A source code security vulnerability semantic detection method based on a large language model

Abstract

The application relates to the technical field of electric digital data processing, and discloses a source code security vulnerability semantic detection method based on a large language model, which comprises the following steps: analyzing to-be-detected source code to extract execution path constraint features, and constructing an orthogonal characteristic basis vector sequence through orthogonal feature extraction; inputting the to-be-detected source code into a large language model to obtain an initial semantic tensor; performing orthogonal projection on the initial semantic tensor to a code security constraint subspace constructed by the orthogonal characteristic basis vector sequence, and performing weighted aggregation in combination with attention weight distribution information entropy to generate a refined semantic vector; and calculating the vector deviation distance between the refined semantic vector and a preset vulnerability feature distribution center; the application uses a logical subspace projection mechanism to eliminate business semantic noise, establishes the association between the detection conclusion and the code execution logic, and improves the precision of identifying hidden logical offset vulnerabilities.

Description

Technical Field

[0001] This invention relates to a semantic detection method for source code security vulnerabilities based on a large language model, belonging to the field of electronic digital data processing technology. Background Technology

[0002] Source code security testing currently occupies a core position in electronic digital data processing, mainly responsible for identifying security risks within the program execution sequence. The current mainstream testing methods rely on static scanning technology, which constructs an abstract syntax tree of the source code and matches it with a pre-built expert rule base. This type of method has high execution efficiency in handling syntax vulnerabilities with known patterns.

[0003] Static rule matching, when processing deep dynamic execution flow vulnerabilities, has a single perception dimension, making it difficult to simultaneously consider semantic depth and path accuracy. For example, Chinese invention patent CN121100335A discloses a method for locating source code vulnerabilities at the lexical level. This method identifies vulnerability lexicals through a classifier and uses positive and negative samples to guide a large language model's judgment. However, this scheme relies on probabilistic semantic matching of lexical sequences and does not establish a hard mathematical correlation between the detection conclusion and the physical execution path. Detection accuracy depends on the coverage of a small number of samples. When handling customized business or hidden logic offset vulnerabilities, it lacks constraints on code execution logic boundaries, making it prone to semantic noise interference and causing feature vector deviation. However... As business logic becomes more complex, security risks are no longer limited to syntactic compliance. Deep vulnerabilities such as logic bypass and implicit privilege escalation often cross function boundaries and exhibit high semantic relevance. Existing static detection methods lack the ability to perceive the logical intent of the code, resulting in a high false negative rate when dealing with the above scenarios. To overcome the shortcomings of semantic understanding, the industry has tried to introduce full language model inference to perform deep semantic encoding on code fragments. Analysis shows that such approaches face constraints in terms of computing power and detection efficiency in practical engineering applications. Simply relying on increasing the sampling frequency or expanding the model size leads to redundant computing resources and lacks traceable physical execution evidence.

[0004] Therefore, how to accurately identify source code vulnerabilities through logical convergence point extraction and semantic intrinsic subspace projection becomes the technical problem to be solved by this invention. Summary of the Invention

[0005] To address the problems mentioned in the background section, the technical solution of this invention is as follows: A source code security vulnerability semantic detection method based on a large language model, comprising the following steps:

[0006] Step 1: Parse the source code to be tested to extract execution path constraint features, which include variable value range data, access control identifiers, and function call sequence constraints.

[0007] Step 2: Perform orthogonal feature extraction processing on the execution path constraint features to construct an orthogonal feature basis vector sequence representing the boundary of code execution logic constraints;

[0008] Step 3: Input the source code to be tested into the preset large language model, and extract features through the encoder of the large language model to obtain the output initial semantic tensor; where the initial semantic tensor represents the semantic distribution pattern of the source code to be tested.

[0009] Step 4: Perform orthogonal projection processing on the initial semantic tensor into the code safety constraint subspace constructed by the orthogonal feature basis vector sequence. By extracting the projection components of the initial semantic tensor in each orthogonal feature basis vector direction, and combining them with the attention weight distribution information entropy generated by the pre-set large language model internal attention mechanism, perform vector weighted aggregation to filter business semantic noise and generate refined semantic vectors.

[0010] Step 5: Calculate the vector deviation distance between the refined semantic vector and the preset vulnerability feature distribution center. The preset vulnerability feature distribution center is determined by the average semantic feature of historical security vulnerability code samples. When the vector deviation distance exceeds the preset offset threshold, it is determined that the source code under test has a logical offset vulnerability.

[0011] Preferably, in step two, the operation of constructing the orthogonal feature basis vector sequence includes: constructing a high-dimensional constraint matrix from the variable value range data, access control identifier, and function call sequence constraint terms; performing singular value decomposition on the high-dimensional constraint matrix to extract the singular value feature space; and selecting a preset number of feature vectors in descending order of singular values ​​to form the orthogonal feature basis vector sequence.

[0012] Preferably, step five further includes: real-time monitoring of the semantic feature changes in the code execution flow and calculating the semantic evolution gradient between adjacent code nodes; combining the information entropy of the attention weight distribution with the semantic evolution gradient to construct dynamic judgment logic and identify unexpected logical pointer mutations that occur in the source code under test during the execution flow evolution process.

[0013] Preferably, the execution process of the dynamic judgment logic includes: establishing a semantic modeling quality assessment model, using the information entropy of attention weight distribution to measure the certainty of semantic extraction; when the certainty is lower than the preset confidence threshold and the semantic evolution gradient undergoes a polarity reversal, marking the current execution node of the source code to be tested as a logic failure risk point.

[0014] Preferably, the method further includes the following steps: Step 6, injecting boundary logic interference items into the data flow path of the source code to be tested, and analyzing the implicit semantic coupling strength hidden in global state sharing by monitoring the semantic feature change rate of non-directly related nodes.

[0015] Preferably, in step six, the operation of identifying implicit logic vulnerabilities includes: inputting boundary condition test cases into the convergence node of the data flow path; extracting the residual distribution data of the response feature tensor of non-directly related nodes relative to the boundary condition test cases; and identifying implicit execution logic vulnerabilities caused by cross-function references based on the residual distribution data.

[0016] Preferably, the method further includes the following steps: Step 7, obtaining the semantic distribution center of the historical version of the source code to be tested; calculating the cumulative semantic offset generated when the incremental code is integrated into the existing code framework; and performing logistic regression prediction based on the cumulative semantic offset in the code version iteration dimension to block the degradation process of the code execution logic.

[0017] Preferably, the obtained vulnerability detection results are output to a preset electronic digital data processing system via a security audit interface to trigger the corresponding security interception action.

[0018] Compared with the prior art, the beneficial effects of the present invention are:

[0019] 1. In the semantic detection of source code security vulnerabilities, the orthogonalized intrinsic basis sequence generated by the physical path constraints of the source code is used to guide the high-dimensional semantic tensor to perform collapse projection to the logical subspace, eliminate business semantic noise that is irrelevant to the security boundary, transform the full feature comparison into precise focusing on the intrinsic logical components, establish a deterministic mathematical correlation between the detection conclusion and the physical execution logic, and enhance the system's ability to identify hidden logical offsets in complex business contexts.

[0020] 2. By integrating the entropy value of the attention weight distribution within the large language model with the semantic evolution slope features across nodes, a dynamic judgment system with quality perception capability is constructed. The entropy value of the attention weight distribution is used to measure the confidence of semantic extraction. Combined with the differential change of the semantic tensor in the data flow, it identifies unexpected evolution direction mutations that occur with logical evolution, effectively distinguishes between code logic vulnerabilities and model understanding deviations, and realizes full lifecycle tracking of long-path logic failure problems.

[0021] 3. By changing the application of large language models from full text prediction to semantic feature mapping and conflict recognition of key nodes, on-demand allocation of computing resources is achieved. The redundancy of business logic is predicted by using feature residual signals during the computing process, and the switching frequency between deep inference mode and lightweight matching mode is automatically adjusted. The saved computing power is redirected to non-typical feature modules, reducing the resource overhead of large-scale engineering implementation while maintaining detection depth, and improving the overall signal-to-noise ratio of the detection system. Attached Figure Description

[0022] Figure 1 This is a flowchart of the source code vulnerability semantic detection process of the orthogonal projection mechanism of this invention;

[0023] Figure 2 This is a time sequence diagram of the entire collaborative interaction of the source code detection system of this invention. Detailed Implementation

[0024] The method claimed in this invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the following embodiments are intended to explain the invention and are not intended to limit the scope of protection of the invention.

[0025] This invention provides a semantic detection method for source code security vulnerabilities based on a large language model. It uses an orthogonalized eigenbase sequence generated from the physical path constraints of the source code as a guide to perform a collapse projection of a high-dimensional semantic tensor onto a logical subspace. This eliminates business semantic noise during electronic digital data processing and establishes a deterministic mathematical correlation between the detection conclusion and the code execution logic. Executed by a computing unit, its core logical architecture includes path skeleton extraction, semantic feature encoding, heterogeneous dimension alignment, consistency conflict detection, and logical offset determination stages. Each stage achieves feature transfer and logical closure through a data flow logical skeleton. Addressing the challenge that source code security in electronic digital data processing depends not only on syntactic compliance but also on the implicit semantic completeness of the logical flow, the processor parses the source code under test to extract execution path constraint features. These features include variable value ranges, access control identifiers, and function call sequence constraints. An abstract syntax tree of the source code is constructed through the compiler front-end. The abstract syntax tree is traversed, and all nodes containing variable assignments and function calls are identified and defined as logical convergence points, thereby extracting the data flow logical skeleton. and the corresponding physical path constraint parameters To address the trade-off between semantic analysis overhead and real-time performance, an orthogonal feature extraction process is employed to extract orthogonal features from execution path constraint features, thereby constructing an orthogonal feature basis vector sequence representing the boundaries of code execution logic constraints. The variable value range data, access control identifiers, and function call sequence constraints are constructed into a high-dimensional constraint matrix. Singular value decomposition is performed on the high-dimensional constraint matrix to extract the singular value feature space. A predetermined number of feature vectors are selected in descending order of singular values ​​to form an orthogonal feature basis vector sequence. ,in, Indicates the first orthogonal eigenbase vectors To obtain a preset number of feature vectors and to acquire deep features representing the logical intent of the code, the processor inputs the source code to be tested into a preset large language model and obtains the initial semantic tensor output by the encoder of the preset large language model. The context code window data of the logical convergence points is obtained, and it is input into the language model fine-tuned with a secure corpus. The state vector of the logical convergence points in the hidden layer is extracted as the initial semantic tensor. .

[0026] To address the interference of redundant business semantics in the initial semantic tensor on security boundary determination, the processor will... Towards the orthogonal eigenvector sequence The constructed code safety constraint subspace undergoes orthogonal projection processing to extract the initial semantic tensor. In each orthogonal eigenvector The projection components in the direction, combined with the information entropy of the attention weight distribution generated by the pre-defined multi-head attention mechanism within the large language model. Perform weighted aggregation of vectors to generate refined semantic vectors. Among them, the information entropy of the attention weight distribution The calculation is used to characterize the certainty of the model's semantic understanding of the node. When the certainty is lower than a preset confidence threshold, a semantic compensation strategy is automatically triggered, and the attention weight distribution information entropy is established through the following procedure. With weighting coefficients used for weighted aggregation Deterministic correlation between them, setting weighting coefficients Information entropy of attention weight distribution They are negatively correlated, and the weighting coefficients are calculated using the mapping operator. ,in, These are weighting coefficients. The information entropy of the attention weight distribution is calculated using weighting coefficients. The orthogonal projection components are weighted by magnitude to reduce the influence of each feature component on refining the semantic vector when the attention distribution tends to diverge, i.e., when model uncertainty increases. The contribution weights are calculated by the processor to quantify the degree of matching between semantic intent and physical implementation. With preset vulnerability feature distribution center Vector deviation distance between Preset vulnerability feature distribution center The semantic vector is determined by the mean of the semantic features of historical security vulnerability code samples, and the processor calculates a refined semantic vector. With verification tensor Spatial consistency coefficient Verify tensor Physical path constraint parameters The spatial consistency coefficient is obtained through linear transformation operator mapping. The calculation formula is as follows: When the spatial consistency coefficient Less than the preset consistency threshold or vector deviation distance When the preset offset threshold is exceeded, the processor outputs a security risk assessment instruction for the source code, determining that the source code under test has a logical offset vulnerability; the processor executes a deterministic generation procedure for the ideal evolution vector to extract physical path constraint parameters. The logical branch transition identifier contained herein will be used to verify the starting and ending points of the tensor. As input, a preset linear transformation operator matching the logical branch transition identifier is invoked. Through calculation The ideal evolution vector of the current node under the safe path topology is obtained, where, For the ideal evolution vector, For the preset linear transformation operator, To verify the tensor, thus providing a definite execution basis for semantic gradient comparison between adjacent code nodes.

[0027] For deep logic bypass vulnerabilities that cross function boundaries and exhibit semantic correlation, we monitor the changes in semantic features in the code execution flow in real time, calculate the semantic evolution gradient between adjacent code nodes, and the processor follows the logical skeleton of the data flow. Semantic difference features between adjacent logical convergence points are extracted to generate actual logical evolution vectors. Based on the logical transformation operators in the physical path constraints, the corresponding ideal evolution vectors are obtained. The processor determines whether the directional deviation between the actual and ideal evolution vectors is within a safe range, thereby identifying unexpected logical pointer mutations occurring during the execution flow evolution process. The processor performs boundary logic interference injection and response extraction processing according to the following procedure, identifying logical nodes in the source code under test that involve global state sharing and setting them as sensitive convergence points, and retrieving physical path constraint parameters. Using the endpoints of the corresponding variable's range as input, a virtual semantic perturbation vector representing the logical boundary characteristics is constructed. Monitor the hidden layer state response of non-physically connected nodes and calculate the semantic feature residual distribution data of non-associated nodes before and after interference injection. ,in, For residual distribution data, The feature vectors of non-associated nodes after the injection of interference. Given the feature vectors in the baseline state, the processor operates on the residual distribution data. When the preset coupling strength threshold is exceeded, an implicit logical dependency vulnerability involving cross-function references is identified. In a continuous integration environment, to prevent logical degradation caused by incremental code integration into the existing framework, the processor obtains the semantic distribution center of the historical versions of the source code under test, calculates the cumulative semantic offset generated during incremental code integration, and extracts the initial semantic tensor. With verification tensor The semantic residual vector between the two is used to perform logistic regression prediction by utilizing the semantic inertia offset of the semantic residual vector relative to the logical evolution trend line. When the semantic inertia offset is in a unidirectional polarization state, a logical degradation warning instruction is output to block the degradation process of the code execution logic. The obtained vulnerability detection results are output to the preset electronic digital data processing system through the security audit interface to trigger the corresponding security interception action.

[0028] The construction of high-dimensional constraint matrices is achieved by transforming abstract code logic into a numerical grid with a fixed topological structure. Specifically, the processor maps variable value ranges to a normalized feature bitmap of 1024 bits, where each bit corresponds to a preset numerical segment, representing the value trend of the variable in physical storage; access control identifiers are assigned discrete level weight coefficients (ranging from 0.1 to 1.0) with increasing amplitude according to their corresponding security levels; and function call sequences are converted into directional unit vector chains according to the topological order of program execution. Feature data are orthogonally assembled in the spatial dimension to form an initial high-dimensional constraint matrix. The construction of this matrix ensures that each set of feature components has a definite physical origin in the subsequent singular value decomposition, representing three types of physical constraint boundaries: variable boundaries, access barriers, and logical flow directions. The injected boundary logic perturbation term manifests as ±10% edge perturbation on the input data value range. This perturbation is similar to a step test in a physical system, aiming to detect the state stability of the code system. The processor calculates the residual distribution before and after the perturbation by monitoring the response feature tensors of indirectly related nodes. According to the root mean square value of energy, if the value exceeds a preset normalization unit of 0.015, it indicates abnormal high-frequency semantic coupling between non-physically connected nodes. This coupling physically represents the implicit data leakage or privilege escalation risk of cross-function references in the system. By adjusting the pulse width of the interference term, the system can locate the implicit execution logic defects hidden in global state sharing. The semantic evolution gradient is defined as the instantaneous displacement vector of adjacent logical convergence points in the feature space. The system establishes a sliding time window with a length of 5 logical nodes to monitor the magnitude of this vector in real time. The so-called polarity reversal refers to the critical state where the cosine of the angle between the evolution vector of the current node and the evolution vector of the previous node crosses a threshold, that is, the vector direction undergoes a drastic deflection of more than 170 degrees. This physical characteristic usually corresponds to an abnormal redirection of the execution flow in the code due to buffer overflow or logic hijacking. When the processor detects this directional change and it is accompanied by divergent fluctuations in the information entropy of the attention weight (fluctuation amplitude greater than 0.25), the system will trigger a feedback response path, immediately locking the node as a physical execution logic failure point, thereby blocking the potential vulnerability triggering link.

[0029] Example 1: In a high-concurrency financial transaction logic processing system, when the source code involves multi-layered nested asynchronous permission verification and global cache state synchronization, traditional static matching tools suffer from detection blind spots because they cannot cross the closure boundaries of asynchronous callback functions. At this time, normal business logic flow and unexpected privilege escalation execution paths exhibit high similarity at the code text level, making syntax pattern-based identification methods unable to effectively distinguish between legitimate business operations and potential logic bypass behaviors. To locate the security risks under this condition, the processor extracts execution path constraint features involving transaction amount reconciliation and user identity token updates from the source code under test; it parses and obtains variable value range data, access control identifiers, and function call sequence constraint terms at each logic convergence point, and constructs the corresponding high-dimensional constraint matrix. The processor then performs singular value decomposition on the high-dimensional constraint matrix to construct an orthogonal feature basis vector sequence. ,in, It is a sequence of orthogonal eigenvectors. For the first orthogonal eigenbase vectors To determine the number of orthogonal feature basis vectors, the processor simultaneously acquires an initial semantic tensor representing the distribution pattern of business intent. .

[0030] In this scenario, because the code contains a large amount of financial statistics and business descriptions, the initial semantic tensor... There is internal semantic noise. By performing orthogonal projection processing, the initial semantic tensor is... Towards the orthogonal eigenvector sequence Projecting the constructed code security constraint subspace onto the initial semantic tensor to compute the initial semantic tensor. In each orthogonal eigenvector By removing the projected components in the direction and discarding the business semantic components that are irrelevant to the security boundary, a refined semantic vector is generated. The processor calculates and refines semantic vectors. Vector deviation distance between the target vulnerability feature distribution center and the target vulnerability feature distribution center The specific calculation formula is as follows: ,in, The vector deviation distance. To refine semantic vectors in the first Components of each dimension To pre-determine the distribution center of vulnerability features in the th Components of each dimension This represents the total number of dimensions in the feature space; under this condition, although the code syntax conforms to the standard permission call format, its projected refined semantic vector... It exhibits a trend of deviating from the safety logic baseline, generating an offset exceeding the preset threshold. Vector deviation distance The processor bases its decisions on the vector deviation distance. The numerical determination of code reveals a logical offset vulnerability in the asynchronous callback processing stage. This allows for accurate localization of complex logical vulnerabilities across function boundaries without performing full business semantic reasoning. Execution path constraint features obtained from static analysis provide logical anchors for the high-dimensional semantic tensors extracted by the language model. The pre-set large language model supplements the originally sparse physical path constraints with intent representations. The two achieve spatial alignment of heterogeneous data through an orthogonal projection mechanism. This approach reconstructs code text and execution logic, which were originally difficult to compare directly, into a geometric distance metric within a unified security constraint subspace. This transforms the logical consistency review task into a deterministic numerical deviation calculation, ensuring the security of the electronic digital data processing system when processing complex business code.

[0031] Example 2: In an experimental environment verifying the ability to identify logic offset vulnerabilities, the experiment aimed to test the detection stability of the method of the present invention when facing different code nesting depth gradients. The experiment was conducted on a high-performance computing node equipped with a graphics processor with at least 24GB of video memory to support the operation of a pre-set large language model. The experimental dataset was derived from a publicly known security vulnerability benchmark library and mixed with anonymized real financial transaction code. The goal was to construct an orthogonal feature basis vector sequence representing the execution logic. The processor determines the number of intrinsic dimensions. The value selection logic, the number of intrinsic dimensions The setting of this parameter needs to balance the fidelity of semantic reconstruction with the expenditure of computing resources. Since the main technical factors affecting the value of this parameter include the function call hierarchy of the source code under test and the complexity of variable dependencies, the processor needs to strike a balance between ensuring the capture of deep path features and maintaining real-time detection. When the function call hierarchy of the source code under test increases, the number of intrinsic dimensions increases in order to extract finer-grained logical constraint components. It tends to the upper limit of the range of values.

[0032] For the nested code scenario with an average depth of 5 levels in this experiment, the number of intrinsic dimensions was set. The value is 16; the preset offset threshold is... The selection is based on the vector deviation distance of the system on 100 sets of known security code samples. The distribution range is determined, and the vector deviation distance is taken. Three times the standard deviation of the mean of the safe sample set distribution was used as the numerical boundary for judging logical offset; the processor actively injected Gaussian white noise with a signal-to-noise ratio of 15dB during data acquisition to simulate non-standard comments, redundant variable declarations, and irregular indentation perturbations introduced by developers when writing code, thus verifying the refined semantic vector. Anti-interference performance in a real development environment; during the test, the sample group of this invention adopted the orthogonal projection procedure mentioned above, while the control group adopted the full language model inference method and the direct semantic matching method without orthogonal projection processing respectively. The processor monitors and records the detection response data under different vulnerability intensity gradients in real time. The vulnerability intensity gradient is set by adjusting the concealment of illegal logic bypass path in the code and the distance of cross function calls, covering three levels of risk scenarios: low, medium and high.

[0033] Table 1: Gradient Experiment Response Data Checklist

[0034]

[0035] The parameters listed in Table 1 have the following meanings: nesting depth represents the number of levels of function calls in the source code; initial semantic variance is used to characterize the initial semantic tensor output by the large language model. The degree of dispersion of distribution across various dimensions; refined semantic offset To refine semantic vectors Vector deviation distance between the target vulnerability feature distribution center and the target vulnerability feature distribution center; consistency coefficient Represents a refined semantic vector Verification tensor generated by mapping physical path The cosine similarity between them; the data shows that as the nesting depth increases, the initial semantic tensor... The internal business semantic noise expands accordingly, causing the initial semantic variance to show an upward trend. However, after performing orthogonal projection processing onto the code safety constraint subspace, the generated refined semantic vector... It can eliminate business logic components that are irrelevant to the security boundary, thus reducing the vector deviation distance. It exhibits a regular growth pattern that matches the nesting depth; in samples with a nesting depth of 5 levels or more, the consistency coefficient... By reducing and triggering the early warning logic, compared to the control group that did not perform orthogonal projection, the false negative rate of the sample group in this invention decreased from 18.5% to 3.2% under noisy conditions, confirming the effectiveness of the orthogonal projection mechanism in extracting the intrinsic features of logic; when the nesting depth exceeds 12 levels, the semantic vector is refined. With verification tensor Spatial consistency coefficient The slowing rate of decline indicates that the efficiency of projecting high-dimensional semantic tensors onto low-dimensional physical constraints is approaching saturation, the system's recognition accuracy is stabilizing, and further increases in computing resources cannot yield proportional performance gains.

[0036] Example 3: This example combines Figures 1 to 2 This section describes a semantic detection method for source code security vulnerabilities based on a large language model, such as... Figure 1As shown, the process begins with step one, parsing the source code to be tested to extract execution path constraint features. These features specifically include variable value ranges, access control identifiers, and function call sequence constraints. Step two involves orthogonalizing these features to construct an orthogonal feature basis vector sequence that represents the boundaries of the code execution logic constraints. Next, step three inputs the source code to be tested into a pre-defined large language model to obtain an initial semantic tensor output by the encoder of the pre-defined large language model, representing the semantic distribution patterns of the code. Based on this, step four proceeds to step four, transforming the initial semantic tensor into orthogonal feature basis vectors. The code security constraint subspace constructed by the vector sequence undergoes orthogonal projection processing. By extracting the projection components of the initial semantic tensor in the directions of each orthogonal feature basis vector, and combining them with the information entropy of the attention weight distribution generated by the internal attention mechanism of the preset large language model, vector weight aggregation is performed to filter business semantic noise and generate refined semantic vectors. Finally, step five is executed to calculate the vector deviation distance between the refined semantic vector and the preset vulnerability feature distribution center. The preset vulnerability feature distribution center is determined by the mean of the semantic features of historical security vulnerability code samples. When the vector deviation distance exceeds the preset offset threshold, it is determined that the source code under test has a logical offset vulnerability.

[0037] like Figure 2 As shown, the interaction sequence of this detection system begins with the user or developer submitting the source code to be tested to the detection system. The detection system sends the source code to the code parser for parsing. After the code parser internally constructs an abstract syntax tree and identifies logical convergence points, it returns execution path constraint features to the detection system. The detection system then performs orthogonal feature extraction and constructs an orthogonal feature basis vector sequence. At the same time, the source code to be tested is input into a large language model, which returns an initial semantic tensor after being processed by the encoder. The detection system initiates execution orthogonal projection processing, and the data flows to the vulnerability analyzer, which extracts the projection components and weights and aggregates them to generate a refined semantic vector, and then calculates the vector deviation distance. When the deviation distance exceeds the threshold, a logical offset vulnerability is determined to exist. The vulnerability analyzer outputs the vulnerability detection result and sends it to the security audit interface to trigger the corresponding security interception action. Conversely, when the deviation distance is within the safe range, the code is determined to be safe, and the detection system finally returns the conclusion that the security detection has passed to the user or developer.

[0038] Example 4: In an electronic digital data processing system designed to defend against indirect privilege escalation injection attacks, the source code involves object references and permission token passing across multiple class instances. Traditional static parsing tools extract basic physical path constraint parameters. However, because this constraint exhibits a sparse distribution during the deep evolution of code logic, the system struggles to determine which components in high-dimensional semantic features are subject to security boundary restrictions. This leads to uncertainty risks in the security assessment task. Therefore, the initial state is determined, the target is identified as the permission verification logic block in the source code under test, and the processor's operating frequency is set to be no less than 2.5 GHz to support matrix operations. The processor determines the verification tensor according to the following procedure. Extract physical path constraint parameters The variable values ​​in the data are taken from a range and normalized, and the dimension is constructed as follows: Constrained eigenvectors ,in, This refers to the total number of security sub-items involving permission levels and execution order; the processor invokes a preset linear transformation matrix. Acting on the constrained eigenvector The verification tensor used for spatial consistency verification is calculated. The specific calculation formula is as follows: ,in, To verify the tensor, For pre-calibrated linear transformation matrix operators, To constrain feature vectors; through this matrix mapping procedure, the processor maps discrete physical path constraints to a numerical tensor space aligned with the semantic features of the large language model; linear transformation matrix The data was obtained through comparative learning training, selecting 100,000 sets of source code fragments and their corresponding physical path constraint parameters. To train the sample set, the physical path constraint parameters are... Normalization of variable value ranges, permission levels, and function call depth is performed, and the construction dimension is... Constrained eigenvectors ,in This represents the total number of safety sub-items and constrains the feature vector. Input a three-layer fully connected multilayer perceptron network, and minimize the output vector and the initial semantic tensor of a pre-defined large language model at the corresponding code node. Adjust network weights based on mean squared error until the loss function converges. Below the threshold, the parameters of the multilayer perceptron network are extracted as a linear transformation matrix. The symbolic physical path constraints are linearly mapped to a 768-dimensional semantic tensor space, generating a semantic tensor that is identical to the initial one. Dimensional alignment verification tensor .

[0039] The processor synchronously acquires the hidden layer states of a pre-defined large language model to extract the initial semantic tensor. The pre-defined large language model employs a Transformer encoder architecture with 12 attention heads. The processor retrieves the 768-dimensional hidden vector output from the 12th layer of the encoder as the initial semantic tensor. Through orthogonal projection processing, the information entropy of the attention weight distribution generated by the pre-set multi-head attention mechanism within the large language model is calculated. The specific calculation formula is as follows: ,in, For the information entropy of the attention weight distribution, For the first The weight score assigned to each attention point at the current logical convergence point. The total number of attention heads; information entropy distributed using attention weights. The determinism of semantic extraction is measured, and information entropy is distributed based on attention weights. We construct weighted coefficients to perform vector weighted aggregation on each orthogonal projection component, generating a refined semantic vector. This enables the extraction of logical intrinsic components when processing code containing non-security business descriptions; weighting coefficients Determine the temperature smoothing coefficient introduced in the process. Calibration is achieved by monitoring the information entropy of the attention weight distribution on the validation set. The range of values, the weighting coefficients Set as Temperature smoothness coefficient The values ​​are selected based on the 95th percentile of the entropy distribution of the security code sample under normal logical branches. The contribution of the output entropy of large-scale language models to the vector weighting and aggregation process is adjusted. When the attention distribution diverges, the weighting coefficient is reduced. Suppressing Refined Semantic Vectors Sino-African intrinsic semantic components; processor computes refined semantic vectors With verification tensor Spatial consistency coefficient When the spatial consistency coefficient Less than the preset consistency threshold When the processor marks the source code under test as having a logical offset risk, the vulnerability detection logic changes from probabilistic inference to quantitative tensor geometric distance measurement based on security constraint subspace, thus eliminating interference caused by business semantic redundancy and ensuring the reliability of source code vulnerability detection tasks in the electronic digital data processing system, due to the establishment of a transformation mapping between physical path constraints and semantic space.

[0040] Example 5: In a processing system that needs to defend against memory corruption vulnerabilities, the processor calls a benchmark library containing 500 annotated vulnerability code samples, extracts the projection features of each vulnerability sample in the security constraint subspace, and generates a refined semantic vector sequence. ,in, Indicates the first Refined semantic vectors of a vulnerability sample. As a sample index, a preset vulnerability feature distribution center is generated by calculating the arithmetic mean of the components of each sample vector in the feature space. This allows for the determination of clustering benchmarks for vulnerability features in the feature space; and the pre-defined distribution centers of vulnerability features are also used. The vulnerability was determined through clustering calculations on the security vulnerability codebase. -The mean clustering algorithm generates refined semantic vectors from historical security vulnerability code samples. Classification, based on the cause of the vulnerability: For each cluster, the arithmetic mean of the feature vectors within the cluster is calculated as the distribution center of the corresponding vulnerability category. ,in For vulnerability category indexing, a preset offset threshold is set. By statistically analyzing the vector deviation distances of 500 sets of known secure code samples within the corresponding vulnerability security constraint subspace... Determine and calculate the vector deviation distance. Distribution mean With distribution standard deviation Set the preset offset threshold Set as .

[0041] When the system is deployed in a code review environment that integrates external plugins, the processor selects source code with valid access permissions as a reference baseline and monitors the vector deviation distance generated at 10 independent sampling points of the reference baseline. Calculate the vector deviation distance Distribution mean on the reference baseline sample set With distribution standard deviation According to the formula Determine the preset offset threshold ,in, For the preset offset threshold, The mean of the vector deviation distance distribution. The processor calculates the standard deviation of the vector deviation distance based on a preset offset threshold. A logical offset determination boundary is established, and each processing unit of the system performs consistency conflict detection on the online input source code to be tested based on the logical offset determination boundary.

[0042] Example 6: In a scenario where a vulnerability detection system is integrated into a project library with heterogeneous code modules, to establish a benchmark for the current computing environment and eliminate uneven feature energy distribution caused by fluctuations in hardware computing precision, the processor executes a project-level pre-calibration procedure. It selects 200 logical nodes from the current project as calibration samples and monitors the vector distribution of these calibration samples at the 12th hidden layer of a pre-defined large language model. This process calculates the semantic energy benchmark for the current project environment. The specific calculation formula is as follows: ,in, As a semantic energy benchmark, To calibrate the total number of samples, For the first The initial semantic tensor of each calibration sample is used with a semantic energy benchmark. Amplitude scaling is performed on the initial semantic tensor of the online input source code to ensure the numerical stability of component extraction during subsequent orthogonal projection.

[0043] When the system encounters operating conditions involving low-level hardware driver logic and increased logic density, an adaptive fine-tuning procedure for logic density is executed to determine the number of intrinsic dimensions. The average physical path complexity of the logical convergence point within the processor statistics submodule. And based on average physical path complexity Adjusting the number of intrinsic dimensions The value of is determined when the average physical path complexity When the value exceeds a preset threshold, the processor will reduce the number of intrinsic dimensions. The value is set to offset 32 ​​from the upper limit of its range to increase the weight of the physical constraint intrinsic components within the code safety constraint subspace. The processor performs 5 loop iterations on the verification sample set and monitors the spatial consistency coefficient. The processor fixes the current linear transformation matrix when the fluctuating residual converges to below 0.005. And determine the corresponding decision boundaries; in the industrial development scenario of continuous integration, the processor executes a stability monitoring procedure for the cumulative semantic offset, sets the sliding monitoring window length to 5 code commit versions, extracts the cumulative semantic offset of each version relative to the semantic distribution center of historical versions and constructs a temporal evolution sequence, and performs linear regression fitting on the temporal evolution sequence to obtain the semantic evolution slope. When the semantic evolution slope If three consecutive versions maintain positive growth and their absolute value exceeds the preset polarization growth threshold of 0.05, the current code framework is determined to have a risk of unidirectional semantic degradation and a preventive refactoring instruction is output.

[0044] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0045] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A source code security vulnerability semantic detection method based on a large language model, characterized in that, Includes the following steps: Step 1: Parse the source code to be tested to extract execution path constraint features, which include variable value range data, access control identifiers, and function call sequence constraints. Step 2: Perform orthogonal feature extraction processing on the execution path constraint features to construct an orthogonal feature basis vector sequence representing the boundary of code execution logic constraints; Step 3: Input the source code to be tested into the preset large language model, and extract features through the encoder of the large language model to obtain the output initial semantic tensor; where the initial semantic tensor represents the semantic distribution pattern of the source code to be tested. Step 4: Perform orthogonal projection processing on the initial semantic tensor into the code safety constraint subspace constructed by the orthogonal feature basis vector sequence. By extracting the projection components of the initial semantic tensor in each orthogonal feature basis vector direction, and combining them with the attention weight distribution information entropy generated by the pre-set large language model internal attention mechanism, perform vector weighted aggregation to filter business semantic noise and generate refined semantic vectors. Step 5: Calculate the vector deviation distance between the refined semantic vector and the preset vulnerability feature distribution center. The preset vulnerability feature distribution center is determined by the average semantic feature of historical security vulnerability code samples. When the vector deviation distance exceeds the preset offset threshold, it is determined that the source code under test has a logical offset vulnerability.

2. The source code security vulnerability semantic detection method based on a large language model according to claim 1, characterized in that, In step two, the operation of constructing the orthogonal feature basis vector sequence includes: constructing a high-dimensional constraint matrix from the variable value range data, access control identifier, and function call sequence constraint terms; performing singular value decomposition on the high-dimensional constraint matrix to extract the singular value feature space; and selecting a preset number of feature vectors in descending order of singular values ​​to form the orthogonal feature basis vector sequence.

3. The source code security vulnerability semantic detection method based on a large language model according to claim 1, characterized in that, Step five also includes: real-time monitoring of semantic feature changes in the code execution flow and calculation of semantic evolution gradients between adjacent code nodes; combining attention weight distribution information entropy and semantic evolution gradients to construct dynamic judgment logic to identify unexpected logical pointer mutations that occur in the source code under test during the execution flow evolution process.

4. The source code security vulnerability semantic detection method based on a large language model according to claim 3, characterized in that, The execution process of dynamic judgment logic includes: establishing a semantic modeling quality assessment model, using the information entropy of attention weight distribution to measure the certainty of semantic extraction; when the certainty is lower than the preset confidence threshold and the semantic evolution gradient undergoes a polarity reversal, marking the current execution node of the source code to be tested as a logic failure risk point.

5. The source code security vulnerability semantic detection method based on a large language model according to claim 1, characterized in that, It also includes the following steps: Step 6: Inject boundary logic interference items into the data flow path of the source code under test, and analyze the implicit semantic coupling strength hidden in global state sharing by monitoring the semantic feature change rate of non-directly related nodes.

6. The source code security vulnerability semantic detection method based on a large language model according to claim 5, characterized in that, In step six, the operations for identifying implicit logic vulnerabilities include: inputting boundary condition test cases into the convergence node of the data flow path; extracting the residual distribution data of the response feature tensor of non-directly related nodes relative to the boundary condition test cases; and identifying implicit execution logic vulnerabilities caused by cross-function references based on the residual distribution data.

7. The source code security vulnerability semantic detection method based on a large language model according to claim 1, characterized in that, It also includes the following steps: Step 7: Obtain the semantic distribution center of the historical versions of the source code to be tested; calculate the cumulative semantic offset generated when the incremental code is integrated into the existing code framework; perform logistic regression prediction based on the cumulative semantic offset in the code version iteration dimension to block the degradation process of the code execution logic.

8. The source code security vulnerability semantic detection method based on a large language model according to claim 1, characterized in that, The obtained vulnerability detection results are output to the preset electronic digital data processing system via the security audit interface to trigger the corresponding security interception action.

Images