A vulnerability discovery method and system based on symbolic-semantic hybrid reasoning

Abstract

This invention provides a vulnerability discovery method and system based on symbolic-semantic hybrid reasoning, belonging to the field of software security technology. The method includes: parsing the target program and extracting event sequences; converting events into symbols with temporal labels and confidence levels, constructing a symbolic dependency graph; performing reasoning based on the dependency graph, and when determinism is insufficient, calling a large language model to generate semantic reasoning actions, updating the state after symbolic verification; extracting new rules from the verified reasoning chains through reinforcement learning to achieve self-evolution; and outputting a vulnerability report containing the reasoning path and confidence level. The system correspondingly includes a temporal probability symbolic module, a symbolic-semantic bidirectional coupled reasoning module, a reinforcement learning self-evolution module, and a report generation module. This invention integrates the rigor of symbolic logic with the generalization ability of semantic models, effectively improving the accuracy, interpretability, and adaptability of vulnerability detection, and is suitable for security auditing and code review of complex software systems.

Description

Technical Field

[0001] This invention relates to the field of software security technology, and in particular to a vulnerability discovery method and system based on symbolic-semantic hybrid reasoning. Background Technology

[0002] After years of development, current software vulnerability detection technology has formed a variety of mainstream methods, but it still faces many insurmountable technical bottlenecks in practical applications.

[0003] The first category is static symbolic analysis methods. This method relies on symbolic execution techniques and constraint solvers to derive the program's state space, attempting to cover all possible execution paths through formal methods. While this method has strict logical guarantees in theory, it encounters a severe "path explosion" problem in real-world complex systems. When a program contains a large number of conditional branches and loop structures, the number of possible execution paths grows exponentially, leading to a sharp increase in analysis time and memory consumption, making this method difficult to apply to large-scale real-world software systems. More seriously, traditional symbolic execution methods have very limited ability to handle dynamic characteristics, external interactions, and temporal dependencies, often requiring significant manual intervention and environmental assumptions.

[0004] The second category is methods based on semantic analysis and large language models. In recent years, with the development of deep learning technology, researchers have begun to explore using large language models to understand code semantics, identifying potential vulnerabilities by learning implicit patterns from massive amounts of code samples. The advantage of this type of method lies in its ability to capture complex semantic relationships and contextual information, and even identify vulnerability patterns that are difficult to describe using traditional rules. However, this method has a fundamental flaw: the reasoning process is completely "black box," lacking formal verification mechanisms and prone to producing "illusory conclusions." The model may make incorrect judgments based on surface features without being able to explain its reasoning basis, let alone guarantee the reliability of the results. This lack of interpretability and uncertainty makes this method difficult to apply to security-critical scenarios.

[0005] The third category is hybrid pattern analysis methods that attempt to combine symbolic and semantic features. These methods try to integrate the advantages of the first two approaches, but existing research mostly remains at the level of simple feature concatenation or process sequencing, lacking a unified mathematical framework and deep coupling mechanisms. More importantly, these methods still rely on manually designed rule bases and cannot automatically learn and adapt to new vulnerability patterns, proving inadequate in the face of constantly evolving security threats.

[0006] The limitations of the three types of methods mentioned above often render existing technologies ineffective in dealing with the following complex vulnerabilities: First, vulnerabilities involving cross-time dependencies, such as TOCTOU (Time-of-Check to Time-of-Use) race condition vulnerabilities, which involve state changes at multiple points in time and require consideration of both temporal relationships and probabilistic factors; second, dynamic resource management errors, such as Use-After-Free and Double-Free memory safety vulnerabilities, whose triggering conditions often depend on complex program execution paths and resource lifecycles; third, privilege boundary bypass and multi-threaded condition races, which involve complex interactions between multiple execution flows; and finally, the automatic learning and discovery of new combined vulnerabilities, as traditional methods lack self-evolution capabilities and cannot proactively adapt to new attack patterns. Summary of the Invention

[0007] This invention aims to solve at least one of the technical problems existing in the prior art, and proposes a vulnerability discovery method and system based on symbolic-semantic hybrid reasoning.

[0008] In a first aspect, embodiments of the present invention provide a vulnerability discovery method based on symbolic-semantic hybrid reasoning, including:

[0009] S1. Parse the target program and extract events to obtain the event sequence;

[0010] S2. Convert the event sequence into a symbolic representation with time series labels and confidence levels, and construct a symbolic dependency graph;

[0011] S3. Based on the symbolic dependency graph, perform reasoning. When the system determinism index is lower than a set threshold, call the Large Language Model (LLM) to generate semantic reasoning actions. Perform symbolic verification on the semantic reasoning actions through a verification operator, and add the verified semantic reasoning actions to the symbolic state.

[0012] S4. Based on the reinforcement learning mechanism, extract new symbolic rules from the verified inference chain and update the rule base;

[0013] S5. Output a vulnerability report, which includes symbolic reasoning path, confidence level, and semantic description.

[0014] Furthermore, the symbols in S2 Represented as:

[0015] ;

[0016] in For program events, For timing logic labels, , where is the confidence level.

[0017] Furthermore, the system determinism index ,when The generation and verification of semantic reasoning actions are triggered in real time. This is the set value.

[0018] Furthermore, the verification operator in S3 Defined as:

[0019] If semantic reasoning action If the symbolic logic constraints are satisfied, output 1 and update. Otherwise, output 0.

[0020] in, In symbolic state, Inference actions generated for LLM, .

[0021] Furthermore, the objective function of the reinforcement learning mechanism is:

[0022] ;

[0023] ;

[0024] in For symbol consistency loss, The weight of symbolic consistency in the overall optimization objective. For reasoning actions, This is a symbolic state.

[0025] Secondly, embodiments of the present invention provide a vulnerability discovery system based on symbolic-semantic hybrid reasoning, comprising:

[0026] The temporal probability symbol module is used to convert program events into temporal probability symbols and construct symbol dependency graphs;

[0027] The symbol-semantic bidirectional coupled reasoning module is used to call a large language model to generate semantic reasoning actions and perform symbol verification through verification operators.

[0028] The reinforcement learning self-evolutionary module is used to update the inference strategy and generate new symbolic rules based on verification feedback.

[0029] The report generation module is used to generate vulnerability reports that include inference chains and confidence levels.

[0030] Furthermore, the symbol output by the time-series probability symbol module is Among them, the timing logic label It is at least one of the timing operators G, F, X, and U. The G operator indicates that an event or condition is always true throughout the entire execution process, the F operator indicates that an event will eventually be true at some point, the X operator indicates that an event is true in the next state and is used to describe single-step state transitions, and the U operator indicates that event A is true until event B occurs.

[0031] Furthermore, the symbol-semantic bidirectional coupled reasoning module includes a semantic mapping function for converting symbolic states into natural language descriptions input to the large language model.

[0032] Furthermore, the reinforcement learning self-evolution module models the reasoning process as a Markov decision process and optimizes the policy through a reward function.

[0033] Furthermore, the vulnerability report output by the report generation module includes symbolic reasoning path, confidence level at each step, temporal relationship, semantic description, and hash identifier.

[0034] The technical advantages of the vulnerability discovery method and system based on symbolic-semantic hybrid reasoning disclosed in this invention are as follows: This invention designs three core technical modules, which together constitute a complete technical ecosystem. The first module is TPS (Temporal Probabilistic Symbolic System), which is responsible for abstracting program events into symbolic representations with temporal labels and confidence levels, providing a formal basis for the entire reasoning process. The second module is BCER (Symbolic-Semantic Bidirectional Coupled Inferencer), which realizes bidirectional information flow and mutual verification between the symbolic system and the large language model, utilizing the generalization ability of the semantic model and ensuring the reliability of reasoning through symbolic constraints. The third module is Evo-RL (Self-Evolutionary Reinforcement Learning Module), which enables the system to continuously learn from reasoning experience, automatically generate new symbolic rules, and achieve continuous evolution of the knowledge base. These three modules are not simply connected in sequence, but form an organic closed-loop structure: the symbol generation stage uses TPS to convert program code into formal symbolic representations; the semantic reasoning stage uses BCER to call the large language model to generate reasoning hypotheses and uses a symbolic verification mechanism to filter reliable conclusions; the symbolic verification stage ensures that all reasoning outputs conform to formal logic constraints; and the rule evolution stage uses Evo-RL to extract new symbolic operators from the verified reasoning chains, automatically expanding the rule base. This closed-loop structure enables the system to continuously improve its reasoning ability and knowledge reserves while maintaining rigor.

[0035] The system continuously updates inference operators through reinforcement learning, giving the symbolic system "evolutionary" characteristics; ensures the "interpretability" of model output through symbolic verification constraints; and achieves "traceability" of multi-stage vulnerability behavior through temporal probabilistic logic modeling. The organic combination of these three characteristics enables this invention to achieve significant breakthroughs in three dimensions: theoretical rigor, practical effectiveness, and continuous evolution capability. Attached Figure Description

[0036] Figure 1 A flowchart illustrating a vulnerability discovery method based on symbolic-semantic hybrid reasoning provided in an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of a vulnerability discovery system based on symbolic-semantic hybrid reasoning, provided as an embodiment of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0039] A vulnerability discovery method based on symbolic-semantic hybrid reasoning, reference Figure 1 As shown, the specific steps include:

[0040] S1. Parse the target program or target code and extract events to obtain the event sequence.

[0041] S2. Convert the event sequence into a symbolic representation with time-series labels and confidence levels, and construct a symbolic dependency graph. Symbols are abstract representations of program events in this invention, constituting the smallest logical unit of the entire inference system.

[0042] Unlike symbolic variables in traditional symbolic execution, the symbols in this invention not only carry syntactic information about the event itself, but also contain rich temporal semantics and uncertainty measures. Each event is converted into a symbol using a temporal probabilistic symbolic system (TPS). And construct a symbolic dependency graph. This definition contains three key elements. The first element... This represents a specific event in the program, such as a function call, memory allocation, variable assignment, resource release, and other basic operations. The second element... This is the timing logic label, or timing logic operator, for the event, used to describe the event's temporal characteristics and duration constraints within the execution sequence. The third element... The confidence level, representing the occurrence of the event or the validity of the related inference, is a probability value between 0 and 1, reflecting the degree of certainty in the system's judgment of the symbol. This triplet structure allows the symbol to simultaneously carry deterministic logical relationships and uncertain probabilistic information, thus providing a unified mathematical foundation for subsequent reasoning propagation and confidence calculation. The symbol is not merely a static label, but also a carrier of information flow in the dynamic reasoning process.

[0043] Temporal logic operators are core tools for expressing the temporal relationships between program events. In traditional temporal logic systems, these operators are mainly used to describe the truth value changes of propositions along the time axis. This invention introduces these classic operators into a symbolic system, enabling the system to accurately describe the temporal conditions and state evolution processes required for vulnerability triggering. The set of temporal operators defined in this invention is as follows:

[0044] ;

[0045] Among them, the G (Globally) operator indicates that an event or condition is true throughout the entire execution process, which is crucial for describing invariant constraints and persistent security properties. The F (Finally) operator indicates that an event will eventually be true at some point, often used to describe the inevitable triggering conditions of a vulnerability. The X (Next) operator indicates that an event is true in the next state, used to describe single-step state transitions. The U (Until) operator indicates that event A is true until event B occurs, which is the most powerful operator for describing temporal dependencies.

[0046] These temporal operators, combined with the confidence level of the symbols, constitute the unique temporal probabilistic logic core of this invention. For example, a symbol with a temporal label F and a confidence level of 0.9 indicates that the system believes the event will eventually occur with 90% certainty. This approach of combining deterministic temporal logic with probabilistic reasoning enables the system to perform reliable vulnerability reasoning under conditions of incomplete information, making it particularly suitable for handling complex programs with multiple possible execution paths.

[0047] The symbolic dependency graph is the core data structure used in this invention for organizing and managing symbolic relationships. It is not a simple directed graph, but a multi-dimensional relational network capable of simultaneously expressing various relationships such as temporal dependencies, data flow dependencies, and control flow dependencies. The symbolic dependency graph constructed internally by the system is defined as follows:

[0048] ;

[0049] The definition consists of three basic components. It is a collection of symbol nodes, each node representing a program event and its related attributes. It is a set of time-series edges, representing the sequential relationship between events, which is crucial for capturing time-related vulnerabilities such as TOCTOU. It is a set of data dependency edges, representing the data flow relationship between variable definition and usage, as well as the dependency relationship between memory address and resource identifier.

[0050] The symbolic dependency graph plays a dual role in this invention. On one hand, it serves as the input structure for the reasoning process; the TPS module constructs an initial dependency graph by analyzing program code, providing a structured knowledge representation for subsequent reasoning. On the other hand, it forms the basis for system output and visualization. The dependency graph clearly displays the causal chain of vulnerabilities, making the reasoning results traceable and interpretable. In practical applications, the dependency graph also supports advanced operations such as subgraph extraction and path lookup, facilitating the location of critical vulnerability triggering conditions.

[0051] S3. Based on the symbolic dependency graph, reasoning is performed. When the system determinism index is lower than a set threshold, the Large Language Model (LLM) is invoked to generate semantic reasoning actions. The semantic reasoning actions are symbolically verified by the verification operator, and the verified semantic reasoning actions are added to the symbolic state.

[0052] Deterministic Indicators of Computational Systems If η is lower than the threshold Then, the large language model is invoked to generate semantic reasoning actions. The deterministic metric is a key indicator used in this invention to quantify the reliability of the reasoning chain. This metric not only reflects the confidence level of individual symbols, but more importantly, it measures the overall deterministic level of the entire reasoning chain.

[0053] This definition uses a product form, meaning that the overall certainty of the reasoning chain depends on the weakest link in the chain. This design follows the "barrel principle," ensuring that the system's assessment of reasoning quality is sufficiently conservative and cautious. When the confidence level of any symbol in the reasoning chain is low, the overall certainty decreases accordingly, triggering a more stringent verification mechanism.

[0054] This indicator plays a crucial control role in system operation. When Above a certain threshold When this occurs, it indicates that the current reasoning chain is entirely based on high-confidence symbolic reasoning, and the system can directly output the conclusion. Below the threshold When significant uncertainty exists, the system will automatically switch to a "symbolic-semantic hybrid reasoning" mode, invoking a large language model to provide semantic-level auxiliary reasoning. This adaptive mechanism allows the system to achieve a dynamic balance between efficiency and accuracy, avoiding unnecessary semantic model calls while still obtaining semantic reasoning support at critical moments.

[0055] Semantic mapping functions are crucial bridges connecting symbolic space and natural language space. They transform abstract symbolic representations into human-understandable natural language descriptions, enabling large language models to participate in the reasoning process. The design of this function needs to consider information transformation at multiple levels. First, it needs to transform the triplet structure of symbols... The process of converting symbolic dependencies into coherent natural language sentences must maintain the integrity of formal information while conforming to the expression habits of natural language. Secondly, it needs to transform the structured relationships in the symbolic dependency graph into causal narratives, enabling the large language model to understand the logical connections between events. Finally, it also needs to appropriately inject contextual information, such as variable names, function semantics, and code comments, to enrich the semantic model's understanding. This natural language description provides the large language model with the necessary semantic context, enabling it to infer possible vulnerability patterns and triggering conditions based on knowledge accumulated from learning from massive amounts of code, thereby supplementing the shortcomings of symbolic systems in semantic understanding.

[0056] S4. Based on reinforcement learning, new symbolic rules are extracted from the validated inference chains to update the rule base. After review by the validation operator V, the symbolic state is updated if it passes. During inference, the reinforcement learning module records feedback and generates new rules. Update the rule base.

[0057] The verification operator is one of the most crucial innovative mechanisms in this invention. It acts as a gatekeeper for the symbolic system's output of the large language model. Through this mechanism, the system can effectively suppress the "illusion" problem of the large language model, ensuring that only inference conclusions that conform to formal logic constraints are accepted.

[0058] The symbol verification function is defined as follows:

[0059] ;

[0060] The validation function's judgment process includes multiple levels of checks. The first is a syntax-level check, validating the inference actions. First, there's the check to see if the symbolic representation conforms to predefined syntax rules. Second, there's the logical-level check, verifying whether the action is consistent with the current symbolic state. First, maintain consistency by checking if any known logical constraints or invariants are violated. Next, perform a timing-level check to verify if the implicit temporal relationship of the action is compatible with the temporal edges in the dependency graph. Finally, include a confidence-level check to assess whether the confidence level of the action is within a reasonable range.

[0061] Only inference actions that pass all levels of checks are assigned a verification value of 1 and thus incorporated into the symbolic system for subsequent processing. This rigorous verification mechanism constitutes the fundamental feature that distinguishes this invention from pure machine learning methods. It ensures that the system output has formal guarantees, rather than merely being a statistically significant probability judgment. All inference outputs of large language models must be reviewed by the V function, which is the core mechanism to ensure the logical correctness and symbolic consistency of the system output results.

[0062] The reinforcement learning constraint term is a core component of the self-evolutionary mechanism of this invention. In traditional reinforcement learning, the agent often focuses only on maximizing the cumulative reward, neglecting the inherent consistency requirements of the symbolic system. This invention introduces a specific constraint term to ensure that the system does not deviate from the basic principles of symbolic logic during evolution. To prevent overfitting or rule degeneration during system evolution, this invention introduces a symbolic consistency loss function:

[0063] ;

[0064] The loss function penalizes the inference action at each time step; if the action... Failed to pass symbol verification, i.e. This will result in a loss of one unit. Parameter The weight of sign consistency in the overall optimization objective is typically set to a large value to ensure the priority of sign constraints. Based on this, the complete optimization objective function of the system is defined as follows:

[0065] ;

[0066] This optimization objective cleverly balances two important aspects. The first aspect... This represents the performance goals pursued by the system, including practical indicators such as detection accuracy and inference efficiency. The second item... This represents the logical constraints that the system must adhere to, preventing the sacrifice of inference reliability for the sake of performance improvement. This design ensures that the system maintains the inherent consistency and logical rigor of its symbol system throughout the process of continuous learning and evolution, avoiding problems such as "shortcut learning" and "distribution drift" that may occur with purely data-driven methods.

[0067] S5. Output a vulnerability report, which includes symbolic reasoning path, confidence level, and semantic description.

[0068] This method achieves a deep integration of symbolic logic and semantic understanding, improving the reliability of semantic reasoning while ensuring verifiability.

[0069] This solution adopts a layered hybrid architecture, in which the entire inference process is organized into five interrelated stages, forming a complete processing pipeline:

[0070] The first stage is the source code input and preprocessing stage. The system receives the source code or binary program to be analyzed, parses it using static analysis tools, and extracts the abstract syntax tree, control flow graph, and data flow information of the program. This stage also includes an event extraction process, which identifies and marks key operations in the program (such as function calls, memory operations, resource management, etc.) to prepare for subsequent symbolic modeling.

[0071] The second stage is the symbolic modeling stage, executed by the TPS module. This module transforms the event sequences extracted in the first stage into symbolic representations with time-series labels and confidence levels, and simultaneously constructs a symbolic dependency graph to establish temporal and data dependencies between events. The output of this stage is a complete symbolic space. and the corresponding dependency graph Together, they form the formal basis for subsequent reasoning.

[0072] The third stage is the reasoning stage, led by the BCER module. In this stage, the system first performs pure symbolic reasoning based on the symbolic system's own rule base, attempting to match known vulnerability patterns. When symbolic reasoning encounters uncertainty (i.e., deterministic metrics)... When the threshold is reached, the system invokes the large language model for semantic-level assisted reasoning. Based on the natural language description transformed by the semantic mapping function, the large language model generates a series of reasoning action hypotheses. These hypotheses are then rigorously symbolically verified by a verification operator; only actions that pass verification are accepted and used to update the symbolic state.

[0073] The fourth stage is the learning stage, executed by the Evo-RL module. This module continuously monitors the inference process, recording the path, result, and verification feedback for each inference. When the system detects that certain inference patterns recur and have a high verification pass rate, it automatically extracts common features from these successful cases, generates new symbolic rules, and incorporates them into the rule base.

[0074] This process is achieved through reinforcement learning algorithms, using symbolic consistency loss as a constraint and detection performance as an optimization objective, so that the rule base can continuously evolve and improve.

[0075] The fifth stage is the output and report generation stage. The system organizes the vulnerability conclusions derived from the reasoning, the complete symbolic reasoning chain, the confidence assessment at each step, and the relevant code locations and triggering conditions into a structured report. The report not only includes the final vulnerability assessment but also a complete chain of reasoning evidence, making the results traceable and verifiable, meeting the stringent requirements of security auditing and legal evidence collection.

[0076] These five stages are not strictly unidirectional flows, but rather involve multiple feedback loops. For example, new rules generated during the learning stage are fed back to the TPS module, enhancing its symbolic modeling capabilities; verification results from the inference stage are fed back to the Evo-RL module, guiding its optimization strategy. This closed-loop structure endows the system with "evolutionary" characteristics—continuously updating the inference operators through reinforcement learning, enabling the symbolic system to adapt to new vulnerability patterns; "interpretability"—ensuring clear logical basis for model outputs through symbolic verification constraints; and "traceability"—achieving complete recording of multi-stage vulnerability behavior through temporal probabilistic logic modeling.

[0077] Based on the same inventive concept, such as Figure 2 As shown, this embodiment of the invention also provides a vulnerability discovery system based on symbolic-semantic hybrid reasoning. This system is used to implement the above method and includes:

[0078] The temporal probability symbol module is used to convert program events into temporal probability symbols and construct symbol dependency graphs;

[0079] The symbol-semantic bidirectional coupled reasoning module is used to call a large language model to generate semantic reasoning actions and perform symbol verification through verification operators.

[0080] The reinforcement learning self-evolutionary module is used to update the inference strategy and generate new symbolic rules based on verification feedback.

[0081] The report generation module is used to generate vulnerability reports that include inference chains and confidence levels.

[0082] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A vulnerability discovery method based on symbolic-semantic hybrid reasoning, characterized in that, include: S1. Parse the target program and extract events to obtain the event sequence; S2. Convert the event sequence into a symbolic representation with time-series labels and confidence levels, and construct a symbolic dependency graph; wherein, the symbols... Represented as: ； in For program events, For timing logic labels, Confidence level; S3. Based on the symbolic dependency graph, perform reasoning. When the system determinism index is lower than a set threshold, call the Large Language Model (LLM) to generate semantic reasoning actions. Perform symbolic verification on the semantic reasoning actions through a verification operator, and add the verified semantic reasoning actions to the symbolic state. S4. Based on the reinforcement learning mechanism, extract new symbolic rules from the verified inference chain and update the rule base; S5. Output a vulnerability report, which includes symbolic reasoning path, confidence level, and semantic description.

2. The method according to claim 1, characterized in that, The system deterministic index ,when The generation and verification of semantic reasoning actions are triggered in real time. This is the set value.

3. The method according to claim 1, characterized in that, The verification operator in S3 Defined as: If semantic reasoning action If the symbolic logic constraints are satisfied, output 1 and update. Otherwise, output 0. in, For symbolic state, Inference actions generated for LLM, .

4. The method according to claim 1, characterized in that, The reinforcement learning mechanism includes: ； ； in, For the objective function For symbol consistency loss, The weight of symbolic consistency in the overall optimization objective. For reasoning actions, This is a symbolic state.

5. A vulnerability discovery system based on symbolic-semantic hybrid reasoning for implementing the method of claim 1, characterized in that, The system includes: The temporal probability symbol module is used to convert program events into temporal probability symbols and construct symbol dependency graphs; The symbol-semantic bidirectional coupled reasoning module is used to call a large language model to generate semantic reasoning actions and perform symbol verification through verification operators. The reinforcement learning self-evolutionary module is used to update the inference strategy and generate new symbolic rules based on verification feedback. The report generation module is used to generate vulnerability reports that include inference chains and confidence levels.

6. The system according to claim 5, characterized in that, The symbol output by the time-series probability symbol module is The first element A timing logic label represents a specific event in a program. It is at least one of the timing operators G, F, X, and U. The G operator indicates that an event or condition is true throughout the entire execution process; the F operator indicates that an event will eventually be true at some point; the X operator indicates that an event is true in the next state and is used to describe single-step state transitions; and the U operator indicates that event A is true until event B occurs. The third element... The confidence level represents the occurrence of the event or the validity of the related inference, and is a preset probability value between 0 and 1.

7. The system according to claim 5, characterized in that, The symbol-semantic bidirectional coupled reasoning module includes a semantic mapping function, which is used to convert symbolic states into natural language descriptions input to the large language model.

8. The system according to claim 5, characterized in that, The reinforcement learning self-evolution module models the reasoning process as a Markov decision process and optimizes the policy through a reward function.

9. The system according to claim 5, characterized in that, The vulnerability report output by the report generation module includes symbolic reasoning path, confidence level at each step, temporal relationship, semantic description, and hash identifier.

Images