Automatic code auditing method based on large model and multiple agents

Abstract

The invention relates to an automatic code auditing method based on a large model and multiple agents, and belongs to the field of computer software security and artificial intelligence. Comprising the following steps: identifying a multi-dimensional category of a source code to be audited; dynamically selecting a plurality of agents from the agent pool by a large language model according to a multi-dimensional category, and executing auditing analysis on the code in parallel; after auditing, each agent submits an independent structured sub-auditing report; the report integration module is used for summarizing, deduplication, priority ranking and conflict resolution of all the sub-audit reports; and calling the large language model to generate a final total audit report, and using user feedback for iterative optimization of the intelligent agent. Through a multi-agent collaborative architecture driven by a large model, the contradiction between high false alarm of a traditional tool and high missing report of a general model is solved, and the expandability and the adaptive evolution ability of the system are realized while the auditing accuracy and efficiency are improved.

Description

Technical Field

[0001] This invention relates to an automated code auditing method based on large models and multiple agents, belonging to the fields of computer software security and artificial intelligence technology. Background Technology

[0002] In today's software development field, code auditing is a crucial step in ensuring software quality and security, but it faces significant challenges in terms of efficiency and accuracy. Existing technologies mainly rely on traditional static code analysis (SAST) tools. These tools perform pattern matching through pre-defined rule bases, which can uncover some known issues. However, their rigid rules are difficult to adapt to changing programming paradigms, and they lack an understanding of the deep context of the code and the developer's intent, resulting in high false positive and false negative rates, leading to "alarm fatigue."

[0003] With the development of large language models (LLMs), directly utilizing them for code analysis has become an emerging approach. Large models, with their superior natural language understanding capabilities, offer new possibilities for automated code auditing. However, directly applying general-purpose large models to this task faces two core challenges. First, while general-purpose models possess broad but not deep knowledge, their auditing capabilities for complex and hidden vulnerabilities in specific languages ​​or frameworks are inferior to those of domain experts, resulting in a higher risk of missed detections. Second, limited by context windows, general-purpose models struggle to perform holistic and consistent analysis of large codebases, easily losing cross-module global information.

[0004] Therefore, existing code auditing solutions are caught in a fundamental trade-off between "depth of specialization" and "breadth of context." Neither adding rules to traditional tools nor fine-tuning general models can fundamentally resolve this contradiction. There is an urgent need in this field for a completely new systematic architecture that can organically combine the deep analytical capabilities of specialized models with the macro-reasoning capabilities of general models, ensuring high accuracy and recall while possessing good scalability to adapt to the continuously evolving technological ecosystem. Summary of the Invention

[0005] The technical problem to be solved by this invention is that it provides an automated code auditing method based on a large model and multiple agents to solve the problems of insufficient accuracy, limited coverage, poor scalability and low report quality in existing code auditing technologies. This invention also solves the contradiction between high false positives in traditional tools and high false negatives in general models, thereby improving auditing accuracy and efficiency while realizing the scalability and adaptive evolution capability of the system.

[0006] The technical solution of this invention is: This invention provides an automated code auditing method based on large models and multiple agents, the method comprising:

[0007] Identify the multidimensional categories of the source code to be audited;

[0008] A large language model dynamically selects multiple agents from a pool of agents to perform audit analysis on the code in parallel based on multidimensional categories;

[0009] After the audit, each agent submits an independent structured sub-audit report; the report aggregation module summarizes, deduplicates, prioritizes, and resolves conflicts among all sub-audit reports.

[0010] A final audit report is generated by calling a large language model, and user feedback is used to iteratively optimize the agent.

[0011] Furthermore, the method includes the following specific steps:

[0012] S1. Code reception and intelligent classification through vectorized representation and multidimensional classification:

[0013] The system receives the source code to be audited through the input interface; then, the multi-dimensional code classification module analyzes the source code to be audited and assigns it multi-dimensional classification labels.

[0014] S2. Collaborative auditing through dynamic task scheduling driven by a large language model:

[0015] The central scheduling engine acts as the overall commander, dynamically selecting a subset of intelligent agents from the pool based on multi-dimensional classification labels. Subsequently, the central scheduling engine assigns audit tasks to the selected intelligent agents, which then perform audit analysis on the code in parallel.

[0016] S3. Summarize and analyze the aggregation, prioritization, and conflict resolution findings in the sub-audit reports:

[0017] After each agent completes its audit, it generates a structured sub-audit report. The report aggregation module collects all these sub-audit reports and performs summarization, deduplication, priority sorting, and potential conflict resolution.

[0018] S4. Generate and deliver the final audit report by constructing condition-based narrative reports and remediation plans:

[0019] After comprehensively analyzing the sub-audit reports, the report integration module calls the large language model to integrate the scattered technical findings into a logically coherent final audit report containing actionable remediation recommendations, and delivers it to the user.

[0020] S5. Feedback and adaptive evolution are achieved through closed-loop learning based on human feedback:

[0021] A feedback mechanism is provided, allowing users to evaluate the audit results; this human feedback is used as new training data to iteratively optimize the corresponding agent.

[0022] Furthermore, S1 specifically includes:

[0023] S11. Preprocess and vectorize the input source code to be audited:

[0024] First, the source code to be audited is received and preprocessed, including removing code comments and standardizing whitespace characters. Then, the preprocessed code text stream is decomposed into a sequence of terms.

[0025] Subsequently, a pre-trained code model based on the Transformer architecture is selected to process the word sequence; a deep contextualized code vector representation is generated by calculating the importance weight of each word in the word sequence to all other words; this process is implemented using scaled dot product attention.

[0026]

[0027] Where Q, K, and V are matrices obtained by performing different linear transformations on the embedding vectors of the input words; Calculate the dot product similarity between the query and all keys to obtain the attention score. It is the dimension of the key vector. The square root of the value is used as a scaling factor to stabilize the gradient during training; the Softmax function normalizes the score into a probability distribution, representing the level of attention each word should receive; finally, by applying this probability distribution to the value moments V, the weighted summation output is obtained, which is the code vector representation containing rich contextual information.

[0028] S12. Multi-dimensional label classification based on code vector representation:

[0029] The code vectors generated in S11 are input into a classification network. The output layer of the classification network has an independent neuron for each label, and the probability of the code belonging to each label is calculated using the sigmoid activation function. The training objective of the model is to adjust the model parameters by optimizing the loss function. For multi-label classification tasks, the binary cross-entropy loss function is selected.

[0030]

[0031] Where N is the total number of tag categories; for the i-th tag, It is its actual value; if the code belongs to this class, it is 1, otherwise it is 0. The model predicts the probability that the code belongs to the i-th class, which is output by the Sigmoid function. By minimizing this loss function, the model can predict all relevant attribute labels for a given piece of code.

[0032] Furthermore, S2 specifically includes:

[0033] S21. Agent selection and task planning based on multi-dimensional classification labels:

[0034] The central scheduling engine receives the multi-dimensional classification label set L output by S1;

[0035] The central scheduling engine selects from the pre-set pool of expert agents A based on a multi-dimensional classification label set L. pool = In this context, m represents the total number of agents, and the optimal subset A of agents is selected. ∗ To perform audit tasks; this selection process aims to maximize task matching and audit coverage, and can be modeled as a utility maximization problem.

[0036]

[0037] in, It is a correlation scoring function used to quantify intelligent agents. The degree of matching between the professional competence and the current multi-dimensional classification label set L, the function can be a predefined lookup table or a scoring model obtained through learning; It is an optional cost function used to measure the computational resources required to invoke a subset A of agents;

[0038] S22. Task Assignment and Parallel Collaboration Auditing:

[0039] In determining the optimal subset A of intelligent agents ∗ Then, the central scheduling engine assigns each selected agent... Generate specific, personalized audit instructions. The audit instructions are then distributed along with the source code C to be audited; these selected agents, upon receiving the tasks, independently execute their deep analysis functions in parallel. ;

[0040]

[0041] in, It is an intelligent agent The time required to complete its independent audit task; the total time spent in the entire collaborative audit phase. It depends on the agent with the longest execution time, not the sum of the execution times of all agents.

[0042] Furthermore, S3 specifically includes:

[0043] S31. Sub-audit report aggregation and deduplication;

[0044] The report aggregation module first collects standardized sub-audit reports generated in parallel by various intelligent agents; it then aggregates and deduplicates the discovered vulnerabilities, starting with preliminary matching by comparing structured fields; for vulnerabilities that rely on natural language descriptions, it uses a semantic similarity-based method for advanced deduplication.

[0045] Specifically, the text description of each vulnerability is converted into a high-dimensional vector using a pre-trained model; then, cosine similarity is used to calculate the similarity score between any two vulnerability description vectors.

[0046]

[0047] in, and These are vector representations of the two vulnerability descriptions. and It is the i1th component of the vector, and n is the number of components; if the similarity score exceeds the preset threshold, the two vulnerabilities are considered as duplicates and merged.

[0048] S32. Prioritize and risk-score vulnerabilities:

[0049] After generating a unique list of vulnerabilities, a quantified risk score (RiskScore) is calculated for each vulnerability for prioritization. This risk score follows a standard risk model: Risk = Likelihood × Impact. A refined assessment framework based on the OWASP risk rating methodology is employed, where "likelihood" is... and "impact" Determined by the average of multiple sub-factors:

[0050]

[0051] RiskScore = Likelihood × Impact

[0052] in, Scores representing sub-factors related to probability. It is the total number of possible sub-factors, and similarly, Scores representing sub-factors of influence, It is the total number of influencing sub-factors;

[0053] S33. Conflict Resolution and Consensus Reached:

[0054] When multiple agents provide conflicting assessments of the same code vulnerability, a conflict resolution mechanism is activated; a weighted voting model is used to reach consensus; each agent's assessment is treated as a vote, and its weight depends on the agent's domain expertise, historical accuracy, or confidence score returned in this analysis.

[0055]

[0056] Where k is the number of agents participating in the evaluation. It is the vote of the j2th agent. These are the weights assigned to the j2-th agent. The function determines the final, most credible conclusion based on the sum of weighted votes.

[0057] Furthermore, S4 specifically includes:

[0058] S41. Narrative Report Synthesis and Structured Presentation:

[0059] The report synthesis module takes the structured vulnerability data—processed, deduplicated, and prioritized after conflict resolution in S3—and submits it as contextual information to a large language model. This large language model weaves the discrete data points into a logical and readable narrative report. This process is not a simple template filling but rather guides the model to generate multiple sections, including "Execution Summary," "Overall Risk Situation Assessment," "Key Findings," and "Recommended Remediation Strategies," through carefully designed prompts. This generation process is autoregressive; when generating each word, the large language model considers all previously generated words and the input structured vulnerability data.

[0060]

[0061] in, This represents the structured vulnerability data input. It is a sequence of report text generated by the model. At each time step t, the model calculates the next word. The conditional probability distribution, which is based on all previously generated partial text sequences. and the original input structured vulnerability data This probability distribution is calculated by applying a softmax function to the output logits of the Transformer decoder, where... Represents the joint conditional probability, specifically meaning: given the structured vulnerability data as input... Under these conditions, the model generates a complete sequence of report text. The overall probability;

[0062] It is a single-step conditional probability, specifically meaning: given the structured vulnerability data as input... and the already generated partial text sequence Under the condition of ), the model at the current time step Generate the next word The probability of;

[0063] S42. Generate executable code fix suggestions and code patches;

[0064] For each vulnerability, a model finely tuned by a code generation task is invoked to generate specific, directly executable code fix suggestions. This process takes the vulnerable code snippet, vulnerability type, and fix instructions as input, and the model outputs a secure, fixed code snippet. This is also a conditional generation task, the goal of which is to find the most likely correct code fix sequence in a given vulnerability context.

[0065]

[0066] in, It is the original, vulnerable code snippet. It is the type of vulnerability. These are candidate, fixed code snippets; the model's goal is to find code that makes the conditional probability... Maximize the code sequence for fixing ; The meaning is: given the original vulnerable code snippet and vulnerability type Under the given conditions, a candidate post-fix code The probability of finding the correct repair solution;

[0067] S43. Final Draft Packaging and Multi-Channel Delivery of the General Audit Report:

[0068] Finally, the narrative report generated by S41 is assembled with multiple specific code fix suggestions and code patches generated by S42, and the risk score calculated during conflict resolution in S3 is integrated to form a complete, illustrated overall audit report. This overall audit report is packaged into a standard format and delivered through a pre-defined automated workflow. The delivery channel can be flexibly selected according to user configuration, including:

[0069] Push the request to the work order system via API and automatically create a repair task;

[0070] Send it via email to the designated security team or development lead;

[0071] Update the risk management dashboard for management to view in real time;

[0072]

[0073] This formula conceptually represents that the final report is an assembly function. The output of the report is the generated summary text, the sorted list of vulnerability findings, and the remediation plan generated for each vulnerability. Summary: refers to the summary text part of the narrative report generated in step S41. S42 refers to the sorted list of vulnerabilities obtained after the S3 step; Remediations refers to the collection of specific code remediation suggestions generated for each vulnerability in the S42 step; FinalReport refers to the final audit report assembled in the S43 step and delivered to the user.

[0074] Furthermore, S5 specifically includes:

[0075] S51. Collection and verification of structured feedback data:

[0076] By embedding an interactive component in the final audit report, a feedback interface is provided to users, allowing them to mark each individual audit vulnerability discovery.

[0077] When a user submits feedback, the feedback is associated with the corresponding code snippet, vulnerability type, and the agent that generated the vulnerability discovery, forming a high-quality, human-verified training data point.

[0078] These training data points are collected into a dedicated feedback database to provide a basis for subsequent model optimization;

[0079]

[0080] in, This represents the collected feedback dataset, containing k1 feedback instances; each instance is a tuple, where... These are the relevant code snippets. This is the original vulnerability discovery details. It generates the agent ID for the discovery of this vulnerability. ∈{1,0} is a user-provided binary label;

[0081] S52. Feedback-based iterative optimization of agents:

[0082] Periodically or after a certain amount of new feedback has been collected, the retraining process for the relevant agent is initiated.

[0083] Specifically, for a certain intelligent agent Use all tags as by The generated feedback data To the parameters of its internal model The model is updated; this process aims to minimize the prediction error of the model on new human-validated data, thereby enabling the model to perform better in future audit tasks; the model's parameters are updated using gradient descent.

[0084]

[0085] in, It is an intelligent agent The updated model parameters at time t+1 This is the current parameter. It's the learning rate, which controls the step size for each update. It is a loss function The gradient with respect to the current parameters.

[0086] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned automated code auditing method based on a large model and multiple agents.

[0087] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned automated code auditing method based on a large model and multiple agents.

[0088] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned automated code auditing method based on a large model and multiple agents.

[0089] The beneficial effects of this invention are:

[0090] 1. This invention solves the contradiction between accuracy and recall in existing technologies by combining the macro-planning capabilities of a large language model with the deep domain knowledge of multiple expert agents. It can discover complex vulnerabilities missed by traditional tools and filter false positives using global context.

[0091] 2. This invention improves analysis efficiency through a parallel auditing mechanism, while the highly automated process reduces reliance on expensive human resources, thereby significantly reducing operating costs.

[0092] 3. The modular system of the present invention is scalable and can easily add new intelligent agents to adapt to the ever-evolving technology; in addition, the present invention changes the form of audit reports, and can generate in-depth narrative reports containing root cause analysis and actionable remediation suggestions, thereby improving operability; most importantly, its built-in feedback and adaptive evolution mechanism enables the system to continuously learn and self-optimize during use, forming a virtuous cycle of continuously enhancing audit capabilities. Attached Figure Description

[0093] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0094] Figure 1 This is a flowchart illustrating an automated code auditing method based on a large model and multiple agents provided by the present invention;

[0095] Figure 2 This is an architecture flowchart of an automated code auditing method based on a large model and multiple agents provided by the present invention;

[0096] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention.

[0097] The labels in the diagram are as follows:

[0098] 310 - Processor; 320 - Communication interface; 330 - Memory; 340 - Communication bus. Detailed Implementation

[0099] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0100] This invention provides an automated code auditing method based on large models and multi-agent systems, the core process of which includes the following steps:

[0101] Example 1: As Figure 1 As shown, this embodiment of the invention provides an automated code auditing method based on large models and multiple agents, the method comprising the following specific steps:

[0102] S1. Code reception and intelligent classification through vectorized representation and multidimensional classification:

[0103] The system receives the source code to be audited through the input interface; then, the multi-dimensional code classification module analyzes the source code to be audited and assigns it multi-dimensional classification tags such as programming language, functional domain, and audit focus, in preparation for subsequent intelligent scheduling.

[0104] S2. Collaborative auditing through dynamic task scheduling driven by a large language model:

[0105] The central scheduling engine acts as the overall commander, dynamically selecting a subset of intelligent agents from the pool based on multi-dimensional classification labels. Subsequently, the central scheduling engine assigns audit tasks to the selected intelligent agents, which then perform audit analysis on the code in parallel.

[0106] S3. Summarize and analyze the aggregation, prioritization, and conflict resolution findings in the sub-audit reports:

[0107] After each agent completes its audit, it generates a structured sub-audit report. The report aggregation module collects all these sub-audit reports and performs summarization, deduplication, priority sorting, and potential conflict resolution.

[0108] S4. Generate and deliver the final audit report by constructing condition-based narrative reports and remediation plans:

[0109] After comprehensively analyzing the sub-audit reports, the report integration module calls the large language model to integrate the scattered technical findings into a logically coherent final audit report containing actionable remediation recommendations, and delivers it to the user.

[0110] S5. Feedback and adaptive evolution are achieved through closed-loop learning based on human feedback:

[0111] It provides a feedback mechanism that allows users to evaluate the audit results; this human feedback is used as new training data to iteratively optimize the corresponding agents, enabling the system to continuously learn and evolve in use, and achieve self-enhancement of capabilities.

[0112] Furthermore, S1 specifically includes:

[0113] S11. Preprocess and vectorize the input source code to be audited:

[0114] First, the source code to be audited is received and preprocessed, including but not limited to removing code comments and standardizing whitespace characters. Then, the preprocessed code text stream is decomposed into token sequences.

[0115] Subsequently, a pre-trained code model based on the Transformer architecture (such as CodeBERT) is selected to process the word sequence. The core of this model is the self-attention mechanism, which generates a deep contextualized code vector representation by calculating the importance weight of each word in the word sequence to all other words. This process is implemented by Scaled Dot-Product Attention.

[0116]

[0117] Where Q (Query), K (Key), and V (Value) are matrices obtained by performing different linear transformations on the embedding vectors of the input words; Calculate the dot product similarity between the query and all keys to obtain the attention score. It is the dimension of the key vector. The square root of the value is used as a scaling factor to stabilize the gradient during training; the Softmax function normalizes the score into a probability distribution, representing the level of attention each word should receive; finally, by applying this probability distribution to the value moments V, the weighted summation output is obtained, which is the code vector representation containing rich contextual information.

[0118] S12. Multi-dimensional label classification based on code vector representation:

[0119] The code vector generated in S11 is input into a classification network. Since a piece of code can simultaneously possess multiple attributes (e.g., language is Python, function is database interaction, audit concern is security), this task is a multi-label classification problem. Therefore, the output layer of the classification network sets an independent neuron for each label, and uses the sigmoid activation function to calculate the probability that the code belongs to each label. The training objective of the model is to adjust the model parameters by optimizing the loss function. For multi-label classification tasks, the binary cross-entropy loss function is selected.

[0120]

[0121] Where N is the total number of tag categories; for the i-th tag, It is its actual value; if the code belongs to this class, it is 1, otherwise it is 0. The model predicts the probability that the code belongs to the i-th class, which is output by the Sigmoid function. By minimizing this loss function, the model can predict all relevant attribute labels for a given code, providing an accurate basis for subsequent agent scheduling.

[0122] Furthermore, S2 specifically includes:

[0123] S21. Agent selection and task planning based on multi-dimensional classification labels:

[0124] The central scheduling engine receives the multi-dimensional classification label set L output by S1; the core of this engine is a large language model based on the Transformer architecture, which has powerful reasoning and planning capabilities.

[0125] The central scheduling engine selects from the pre-set pool of expert agents A based on a multi-dimensional classification label set L. pool = In this context, m represents the total number of agents, and the optimal subset A of agents is selected. ∗ To perform audit tasks; this selection process aims to maximize task matching and audit coverage, and can be modeled as a utility maximization problem.

[0126]

[0127] in, It is a correlation scoring function used to quantify intelligent agents. The degree of matching between the professional competence and the current multi-dimensional classification label set L, the function can be a predefined lookup table or a scoring model obtained through learning; It is an optional cost function used to measure the computational resources required to invoke a subset A of agents, in order to optimize resources while ensuring audit quality;

[0128] S22. Task Assignment and Parallel Collaboration Auditing:

[0129] In determining the optimal subset A of intelligent agents ∗ Then, the central scheduling engine assigns each selected agent... Generate specific, personalized audit instructions. The audit instructions are then distributed along with the source code C to be audited. These selected agents, which may contain models such as CodeBERT fine-tuned for specific tasks, independently execute their deep analysis functions in parallel after receiving the task. This parallel processing mechanism is one of the key advantages of this invention that distinguishes it from the traditional serial analysis process, as it greatly shortens the time required for the entire audit process.

[0130]

[0131] in, It is an intelligent agent The time required to complete its independent audit task; the total time spent in the entire collaborative audit phase. The system relies on the agent with the longest execution time, rather than the sum of the execution times of all agents. This ensures that the system maintains high auditing efficiency even when scheduling multiple expert agents for complex, in-depth analysis.

[0132] Furthermore, S3 specifically includes:

[0133] S31. Sub-audit report aggregation and deduplication;

[0134] The report aggregation module first collects standardized sub-audit reports generated in parallel by various agents. Since the audit scopes of different agents may overlap, in order to avoid alarm fatigue and form a unified view, the discovered vulnerabilities must be aggregated and deduplicated. This process first performs preliminary matching by comparing structured fields (such as CVE identifiers, code file names, line numbers, function names, etc.). For vulnerabilities that rely on natural language descriptions, a semantic similarity-based method is used for advanced deduplication.

[0135] Specifically, the text description of each vulnerability is converted into a high-dimensional vector using a pre-trained model (such as CodeBERT or other word embedding models); then, cosine similarity is used to calculate the similarity score between any two vulnerability description vectors.

[0136]

[0137] in, and These are vector representations of the two vulnerability descriptions. and It is the i1th component of the vector, and n is the number of components; if the similarity score exceeds the preset threshold, the two vulnerabilities are considered as duplicates and merged, thereby ensuring that each problem in the final report is unique;

[0138] S32. Prioritize and risk-score vulnerabilities:

[0139] After generating a unique list of vulnerabilities, a quantified risk score (RiskScore) is calculated for each vulnerability for prioritization. This risk score follows a standard risk model: Risk = Likelihood × Impact. A refined assessment framework based on the OWASP risk rating methodology is employed, where "likelihood" is... and "impact" Determined by the average of multiple sub-factors:

[0140]

[0141] RiskScore = Likelihood × Impact

[0142] in, Scores representing sub-factors related to probability (such as: difficulty of exploitation, prevalence of vulnerabilities, discoverability, etc.) It is the total number of possible sub-factors, and similarly, Scores representing sub-factors of impact (such as data confidentiality, integrity, business impact, etc.). It is the total number of influencing sub-factors; through this formula, each vulnerability is assigned a precise, comparable risk score.

[0143] S33. Conflict Resolution and Consensus Reached:

[0144] When multiple agents give conflicting assessments of the same code vulnerability (e.g., one agent labels it "high-risk vulnerability" while another labels it "safe"), a conflict resolution mechanism is activated; a weighted voting model is used to reach consensus; each agent's assessment is treated as a vote, and its weight depends on the agent's domain expertise, historical accuracy, or confidence score returned in this analysis.

[0145]

[0146] Where k is the number of agents participating in the evaluation. It is the vote of the j2th agent (e.g., +1 represents "vulnerability exists", -1 represents "safe"). It is the weight assigned to the j2-th agent, which reflects its confidence level on this specific type of problem. The function determines the final, most credible conclusion based on the sum of weighted votes, thus effectively resolving disagreements among agents.

[0147] Furthermore, S4 specifically includes:

[0148] S41. Narrative Report Synthesis and Structured Presentation:

[0149] The report synthesis module takes the structured vulnerability data—processed, deduplicated, and prioritized after conflict resolution in S3—and submits it as contextual information to a large language model (LLM). This model, based on its powerful Transformer architecture, performs a complex natural language generation task. The LLM weaves discrete data points into a logical and readable narrative report. This process is not simple template filling; instead, it guides the model to generate multiple sections, including "Execution Summary," "Overall Risk Situation Assessment," "Key Findings," and "Recommended Remediation Strategies," through carefully designed prompts. This generation process is autoregressive; when generating each token, the LLM considers all previously generated tokens and the input structured vulnerability data.

[0150]

[0151] in, This represents the structured vulnerability data input. It is a sequence of report text generated by the model. At each time step t, the model calculates the next word. The conditional probability distribution, which is based on all previously generated partial text sequences. and the original input structured vulnerability data This probability distribution is calculated by applying a softmax function to the output logits of the Transformer decoder, thus ensuring that the generated report is linguistically fluent and logically consistent with the input data. Represents the joint conditional probability, specifically meaning: given the structured vulnerability data as input... Under these conditions, the model generates a complete sequence of report text. The overall probability;

[0152] It is a single-step conditional probability, specifically meaning: given the structured vulnerability data as input... and the already generated partial text sequence Under the condition of ), the model at the current time step Generate the next word The probability of;

[0153] S42. Generate executable code fix suggestions and code patches;

[0154] To enhance the report's practical value, for each vulnerability, a model finely tuned for a code generation task (such as a variant of CodeBERT) is invoked to generate specific, directly executable code fix suggestions. This process takes the vulnerable code snippet, the vulnerability type (such as CWE-89 SQL injection), and the fix instructions as input, and the model outputs a secure, fixed code snippet. This is also a conditional generation task, the goal of which is to find the most likely correct code fix sequence in a given vulnerability context.

[0155]

[0156] in, It is the original, vulnerable code snippet. It is the type of vulnerability. These are candidate, fixed code snippets; the model's goal is to find code that makes the conditional probability... Maximize the code sequence for fixing This allows the report to not only identify problems but also provide direct solutions, greatly reducing the fix costs and cognitive load for developers; The meaning is: given the original vulnerable code snippet and vulnerability type Under the given conditions, a candidate post-fix code The probability of finding the correct repair solution;

[0157] S43. Final Draft Packaging and Multi-Channel Delivery of the General Audit Report:

[0158] Finally, the narrative report generated by S41 is assembled with multiple specific code fix suggestions and code patches generated by S42, and the risk score calculated during conflict resolution in S3 is integrated to form a complete, illustrated overall audit report. This overall audit report is packaged into a standard format (such as PDF, HTML, or JSON) and delivered through a pre-defined automated workflow. The delivery channel can be flexibly selected according to user configuration, including:

[0159] Push the request to a ticketing system (such as Jira) via API and automatically create a repair task;

[0160] Send it via email to the designated security team or development lead;

[0161] Update the risk management dashboard for management to view in real time;

[0162]

[0163] This formula conceptually represents that the final report is an assembly function. The output of the automated delivery loop takes as input a generated summary text, a sorted list of vulnerability findings, and a remediation plan for each vulnerability. This automated delivery loop ensures that audit results are delivered to the relevant responsible parties in a timely and accurate manner, thereby accelerating the remediation process. Summary: refers to the summary text portion of the narrative report generated in step S41. S42 refers to the sorted list of vulnerabilities obtained after the S3 step; Remediations refers to the collection of specific code remediation suggestions generated for each vulnerability in the S42 step; FinalReport refers to the final audit report assembled in the S43 step and delivered to the user.

[0164] Furthermore, S5 specifically includes:

[0165] S51. Collection and verification of structured feedback data:

[0166] By embedding an interactive component in the final audit report, a feedback interface is provided to users, allowing them to mark each individual audit vulnerability discovery as either a "True Positive" or a "False Positive".

[0167] When a user submits feedback, the feedback is associated with the corresponding code snippet, vulnerability type, and the agent that generated the vulnerability discovery, forming a high-quality, human-verified training data point.

[0168] These training data points are collected into a dedicated feedback database to provide a reliable basis for subsequent model optimization;

[0169]

[0170] in, This represents the collected feedback dataset, containing k1 feedback instances; each instance is a tuple, where... These are the relevant code snippets. This is the original vulnerability discovery details. It generates the agent ID for the discovery of this vulnerability. ∈{1,0} is a user-provided binary label (e.g., 1 represents "confirmed vulnerability", 0 represents "false positive").

[0171] S52. Feedback-based iterative optimization of agents:

[0172] Periodically or after collecting a certain amount of new feedback, the retraining (or fine-tuning) process of the relevant agent is initiated;

[0173] Specifically, for a certain intelligent agent Use all tags as by The generated feedback data To the parameters of its internal model (such as a fine-tuned CodeBERT model) The model is updated; this process aims to minimize the prediction error of the model on new human-validated data, thereby enabling the model to perform better in future audit tasks; the model's parameters are updated using gradient descent.

[0174]

[0175] in, It is an intelligent agent The updated model parameters at time t+1 This is the current parameter. It's the learning rate, which controls the step size for each update. It is a loss function (Typically, this is the gradient of the current parameters, calculated using binary cross-entropy loss.) By repeatedly performing this process, each expert agent learns from its past "mistakes," achieving adaptive evolution of its capabilities and thus improving the long-term audit accuracy of the entire system.

[0176] This invention also provides an electronic device. Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340. The processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions from the memory 330 to execute the code auditing method based on large models and multi-agent collaboration.

[0177] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0178] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the code auditing method based on large models and multi-agent collaboration.

[0179] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the code auditing method based on large model and multi-agent collaboration.

[0180] The core innovation of this invention lies in its unique collaborative auditing architecture combining a large language model with multiple expert agents, which abandons the rigid model of a single analysis engine in existing technologies. By introducing a large language model as an intelligent scheduler, this method can dynamically and adaptively select and combine the most suitable expert agents to perform parallel deep auditing based on multi-dimensional intelligent classification of source code. This mechanism organically combines the macro-planning and reasoning capabilities of the large model with the deep domain knowledge of multiple specially optimized agents, effectively solving the contradiction between the high false positive rate caused by the lack of contextual understanding in traditional static analysis tools and the high false negative rate caused by the insufficient depth of knowledge in general large models. This architecture not only improves the accuracy and coverage of code auditing, but also achieves system scalability and continuous evolution capabilities through a modular agent pool and a closed-loop feedback learning mechanism.

[0181] To illustrate the effects of the present invention, the present invention will be described in comparison from the following aspects.

[0182] Table 1: Comparison of Automation Levels and Advantages / Disadvantages of Different Code Auditing Methods

[0183]

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0185] The above-described contents can be implemented individually or in various combinations, and these variations are all within the protection scope of this invention.

[0186] It should be noted that in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the article or device comprising said element.

[0187] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. The present invention has been described in detail with reference to preferred embodiments. Those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications and substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An automated code auditing method based on large models and multi-agent systems, characterized in that, The method includes: Identify the multidimensional categories of the source code to be audited; A large language model dynamically selects multiple agents from a pool of agents to perform audit analysis on the code in parallel based on multidimensional categories; After the audit, each agent submits an independent structured sub-audit report; the report aggregation module summarizes, deduplicates, prioritizes, and resolves conflicts among all sub-audit reports. A final audit report is generated by calling a large language model, and user feedback is used to iteratively optimize the agent.

2. The automated code auditing method based on large models and multi-agent systems according to claim 1, characterized in that: The method includes the following specific steps: S1. Code reception and intelligent classification through vectorized representation and multidimensional classification: The system receives the source code to be audited through the input interface; then, the multi-dimensional code classification module analyzes the source code to be audited and assigns it multi-dimensional classification labels. S2. Collaborative auditing through dynamic task scheduling driven by a large language model: The central scheduling engine acts as the overall commander, dynamically selecting a subset of intelligent agents from the pool based on multi-dimensional classification labels. Subsequently, the central scheduling engine assigns audit tasks to the selected intelligent agents, which then perform audit analysis on the code in parallel. S3. Summarize and analyze the aggregation, prioritization, and conflict resolution findings in the sub-audit reports: After each agent completes its audit, it generates a structured sub-audit report. The report aggregation module collects all these sub-audit reports and performs summarization, deduplication, priority sorting, and potential conflict resolution. S4. Generate and deliver the final audit report by constructing condition-based narrative reports and remediation plans: After comprehensively analyzing the sub-audit reports, the report integration module calls the large language model to integrate the scattered technical findings into a logically coherent final audit report containing actionable remediation recommendations, and delivers it to the user. S5. Feedback and adaptive evolution are achieved through closed-loop learning based on human feedback: A feedback mechanism is provided, allowing users to evaluate the audit results; this human feedback is used as new training data to iteratively optimize the corresponding agent.

3. The automated code auditing method based on large models and multi-agent systems according to claim 2, characterized in that: S1 specifically includes: S11. Preprocess and vectorize the input source code to be audited: First, the source code to be audited is received and preprocessed, including removing code comments and standardizing whitespace characters. Then, the preprocessed code text stream is decomposed into a sequence of terms. Subsequently, a pre-trained code model based on the Transformer architecture is selected to process the word sequence; a deep contextualized code vector representation is generated by calculating the importance weight of each word in the word sequence to all other words; this process is implemented using scaled dot product attention. ； Where Q, K, and V are matrices obtained by performing different linear transformations on the embedding vectors of the input words; Calculate the dot product similarity between the query and all keys to obtain the attention score. It is the dimension of the key vector. The square root of the value is used as a scaling factor to stabilize the gradient during training; the Softmax function normalizes the score into a probability distribution, representing the level of attention each word should receive; finally, by applying this probability distribution to the value moments V, the weighted summation output is obtained, which is the code vector representation containing rich contextual information. S12. Multi-dimensional label classification based on code vector representation: The code vector generated in S11 is input into a classification network. The output layer of the classification network has an independent neuron for each label, and the probability of the code belonging to each label is calculated using the sigmoid activation function. The training objective of the model is to adjust the model parameters by optimizing the loss function. For multi-label classification tasks, the binary cross-entropy loss function is selected. ； Where N is the total number of tag categories; for the i-th tag, It is its actual value; if the code belongs to this class, it is 1, otherwise it is 0. The model predicts the probability that the code belongs to the i-th class, which is output by the Sigmoid function. By minimizing this loss function, the model can predict all relevant attribute labels for a given piece of code.

4. The automated code auditing method based on large models and multi-agent systems according to claim 2, characterized in that: S2 specifically includes: S21. Agent selection and task planning based on multi-dimensional classification labels: The central scheduling engine receives the multi-dimensional classification label set L output by S1; The central scheduling engine selects from the pre-set pool of expert agents A based on a multi-dimensional classification label set L. pool = In this context, m represents the total number of agents, and the optimal subset of agents is selected. To perform audit tasks; this selection process aims to maximize task matching and audit coverage, and can be modeled as a utility maximization problem. ； in, It is a correlation scoring function used to quantify intelligent agents. The degree of matching between the professional competence and the current multi-dimensional classification label set L, the function can be a predefined lookup table or a scoring model obtained through learning; It is an optional cost function used to measure the computational resources required to invoke a subset A of agents; S22. Task Assignment and Parallel Collaboration Auditing: In determining the optimal subset of intelligent agents Then, the central scheduling engine assigns each selected agent... Generate specific, personalized audit instructions. The audit instructions are then distributed along with the source code C to be audited; these selected agents, upon receiving the tasks, independently execute their deep analysis functions in parallel. ; ； in, It is an intelligent agent The time required to complete its independent audit task; the total time spent in the entire collaborative audit phase. It depends on the agent with the longest execution time, not the sum of the execution times of all agents.

5. The automated code auditing method based on large models and multi-agent systems according to claim 2, characterized in that: S3 specifically includes: S31. Sub-audit report aggregation and deduplication; The report aggregation module first collects standardized sub-audit reports generated in parallel by various intelligent agents; it then aggregates and deduplicates the discovered vulnerabilities, starting with preliminary matching by comparing structured fields; for vulnerabilities that rely on natural language descriptions, it uses a semantic similarity-based method for advanced deduplication. Specifically, the text description of each vulnerability is converted into a high-dimensional vector using a pre-trained model; then, cosine similarity is used to calculate the similarity score between any two vulnerability description vectors. ； in, and These are vector representations of the two vulnerability descriptions. and It is the i1th component of the vector, and n is the number of components; if the similarity score exceeds the preset threshold, the two vulnerabilities are considered as duplicates and merged. S32. Prioritize and risk-score vulnerabilities: After generating a unique list of vulnerabilities, a quantified risk score (RiskScore) is calculated for each vulnerability for prioritization. This risk score follows a standard risk model: Risk = Likelihood × Impact. A refined assessment framework based on the OWASP risk rating methodology is employed, where "likelihood" is... and "impact" Determined by the average of multiple sub-factors: ； RiskScore=Likelihood×Impact; in, Scores representing sub-factors related to probability. It is the total number of possible sub-factors, and similarly, Scores representing sub-factors influencing aspects, It is the total number of influencing sub-factors; S33. Conflict Resolution and Consensus Reached: When multiple agents provide conflicting assessments of the same code vulnerability, a conflict resolution mechanism is activated; a weighted voting model is used to reach consensus; each agent's assessment is treated as a vote, and its weight depends on the agent's domain expertise, historical accuracy, or confidence score returned in this analysis. ； Where k is the number of agents participating in the evaluation. It is the vote of the j2th agent. These are the weights assigned to the j2-th agent. The function determines the final, most credible conclusion based on the sum of weighted votes.

6. The automated code auditing method based on large models and multi-agent systems according to claim 2, characterized in that: S4 specifically includes: S41. Narrative Report Synthesis and Structured Presentation: The report synthesis module takes the structured vulnerability data—processed, deduplicated, and prioritized after conflict resolution in S3—and submits it as contextual information to a large language model. This large language model then weaves the discrete data points into a logical and readable narrative report. This process is not a simple template filling but rather guides the model to generate multiple sections, including "Execution Summary," "Overall Risk Situation Assessment," "Key Findings," and "Recommended Remediation Strategies," through carefully designed prompts. This generation process is autoregressive; when generating each word, the large language model considers all previously generated words and the input structured vulnerability data. ； in, This represents the structured vulnerability data input. It is a sequence of report text generated by the model. At each time step t, the model calculates the next word. The conditional probability distribution, which is based on all previously generated partial text sequences. and the original input structured vulnerability data This probability distribution is calculated by applying a softmax function to the output logits of the Transformer decoder, where... Represents the joint conditional probability, specifically meaning: given the structured vulnerability data as input... Under these conditions, the model generates a complete sequence of report text. The overall probability; It is a single-step conditional probability, specifically meaning: given the structured vulnerability data as input... and the already generated partial text sequence Under the condition of ), the model at the current time step Generate the next word The probability of; S42. Generate executable code fix suggestions and code patches; For each vulnerability, a model finely tuned by a code generation task is invoked to generate specific, directly executable code fix suggestions. This process takes the vulnerable code snippet, vulnerability type, and fix instructions as input, and the model outputs a secure, fixed code snippet. This is also a conditional generation task, the goal of which is to find the most likely correct code fix sequence in a given vulnerability context. ； in, It is the original, vulnerable code snippet. It is the type of vulnerability. These are candidate, fixed code snippets; the model's goal is to find code that makes the conditional probability... Maximize the code sequence for fixing ; The meaning is: given the original vulnerable code snippet and vulnerability type Under the given conditions, a candidate post-fix code The probability of finding the correct repair solution; S43. Final Draft Packaging and Multi-Channel Delivery of the General Audit Report: Finally, the narrative report generated by S41 is assembled with multiple specific code fix suggestions and code patches generated by S42, and the risk score calculated during conflict resolution in S3 is integrated to form a complete, illustrated overall audit report. This overall audit report is packaged into a standard format and delivered through a pre-defined automated workflow. The delivery channel can be flexibly selected according to user configuration, including: Push the request to the work order system via API and automatically create a repair task; Send it via email to the designated security team or development lead; Update the risk management dashboard for management to view in real time; ； This formula conceptually represents that the final report is an assembly function. The output of the report is the generated summary text, the sorted list of vulnerability findings, and the remediation plan generated for each vulnerability. Summary: refers to the summary text part of the narrative report generated in step S41. S42 refers to the sorted list of vulnerabilities obtained after the S3 step; Remediations refers to the collection of specific code remediation suggestions generated for each vulnerability in the S42 step; FinalReport refers to the final audit report assembled in the S43 step and delivered to the user.

7. The automated code auditing method based on large models and multi-agent systems according to claim 2, characterized in that: S5 specifically includes: S51. Collection and verification of structured feedback data: By embedding an interactive component in the final audit report, a feedback interface is provided to users, allowing them to mark each individual audit vulnerability discovery. When a user submits feedback, the feedback is associated with the corresponding code snippet, vulnerability type, and the agent that generated the vulnerability discovery, forming a high-quality, human-verified training data point. These training data points are collected into a dedicated feedback database to provide a basis for subsequent model optimization; ； in, This represents the collected feedback dataset, containing k1 feedback instances; each instance is a tuple, where... These are the relevant code snippets. This is the original vulnerability discovery details. It generates the agent ID for the discovery of this vulnerability. ∈{1,0} is a user-provided binary label; S52. Feedback-based iterative optimization of agents: Periodically or after a certain amount of new feedback has been collected, the retraining process for the relevant agent is initiated. Specifically, for a certain intelligent agent Use all tags as by The generated feedback data To the parameters of its internal model The model is updated; this process aims to minimize the prediction error of the model on new human-validated data, thereby enabling the model to perform better in future audit tasks; the model's parameters are updated using gradient descent. ； in, It is an intelligent agent The updated model parameters at time t+1 This is the current parameter. It's the learning rate, which controls the step size for each update. It is a loss function The gradient with respect to the current parameters.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements an automated code auditing method based on a large model and multiple agents as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements an automated code auditing method based on a large model and multiple agents as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements an automated code auditing method based on a large model and multiple agents as described in any one of claims 1-7.

Images