Security vulnerability detection method, system and device based on artificial intelligence and medium

Abstract

The invention relates to the technical field of software security detection, in particular to a security vulnerability detection method, system and device based on artificial intelligence and a medium. The method comprises the following steps: firstly, acquiring and preprocessing multi-source software security vulnerabilities to obtain a software security vulnerability data set; secondly, according to a software security vulnerability data set and a model pre-trained on a large-scale universal code data set, calling a neural network to construct an artificial intelligence vulnerability detection model; and finally, according to the vulnerability detection result and the set risk level, the corresponding prevention operation is executed, so that the software security vulnerability detection efficiency and accuracy are greatly improved, and the security risk is reduced.

Description

Technical Field

[0001] This invention relates to the field of software security detection technology, and more specifically, to a security vulnerability detection method, system, device, and medium based on artificial intelligence. Background Technology

[0002] In the wave of digitalization, software has become deeply embedded in all sectors of society, from critical infrastructure to everyday mobile applications, making software security paramount. As software systems become increasingly complex, with lines of code often reaching millions or more, traditional manual inspection methods are inefficient, prone to omissions, and unable to meet the demands of massive code reviews. According to authoritative statistics, economic losses caused by software security vulnerabilities have exceeded 100 billion yuan in the past three years, affecting multiple industries including finance, healthcare, and energy. For example, a well-known financial institution suffered billions of dollars in direct economic losses and severe reputational damage due to an undiscovered vulnerability that led to the leakage of customer information.

[0003] Meanwhile, artificial intelligence (AI) technology is booming, achieving remarkable results in fields such as image recognition and natural language processing. Its powerful data analysis and pattern recognition capabilities provide new opportunities for software security vulnerability detection and prevention. By learning from a large number of vulnerability samples, AI models are expected to accurately identify potential security risks, provide early warnings and prevent attacks, compensate for the shortcomings of traditional detection methods, and build a more robust software security defense. This is of great significance for ensuring the smooth operation of the digital economy and maintaining social stability. Summary of the Invention

[0004] This invention addresses the shortcomings of existing security vulnerability detection methods in terms of efficiency and accuracy by proposing an artificial intelligence-based security vulnerability detection method, system, device, and medium. It constructs an intelligent detection model to automatically analyze software code structure and data flow, accurately locating various security vulnerabilities. Simultaneously, it builds a prevention system that responds in real-time based on the detection results, automatically taking remedial and isolation measures, forming an integrated detection and prevention solution. This significantly improves the efficiency and accuracy of software security vulnerability detection and reduces security risks.

[0005] The specific implementation details of this invention are as follows: An artificial intelligence-based security vulnerability detection method includes the following steps: Step S1: Obtain and preprocess multiple software security vulnerabilities to obtain a software security vulnerability dataset; Step S2: Based on the software security vulnerability dataset and the model pre-trained on a large-scale general code dataset, call the neural network to build an artificial intelligence vulnerability detection model; Step S3: Based on the vulnerability detection results and the set risk level, perform the corresponding preventive actions.

[0006] To better realize the present invention, step S1 further includes the following steps: Step S11: Obtain multi-source software security vulnerabilities, which include software security vulnerabilities in multiple programming languages, multiple application areas, and multiple vulnerability types; Step S12: Label the vulnerability samples of multi-source software security vulnerabilities; Step S13: Clean up the marked multi-source software security vulnerabilities; Step S14: Perform semantic equivalence transformation on the cleaned code snippets of multi-source security vulnerabilities and expand the data scale to construct a software security vulnerability dataset.

[0007] To better implement the present invention, step S14 further includes the following steps: Step S141: Perform semantic equivalence transformation on the cleaned code fragments of multi-source security vulnerabilities to generate new software security vulnerability samples with different code forms; the semantic equivalence transformation includes changing the identifier name of the code fragment, changing the for loop to a while loop and adjusting the if-else branch order, extracting inline code into a function, changing the data type without changing the semantics, and adding, deleting or modifying comments and whitespace characters. Step S142: Create a code template based on the new software security vulnerability sample and expand it to obtain a variant of the new software security vulnerability; Step S143: Construct a software security vulnerability dataset based on the new software security vulnerability variant.

[0008] To better realize the present invention, step S2 further includes the following steps: Step S21: Based on the code structure of the code snippet, call convolutional neural networks and recurrent neural networks to build a security vulnerability detection model; Step S22: Train the security vulnerability detection model based on the constructed software security vulnerability dataset to obtain the trained security vulnerability detection model; Step S23: Introduce transfer learning, optimize the trained security vulnerability detection model based on the model pre-trained on a large-scale general code dataset, and construct an artificial intelligence security vulnerability detection model.

[0009] To better implement the present invention, step S21 further includes the following steps: Step S211: Normalize the code fragment, segment the normalized code fragment, and obtain the code token; Step S212: Convert the code tokens into a sequence, and insert the control flow or data flow as a special token into the code token sequence to obtain a linear code token sequence; Step S213: Invoke the convolutional neural network and slide the convolutional kernel on the linear code token sequence to obtain local security vulnerability features; Step S214: Invoke the recurrent neural network to process the linear code token sequence in both forward and backward directions to obtain global security vulnerability features; Step S215: Combine local and global security vulnerability features, and invoke the attention mechanism and sigmoid function to construct a security vulnerability detection model.

[0010] To better realize the present invention, step S23 further includes the following steps: Step S231: Call the CodeBERT model to pre-train on code-annotation pairs, call the CuBERT model to pre-train on Python code, and call the PLBART model to perform denoising pre-training on code and text; Step S232: Initialize the security vulnerability detection model according to the parameters of the pre-trained model, and set the initialized security vulnerability detection model on top of the pre-trained model to obtain the artificial intelligence security vulnerability detection model; Step S233: Based on the software security vulnerability dataset and the set learning rate, fine-tune the artificial intelligence security vulnerability detection model to obtain the fine-tuned artificial intelligence security vulnerability detection model.

[0011] To better realize the present invention, step S3 further includes the following steps: Step S31: Build a prevention system using a microservice architecture; Step S32: Call the message queue to transmit the detection results to the established prevention system; Step S33: Based on the vulnerability type and severity, set risk scoring rules and construct risk levels; Step S34: If the detected vulnerability is a high-risk vulnerability, then perform isolation operations to prevent the vulnerability from being exploited; if the detected vulnerability is a fixable vulnerability, then call code template matching, semantic analysis to generate a fix plan, and modify the code.

[0012] Based on the aforementioned AI-based security vulnerability detection method, and to better realize this invention, a further AI-based security vulnerability detection system is proposed for executing the aforementioned AI-based security vulnerability detection method; comprising an acquisition unit, a model building unit, and a prevention unit; The acquisition unit is used to acquire and preprocess multi-source software security vulnerabilities to obtain a software security vulnerability dataset. The model building unit is used to call a neural network to build an artificial intelligence vulnerability detection model based on a software security vulnerability dataset and a model pre-trained on a large-scale general code dataset. The protection unit is used to perform corresponding protection operations based on the vulnerability detection results and the set risk level.

[0013] Based on the aforementioned AI-based security vulnerability detection method, and to better realize this invention, an electronic device is further proposed, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the aforementioned AI-based security vulnerability detection method is implemented.

[0014] Based on the aforementioned AI-based security vulnerability detection method, and to better realize this invention, a computer-readable storage medium is further proposed, wherein computer instructions are stored on the computer-readable storage medium; when the computer instructions are executed on the aforementioned electronic device, the aforementioned AI-based security vulnerability detection method is implemented.

[0015] The present invention has the following beneficial effects: (1) This invention provides sufficient and high-quality data for subsequent artificial intelligence model training by constructing a software security vulnerability dataset, so as to improve the generalization ability of the model, enable it to adapt to complex and ever-changing software environments, and accurately identify various potential vulnerabilities.

[0016] (2) This invention constructs an artificial intelligence vulnerability detection model, learns the characteristics of different types of vulnerabilities, introduces transfer learning, and quickly adapts to specific software security fields based on a model that has been pre-trained on a large-scale general code dataset, thereby improving the model training efficiency and detection accuracy and accurately locating hidden security risks in the code.

[0017] (3) By establishing a security policy library, this invention customizes personalized prevention strategies according to software application scenarios and security requirements, thereby achieving dynamic security protection for the entire software lifecycle and minimizing security risks. Attached Figure Description

[0018] Figure 1 This is a schematic flowchart of the security vulnerability detection method based on artificial intelligence provided by the present invention. Detailed Implementation

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments, and therefore should not be regarded as a limitation on the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0021] Example 1: This embodiment proposes a security vulnerability detection method based on artificial intelligence, which specifically includes the following steps: Step S1: Obtain and preprocess multiple software security vulnerabilities to obtain a software security vulnerability dataset; Step S1 specifically includes the following steps: Step S11: Obtain multi-source software security vulnerabilities, which include software security vulnerabilities in multiple programming languages, multiple application areas, and multiple vulnerability types; Step S12: Label the vulnerability samples of multi-source software security vulnerabilities; Step S13: Clean up the marked multi-source software security vulnerabilities; Step S14: Perform semantic equivalence transformation on the cleaned code snippets of multi-source security vulnerabilities and expand the data scale to construct a software security vulnerability dataset.

[0022] Step S14 specifically includes the following steps: Step S141: Perform semantic equivalence transformation on the cleaned code fragments of multi-source security vulnerabilities to generate new software security vulnerability samples with different code forms; the semantic equivalence transformation includes changing the identifier name of the code fragment, changing the for loop to a while loop and adjusting the if-else branch order, extracting inline code into a function, changing the data type without changing the semantics, and adding, deleting or modifying comments and whitespace characters. Step S142: Create a code template based on the new software security vulnerability sample and expand it to obtain a variant of the new software security vulnerability; Step S143: Construct a software security vulnerability dataset based on the new software security vulnerability variant.

[0023] This embodiment constructs a software security vulnerability dataset by comprehensively collecting various software security vulnerability cases, covering different programming languages, application areas, and vulnerability types, such as common pointer vulnerabilities in C language and security configuration vulnerabilities in Java. Vulnerability samples are meticulously labeled, including vulnerability location, cause, and severity level. Data cleaning removes duplicate and erroneous data to ensure dataset quality. Data augmentation techniques, such as semantic equivalence transformation of code snippets, are employed to expand the data scale, providing sufficient and high-quality data for subsequent artificial intelligence model training. This enhances the model's generalization ability, enabling it to adapt to complex and ever-changing software environments and accurately identify various potential vulnerabilities.

[0024] Step S2: Based on the software security vulnerability dataset and the model pre-trained on a large-scale general code dataset, call the neural network to build an artificial intelligence vulnerability detection model; Step S2 specifically includes the following steps: Step S21: Based on the code structure of the code snippet, call convolutional neural networks and recurrent neural networks to build a security vulnerability detection model; Step S21 specifically includes the following steps: Step S211: Normalize the code fragment, segment the normalized code fragment, and obtain the code token; Step S212: Convert the code tokens into a sequence, and insert the control flow or data flow as a special token into the code token sequence to obtain a linear code token sequence; Step S213: Invoke the convolutional neural network and slide the convolutional kernel on the linear code token sequence to obtain local security vulnerability features; Step S214: Invoke the recurrent neural network to process the linear code token sequence in both forward and backward directions to obtain global security vulnerability features; Step S215: Combine local and global security vulnerability features, and invoke the attention mechanism and sigmoid function to construct a security vulnerability detection model.

[0025] Step S22: Train the security vulnerability detection model based on the constructed software security vulnerability dataset to obtain the trained security vulnerability detection model; Step S23: Introduce transfer learning, optimize the trained security vulnerability detection model based on the model pre-trained on a large-scale general code dataset, and construct an artificial intelligence security vulnerability detection model.

[0026] Step S23 specifically includes the following steps: Step S231: Call the CodeBERT model to pre-train on code-annotation pairs, call the CuBERT model to pre-train on Python code, and call the PLBART model to perform denoising pre-training on code and text; Step S232: Initialize the security vulnerability detection model according to the parameters of the pre-trained model, and set the initialized security vulnerability detection model on top of the pre-trained model to obtain the artificial intelligence security vulnerability detection model; Step S233: Based on the software security vulnerability dataset and the set learning rate, fine-tune the artificial intelligence security vulnerability detection model to obtain the fine-tuned artificial intelligence security vulnerability detection model.

[0027] This embodiment develops an artificial intelligence vulnerability detection model. It delves into the application of deep learning and machine learning algorithms in vulnerability detection, such as Convolutional Neural Networks (CNNs), which excel at extracting local code features, and Recurrent Neural Networks (RNNs), which can process code sequence information. Combining the characteristics of software code structure, a hybrid model integrating multiple algorithms is constructed. The model is trained using a training dataset, and its parameters are optimized to enable it to learn the characteristic patterns of different types of vulnerabilities. Transfer learning is introduced, leveraging a model pre-trained on a large-scale general-purpose code dataset to quickly adapt to specific software security domains, improving model training efficiency and detection accuracy, and precisely locating hidden security vulnerabilities in the code.

[0028] Step S3: Based on the vulnerability detection results and the set risk level, perform the corresponding preventive actions.

[0029] Step S3 specifically includes the following steps: Step S31: Build a prevention system using a microservice architecture; Step S32: Call the message queue to transmit the detection results to the established prevention system; Step S33: Based on the vulnerability type and severity, set risk scoring rules and construct risk levels; Step S34: If the detected vulnerability is a high-risk vulnerability, then perform isolation operations to prevent the vulnerability from being exploited; if the detected vulnerability is a fixable vulnerability, then call code template matching, semantic analysis to generate a fix plan, and modify the code.

[0030] This embodiment designs an intelligent vulnerability prevention system based on the output results of a detection model, implementing a real-time response system. When a vulnerability is detected, the system automatically assesses its risk level. For high-risk vulnerabilities, it immediately takes isolation measures to prevent exploitation and the spread of security incidents. For repairable vulnerabilities, it utilizes automated remediation technologies, such as code template matching and semantic analysis, to generate remediation solutions and automatically modify the code. Simultaneously, a security policy library is established to customize personalized prevention strategies based on software application scenarios and security requirements, achieving dynamic security protection throughout the software's entire lifecycle and minimizing security risks.

[0031] Working Principle: This embodiment integrates deep learning and machine learning algorithms to construct an intelligent detection model that can automatically analyze software code structure and data flow to accurately locate various security vulnerabilities, such as buffer overflows, SQL injection, and cross-site scripting attacks. Simultaneously, a supporting prevention system is developed that responds in real time based on the detection results, automatically taking remedial and isolation measures to form an integrated detection and prevention solution. The aim is to significantly improve the efficiency and accuracy of software security vulnerability detection, reduce security risks, provide reliable security guarantees for software developers, enterprises, and users, and contribute to the healthy development of the digital industry.

[0032] Example 2: This embodiment is based on the above embodiment 1, such as... Figure 1 As shown, a specific embodiment will be described in detail.

[0033] This embodiment proposes a security vulnerability detection method based on artificial intelligence, which specifically includes the following steps: Step S1: Obtain and preprocess multiple software security vulnerabilities to obtain a software security vulnerability dataset; Step S1 specifically includes the following steps: Step S11: Obtain multi-source software security vulnerabilities, which include software security vulnerabilities in multiple programming languages, multiple application areas, and multiple vulnerability types; Step S12: Label the vulnerability samples of multi-source software security vulnerabilities; Annotation includes precisely marking vulnerable lines or expressions in code snippets to locate vulnerabilities; describing the root technical reasons for the vulnerabilities in natural language to perform root cause analysis; comparing vulnerable_code_snippets and fixed_code_snippets to identify key points for remediation and annotating remediation solutions; and establishing a cross-review mechanism where another expert reviews the annotation results to ensure accuracy and perform quality verification.

[0034] Step S13: Clean up the marked multi-source software security vulnerabilities; The cleaning operations in this embodiment include deduplication, format standardization, erroneous data removal, and normalization. The deduplication process includes identifying and removing duplicate cases based on CVE ID, code hash value, or code semantic similarity. Standardization of formatting includes unifying code indentation and comment style; Error data removal includes removing invalid data manually or through heuristic rules (such as code that cannot be compiled or vulnerability descriptions that are clearly inconsistent with the code); Step S14: Perform semantic equivalence transformation on the cleaned code snippets of multi-source security vulnerabilities and expand the data scale to construct a software security vulnerability dataset.

[0035] Step S14 specifically includes the following steps: Step S141: Perform semantic equivalence transformation on the cleaned code fragments of multi-source security vulnerabilities to generate new software security vulnerability samples with different code forms; the semantic equivalence transformation includes changing the identifier name of the code fragment, changing the for loop to a while loop and adjusting the if-else branch order, extracting inline code into a function, changing the data type without changing the semantics, and adding, deleting or modifying comments and whitespace characters. Semantic equivalence transformation includes automated or semi-automated transformation of existing vulnerable code snippets to generate new samples with equivalent functionality but different code forms; variable / function renaming: changing identifier names; control flow transformation: changing for loops to while loops, adjusting the order of if-else branches; code structure transformation: extracting inline code into functions, or vice versa; data type transformation: changing data types (e.g., int to long) without changing semantics; comment and whitespace adjustment: adding, deleting, or modifying comments and whitespace characters.

[0036] Step S142: Create a code template based on the new software security vulnerability sample and expand it to obtain a variant of the new software security vulnerability; Step S143: Construct a software security vulnerability dataset based on the new software security vulnerability variant.

[0037] Generating code samples that "appear suspicious but are actually safe" and samples that "appear safe but are actually vulnerable" helps improve the robustness of subsequent machine learning models.

[0038] The data collection and processing in this embodiment involves building a data acquisition platform to capture software code and corresponding vulnerability information from multiple channels, including open-source code repositories, security vulnerability databases, and internal enterprise code. Natural language processing (NLP) technology is used to perform lexical and syntactic analysis on the code, extracting key features and converting them into machine-readable vector representations. Data cleaning tools are used to filter and correct data according to predefined rules. Data augmentation algorithms are employed to transform and combine code vectors, expanding the dataset. Finally, data annotation tools are used to organize professionals to accurately annotate the data, providing a high-quality data foundation for model training.

[0039] Step S2: Based on the software security vulnerability dataset and the model pre-trained on a large-scale general code dataset, call the neural network to build an artificial intelligence vulnerability detection model; Step S2 specifically includes the following steps: Step S21: Based on the code structure of the code snippet, call convolutional neural networks and recurrent neural networks to build a security vulnerability detection model; Step S21 specifically includes the following steps: Step S211: Normalize the code fragment, segment the normalized code fragment, and obtain the code token; The input code snippets are preprocessed, including identifier unification (e.g., unifying variable names to VAR1, function names to FUNC1), constant literal replacement, standardized indentation, and comment removal to reduce noise); the code is segmented into tokens such as keywords, operators, identifiers, and literals to achieve lexical-level multi-granularity tokenization; Byte-PairEncoding or WordPiece algorithms are used to solve the OOV problem and understand the components of unseen identifiers to achieve sub-word-level multi-granularity tokenization. Step S212: Convert the code tokens into a sequence, and insert the control flow or data flow as a special token into the code token sequence to obtain a linear code token sequence; By traversing the AST, such as through depth-first traversal, it is converted into a sequence, preserving structural information, thus achieving AST serialization. Control flow or data flow edges are then inserted as special tokens into the code token sequence, forming an enhanced linear sequence.

[0040] Step S213: Invoke the convolutional neural network and slide the convolutional kernel on the linear code token sequence to obtain local security vulnerability features; This method utilizes CNN branches to capture localized vulnerabilities. The convolutional kernels slide across the code sequence, effectively detecting localized, fixed vulnerability patterns, such as insecure function call sequences like `strcpy(dest, src)` or problematic operator combinations. It is particularly well-suited for detecting vulnerabilities with obvious code patterns, such as CWE-119 (buffer fault) and CWE-78 (command injection). Multiple convolutional kernels of different sizes (e.g., 3, 5, 7) are used to capture different ranges of local context, and their outputs are then fused.

[0041] Step S214: Invoke the recurrent neural network to process the linear code token sequence in both forward and backward directions to obtain global security vulnerability features; RNN branches are invoked to capture long-range context dependencies, using Bi-LSTM or GRU. These can process code sequences in both forward and backward directions, understanding the context across the entire function scope. This is crucial for detecting vulnerabilities such as CWE-200 (Information Disclosure) and CWE-862 (Missing Authorization), which require understanding the overall logic flow of the code.

[0042] Step S215: Combine local and global security vulnerability features, and invoke the attention mechanism and sigmoid function to construct a security vulnerability detection model.

[0043] The local features output from the CNN branch and the global features output from the RNN branch are concatenated. An attention mechanism is applied to the fused features or the RNN output to teach the model to "pay attention" to the code parts most relevant to the vulnerability, thereby enhancing the interpretability of the model. The fused features are then input into a fully connected layer and finally processed by either a Sigmoid (binary classification: vulnerability / security) or Softmax (multi-class classification: specifically CWE type in this embodiment) function.

[0044] Step S22: Train the security vulnerability detection model based on the constructed software security vulnerability dataset to obtain the trained security vulnerability detection model; Step S23: Introduce transfer learning, optimize the trained security vulnerability detection model based on the model pre-trained on a large-scale general code dataset, and construct an artificial intelligence security vulnerability detection model.

[0045] Step S23 specifically includes the following steps: Step S231: Call the CodeBERT model to pre-train on code-annotation pairs, call the CuBERT model to pre-train on Python code, and call the PLBART model to perform denoising pre-training on code and text; The models selected in this embodiment include: CodeBERT / GraphCodeBERT model, which is pre-trained on code-annotation pairs to understand the natural language semantics of code; CuBERT model, which is pre-trained on Python code and focuses on the syntax and semantics of the code itself; and PLBART model, which is based on a sequence-to-sequence architecture and is pre-trained on code and text for denoising, and has strong representation capabilities.

[0046] Step S232: Initialize the security vulnerability detection model according to the parameters of the pre-trained model, and set the initialized security vulnerability detection model on top of the pre-trained model to obtain the artificial intelligence security vulnerability detection model; Initialize the backbone of our model with the parameters of the pre-trained model. For example, replace the embedding layer and part of the encoding layer in the security vulnerability detection model with the CodeBERT model, and then attach a task-specific layer (classification head) on top of it. Then, perform end-to-end fine-tuning on the entire target vulnerability dataset.

[0047] Step S233: Based on the software security vulnerability dataset and the set learning rate, fine-tune the artificial intelligence security vulnerability detection model to obtain the fine-tuned artificial intelligence security vulnerability detection model.

[0048] Set a smaller learning rate for the lower layers of the pre-trained model (to preserve general knowledge), and a larger learning rate for the top layers and newly added classification heads (to quickly adapt to new tasks). During training, train only the classification heads first, and then gradually "unfreeze" and train the higher layers of the pre-trained model.

[0049] This embodiment focuses on model development and optimization. Deep learning frameworks such as TensorFlow and PyTorch are used to build the vulnerability detection model. The basic model is first pre-trained on a general code dataset, and then fine-tuned for a software security vulnerability dataset. During training, optimization algorithms such as stochastic gradient descent are used to adjust model parameters, and cross-validation is used to evaluate model performance. Hyperparameter tuning techniques, such as grid search and random search, are employed to determine the optimal model configuration. Attention mechanisms and adversarial training are introduced to enhance the model's ability to capture key vulnerability features, thereby improving detection accuracy and recall.

[0050] Step S3: Based on the vulnerability detection results and the set risk level, perform the corresponding preventive actions.

[0051] Step S3 specifically includes the following steps: Step S31: Build a prevention system using a microservice architecture; Step S32: Call the message queue to transmit the detection results to the established prevention system; Step S33: Based on the vulnerability type and severity, set risk scoring rules and construct risk levels; Step S34: If the detected vulnerability is a high-risk vulnerability, then perform isolation operations to prevent the vulnerability from being exploited; if the detected vulnerability is a fixable vulnerability, then call code template matching, semantic analysis to generate a fix plan, and modify the code.

[0052] This embodiment describes the construction of a prevention system. The system is built around a detection model and incorporates a microservice architecture. A message queue is used to facilitate communication between detection results and the prevention module, ensuring real-time data transmission. In the risk assessment module, risk scoring rules are established based on factors such as vulnerability type and severity to quantify the risk level. The isolation module prevents vulnerability exploitation through operating system access control and network isolation technologies. The remediation module utilizes code generation technology to match and generate remediation code from a remediation template library based on vulnerability characteristics, achieving automatic vulnerability remediation. All modules work collaboratively to ensure software security.

[0053] Working Principle: This embodiment achieves an accuracy rate of over 95% in detecting common software security vulnerabilities, with a false positive rate controlled below 5%, ensuring accurate identification of real vulnerabilities and reducing interference with normal code. It can handle software projects with millions of lines of code in under 2 hours, significantly improving detection speed and meeting the needs of enterprises for rapid iterative development. It covers at least 80% of known software security vulnerability types, including common high-risk vulnerabilities such as buffer overflows, SQL injection, and XSS, ensuring comprehensive software security. For fixable vulnerabilities, the automatic repair success rate reaches over 80%, effectively reducing manual repair costs and improving vulnerability repair efficiency. The risk assessment results match the actual vulnerability severity with over 90% accuracy, providing a reliable basis for security decisions. It also supports mainstream programming languages ​​such as Java, C / C++, and Python, adapting to different development environments and software architectures, and has broad applicability.

[0054] The other parts of this embodiment are the same as those in Embodiment 1 above, so they will not be described again.

[0055] Example 3: Based on any one of Embodiments 1-2 above, this embodiment proposes an artificial intelligence-based security vulnerability detection system for executing the aforementioned artificial intelligence-based security vulnerability detection method; it includes an acquisition unit, a model building unit, and a prevention unit; The acquisition unit is used to acquire and preprocess multi-source software security vulnerabilities to obtain a software security vulnerability dataset. The model building unit is used to call a neural network to build an artificial intelligence vulnerability detection model based on a software security vulnerability dataset and a model pre-trained on a large-scale general code dataset. The protection unit is used to perform corresponding protection operations based on the vulnerability detection results and the set risk level.

[0056] This embodiment also proposes an electronic device, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the above-described artificial intelligence-based security vulnerability detection method.

[0057] This embodiment also proposes a computer-readable storage medium storing computer instructions; when the computer instructions are executed on the aforementioned electronic device, the aforementioned artificial intelligence-based security vulnerability detection method is implemented.

[0058] The other parts of this embodiment are the same as any one of the above embodiments 1-2, so they will not be described again.

[0059] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. An artificial intelligence-based security vulnerability detection method, characterized by, Specifically comprising the following steps: Step S1: obtaining multi-source software security vulnerabilities and preprocessing to obtain a software security vulnerability dataset; Step S2: according to the software security vulnerability dataset, a pre-trained model on a large-scale general code dataset, calling a neural network to build an artificial intelligence vulnerability detection model; Step S3: according to the vulnerability detection result and the set risk level, performing corresponding prevention operations.

2. The method of claim 1, wherein the method further comprises: The step S1 specifically comprises the following steps: Step S11: obtaining multi-source software security vulnerabilities, the multi-source software security vulnerabilities including software security vulnerabilities of multiple programming languages, multiple application fields and multiple vulnerability types; Step S12: labeling vulnerability samples of the multi-source software security vulnerabilities; Step S13: cleaning the labeled multi-source software security vulnerabilities; Step S14: performing semantic equivalent transformation on the code segments of the cleaned multi-source security vulnerabilities, and expanding the data scale to build a software security vulnerability dataset.

3. The method of claim 2, wherein the method further comprises: The step S14 specifically comprises the following steps: Step S141: performing semantic equivalent transformation on the code segments of the cleaned multi-source security vulnerabilities to generate new software security vulnerability samples with different code forms; the semantic equivalent transformation includes changing the code segment identifier name, changing the for loop to the while loop and adjusting the if-else branch order, extracting the inline code into a function, changing the data type without changing the semantics, adding, deleting or modifying comments and white spaces; Step S142: creating a code template according to the new software security vulnerability sample to expand to obtain a new software security vulnerability variant; Step S143: building a software security vulnerability dataset according to the new software security vulnerability variant.

4. The method of claim 1, wherein the method is based on artificial intelligence. The step S2 specifically comprises the following steps: Step S21: according to the code structure of the code segment, calling a convolutional neural network and a recurrent neural network to build a security vulnerability detection model; Step S22: training the security vulnerability detection model according to the built software security vulnerability dataset to obtain a trained security vulnerability detection model; Step S23: introducing transfer learning, optimizing the trained security vulnerability detection model according to a pre-trained model on a large-scale general code dataset to build an artificial intelligence security vulnerability detection model.

5. The method of claim 4, wherein the method further comprises: The step S21 specifically comprises the following steps: Step S211: normalizing the code segment, segmenting the normalized code segment to obtain code tokens; Step S212: converting the code tokens into sequences and inserting control flow or data flow as special tokens into the code token sequence to obtain a linear code token sequence; Step S213: calling a convolutional neural network, sliding a convolution kernel on the linear code token sequence to obtain local security vulnerability features; Step S214: calling a recurrent neural network to process the linear code token sequence from both forward and backward directions to obtain global security vulnerability features; Step S215: splicing the local security vulnerability features and the global security vulnerability features, and calling an attention mechanism and a Sigmoid function to build a security vulnerability detection model.

6. The method of claim 5, wherein the method further comprises: The step S23 specifically comprises the following steps: Step S231: calling the CodeBERT model pre-trained on code-comment pairs, calling the CuBERT model pre-trained on Python code, and calling the PLBART model pre-trained on code and text for denoising; Step S232: initializing the security vulnerability detection model according to the parameters of the pre-trained model, setting the initialized security vulnerability detection model at the top of the pre-trained model, and obtaining an artificial intelligence security vulnerability detection model; Step S233: fine-tuning the artificial intelligence security vulnerability detection model according to the software security vulnerability dataset and the set learning rate, and obtaining the fine-tuned artificial intelligence security vulnerability detection model.

7. The method of claim 1, wherein the method further comprises: The step S3 specifically includes the following steps: Step S31: calling a micro-service architecture to build a prevention system; Step S32: calling a message queue to transmit the detection result to the built prevention system; Step S33: setting a risk scoring rule according to the vulnerability type and the risk degree, and constructing a risk level; Step S34: if the detected vulnerability is a high-risk vulnerability, performing an isolation operation to prevent the vulnerability from being exploited; if the detected vulnerability is a repairable vulnerability, calling a code template matching, semantic analysis to generate a repair scheme, and modifying the code.

8. An artificial intelligence-based security vulnerability detection system for performing an artificial intelligence-based security vulnerability detection method according to claim 1; characterized in that, It comprises an acquisition unit, a model construction unit and a prevention unit. The acquisition unit is configured to acquire and preprocess multi-source software security vulnerabilities to obtain a software security vulnerability dataset. The model construction unit is configured to construct an artificial intelligence vulnerability detection model by calling a neural network according to the software security vulnerability dataset and a model pre-trained on a large-scale general code dataset. The prevention unit is configured to perform a corresponding prevention operation according to the vulnerability detection result and the set risk level.

9. An electronic device, comprising: The electronic device comprises a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the artificial intelligence-based security vulnerability detection method of any one of claims 1-7 is realized.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device of claim 9, the artificial intelligence-based security vulnerability detection method of any one of claims 1-7 is realized.

Images