Real-time vulnerability detection and repair system of AI code generation model

Abstract

The invention relates to the technical field of software security, and particularly discloses a real-time vulnerability detection and repair system of an AI code generation model. The system comprises a central coordinator, a real-time monitoring module, a deep analysis module, an intelligent repair module and a feedback learning module. The real-time monitoring module rapidly scans and triggers the generated codes; the deep analysis module performs interprocess stain analysis on the trigger code to generate a diagnosis report containing a precise data flow path; the intelligent repair module generates a repair patch under the function equivalence constraint according to the diagnosis report; and the feedback learning module collects the processing feedback of the developer on the repair patch, and drives the continuous optimization of each module of the system. According to the method, through layered progressive analysis and repair generation, the repair accuracy and the function safety are ensured; through a feedback learning mechanism, the self-adaptive evolutionary ability of the system is realized, the problems of unavailability of repair suggestions and static stiffness of the system in the prior art are solved, and real-time protection is provided for AI auxiliary programming.

Description

Technical Field

[0001] This invention relates to the field of software security technology, and more specifically, to a real-time vulnerability detection and repair system for an AI code generation model. Background Technology

[0002] With the widespread adoption of AI-assisted programming, AI code generation models have become an important tool for improving software development efficiency. However, the code generated by these models may contain potential security vulnerabilities, introducing security issues into the early stages of the software development lifecycle. Traditional security tools typically run after the code is written, making it difficult to meet the need for real-time protection against AI-generated code. Therefore, developing technical solutions that can be deeply integrated with AI coding activities and provide security intervention at the moment of code generation is of great significance.

[0003] Existing technical solutions have several shortcomings in addressing the real-time security challenges of AI-generated code. First, while common static application security testing tools or simple pattern-matching scanners can quickly detect known vulnerability patterns, they have high false positive rates and lack in-depth analysis of vulnerability causes, resulting in a large number of low-value alerts being pushed to developers, interfering with normal development work. Second, some solutions attempt to combine AI with vulnerability detection or remediation, but the detection and remediation processes are often independent. Remediation modules only generate generic patches based on vulnerability type tags, failing to fully consider the complete business logic context of the original code. This results in generated remediation code that may break the original functionality of the program, leading to poor usability and low developer adoption rates. Furthermore, existing systems generally lack self-evolution capabilities, failing to continuously learn from actual developer feedback and adapt to the unique coding styles and security requirements of different projects and teams. Their detection rules and remediation strategies are prone to becoming outdated, making it difficult to continuously improve accuracy and usability in the long run.

[0004] In summary, existing technologies face three interrelated problems in addressing real-time security issues of AI-generated code: high false positives, unavailable remediation suggestions, and a lack of system adaptability. These problems restrict their effective integration and efficient application value in the development process. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a real-time vulnerability detection and repair system for an AI code generation model, thereby addressing the problems mentioned in the background section.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a real-time vulnerability detection and remediation system for AI code generation models, comprising: The central coordinator manages the state transitions and inter-module scheduling of vulnerability handling tasks. As the system's hub, it coordinates the start-up, shutdown, and data transfer of each module through an event-driven mechanism to ensure the orderly progress of the processing flow. The real-time monitoring module, connected to the central coordinator, is used to monitor code generation activities and, through rapid matching based on predefined vulnerability feature templates, initially filters out high-risk suspected vulnerability code fragments from the code stream and generates trigger signals to the central coordinator. This module achieves the first layer of efficient filtering of massive generated code. The deep analysis module, scheduled and started by the central coordinator, is used to perform semantic-level vulnerability analysis on the code fragments and their complete function-level contexts that have been initially screened. This analysis confirms the authenticity of the vulnerability and accurately locates the pollution propagation path by constructing and analyzing the program dependency graph and data flow, and generates a structured diagnostic report containing the cause of the vulnerability and the propagation path. The intelligent repair module is invoked by the central coordinator after obtaining the diagnostic report. It is used to match repair strategies from a pre-set knowledge base according to the vulnerability type and code context indicated by the structured diagnostic report, and generate a repair patch that can safely replace the original vulnerability code under the condition of strictly adhering to the functional equivalence constraint. The feedback learning module, connected to the central coordinator, is used to collect and analyze the actions taken by developers in response to the code fix patches. By correlating the action results with the corresponding code snippets, diagnostic reports, and fix patches, different action types are classified into positive, negative, and correction samples. Based on these sample data, the module continuously optimizes the filtering rules of the real-time monitoring module, the analysis model of the deep analysis module, and the repair strategy of the intelligent repair module.

[0007] Furthermore, the deep analysis module performs semantic-level vulnerability analysis, specifically including the following steps: S1: Construct the program dependency graph of the code snippet and its context. The graph uses nodes to represent program statements and edges to represent data dependencies and control dependencies between statements, providing a structured program model for subsequent analysis. S2: Perform inter-process taint propagation analysis on the program dependency graph. Through predefined taint sources and dangerous sinks, combined with pre-set cleanup rules, systematically track and locate the complete data flow path from the taint source to the dangerous sink that has not been cleaned up. This step transforms the surface code pattern into a verifiable security semantic problem. S3: Based on the located data flow path, generate the structured diagnostic report. This report records in detail the vulnerability type, the location of the key code involved, and the specific pollution propagation chain, providing accurate input for automated remediation.

[0008] Furthermore, the inter-process taint propagation analysis performed in step S2 specifically includes: when the analysis involves function calls, querying the preset summary information of the called function. The summary information defines the taint propagation and cleansing effect of the function on its parameters and return values ​​in a structured form. The taint status of the calling point is updated according to the summary information to achieve cross-function analysis. This method avoids repeated analysis of the function's internal implementation, improving analysis efficiency while ensuring analysis accuracy.

[0009] Furthermore, the intelligent repair module generates code repair patches, specifically including the following steps: S1: Based on the vulnerability type and code context in the structured diagnostic report, match the applicable remediation template and constraints from the remediation strategy mapping table, which encodes the best practices for security coding in different vulnerability scenarios; S2: Instantiate the repair template based on the key parameters in the structured diagnostic report and generate preliminary repair code. This process ensures that the repair solution is tailored to the specific vulnerability context. S3: Perform functional equivalence verification on the preliminary repair code. By comparing the behavior of the original code and the repaired code on a preset test input set, ensure that the repair only eliminates security defects without changing the original functionality. After the verification is passed, generate the final code repair patch.

[0010] Furthermore, the functional equivalence verification is implemented using at least one of symbolic execution, abstract interpretation, or test case-based regression testing. Symbolic execution verifies equivalence by performing symbolic reasoning on the program path, abstract interpretation approximates the program behavior on an abstract value domain, and regression testing verifies by executing specific test cases. The system can select or combine the above methods according to code complexity and resource availability.

[0011] Furthermore, the feedback learning module is optimized based on the developer's actions, specifically implemented as follows: When the action is to adopt the patch, the corresponding case is used as a positive sample to enhance the deep analysis module's ability to identify similar vulnerability patterns. When the action is to adopt after editing, the differences between the system-generated fix patch and the developer's final code are compared. The difference information is used as a correction sample to optimize the applicability of the template in the fix strategy mapping table or to generate a new template that better suits the developer's preferences. When the handling operation is rejection and the reason is false alarm, the corresponding case is used as a negative sample to adjust the screening weight of the relevant feature template in the real-time monitoring module or the judgment threshold of the deep analysis module, so as to reduce the occurrence of similar false alarms in the future.

[0012] Furthermore, the feedback learning module periodically updates the system's internal model and strategy using the positive samples, correction samples, and negative samples through incremental learning or batch retraining. Incremental learning makes small-scale, rapid adjustments to the model after receiving new feedback, enabling the system to quickly adapt to current changes. Batch retraining, on the other hand, periodically uses accumulated samples for comprehensive training to obtain a more stable and globally optimized model.

[0013] Furthermore, the central coordinator maintains a state machine to track the status of each vulnerability handling task. The status includes at least "pending diagnosis," "in diagnosis," "pending repair," "in repair," "pending user decision," and "learning completion." The coordinator schedules the corresponding modules to execute tasks based on the status. This status management mechanism ensures that the processing of each task is controllable and traceable, and prevents task loss or chaotic processing logic.

[0014] Furthermore, the system also includes a user interface for visually displaying the code fix patch, the cause and propagation path of the vulnerability to developers, and providing interactive controls for developers to perform actions such as adoption, edit and then adopt or reject. This interface is integrated into the development environment in a non-blocking manner, ensuring that the development process is not interrupted while providing complete decision-making information.

[0015] Furthermore, the real-time monitoring module is embedded in the development environment as a front-end plugin to achieve low-latency capture of code change events; the central coordinator, deep analysis module, intelligent repair module, and feedback learning module are deployed as back-end services and communicate through message queues or remote procedure calls; the previously separate back-end distributed architecture ensures the high scalability and high availability of the system's processing power and can effectively cope with large-scale concurrent requests.

[0016] The technical effects and advantages of this invention are as follows: Compared to existing technologies where vulnerability detection and remediation are disconnected and remediation recommendations don't consider functionality preservation, this system introduces a constraint-guided intelligent remediation module and a collaborative deep analysis module, creating a coherent closed loop between vulnerability diagnosis and security remediation. The structured diagnostic report output by the deep analysis module not only includes the vulnerability type but also precisely describes the data flow path from the source of the vulnerability to the sink of the threat, providing specific code context for remediation. The remediation module then uses this report to match and instantiate remediation templates containing functionality preservation constraints from the remediation strategy mapping table, and verifies the functional equivalence of the generated remediation patches through methods such as symbolic execution or regression testing. This approach ensures that the generated remediation solution eliminates security flaws while maintaining the original input and output behavior of the code, thereby improving the accuracy of remediation recommendations and reducing the burden of secondary modifications for developers.

[0017] Compared to existing technologies where systems are static and unable to learn and evolve from usage, this system designs a closed-loop feedback learning module deeply integrated with a central coordinator. This module systematically captures the developer's final action on each fix suggestion, including adoption, edited adoption, or rejection, along with the reasons. These actions are associated with and stored with corresponding code snippets, diagnostic reports, and fix patches, and categorized as positive, negative, and correction samples. The system periodically uses this sample data, through incremental learning or batch retraining, to optimize the filtering rule weights of the real-time monitoring module, the semantic analysis model parameters of the deep analysis module, and the entries in the fix strategy mapping table. Thus, the system can continuously learn from real-world development interactions, dynamically adjusting its detection sensitivity, fix preferences, and decision thresholds, gradually adapting to the needs of specific development environments, and overcoming the limitations of traditional tools' rigid rules and poor adaptability.

[0018] Compared to existing technologies that rely on simple combinations of independent tools, leading to rigid processing flows and suboptimal resource allocation, this system achieves efficient resource scheduling and unified state management through a central coordinator and a hierarchical, progressive processing flow. The central coordinator, acting as the core scheduling hub, sequentially schedules the real-time monitoring, deep analysis, intelligent repair, and feedback learning modules based on a state machine, and manages the data flow between these modules. The real-time monitoring module performs lightweight, fast filtering, submitting only high-risk segments to the computationally intensive deep analysis module, effectively allocating computing resources. This hierarchical, progressive design allows the system to concentrate deep analysis resources on the most suspicious code segments while ensuring immediate response to generated code, achieving a balance between real-time requirements and deep analysis accuracy, and improving the overall system processing efficiency and scalability. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the overall architecture of a real-time vulnerability detection and repair system for an AI code generation model provided in an embodiment of the present invention; Figure 2 This is a complete flowchart of the layered and progressive vulnerability processing and feedback learning provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the principle of inter-process taint propagation analysis in deep semantic analysis according to an embodiment of the present invention; Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 As attached Figures 1 to 3 The system shown is a real-time vulnerability detection and remediation system based on an AI code generation model. The implementation of this system does not depend on a specific programming language, integrated development environment, or hardware platform.

[0022] S100: Real-time monitoring and initial triggering The task at this stage is to be aware of code generation activities and perform preliminary security screenings to identify potential targets that require in-depth analysis.

[0023] S101: Code Change Event Capture The real-time monitoring module continuously acquires code change events by attaching listeners to the document object model of the integrated development environment, or by parsing the application programming interface stream provided by the AI ​​code generation model.

[0024] When an event indicates that a new code snippet has been inserted or an existing code snippet has been modified, the module captures the text content in the code editor buffer corresponding to the changed area and defines this content as a code snippet to be analyzed. .

[0025] At the same time, the module will record The metadata includes its file path in the project, start and end line numbers, and its syntax context.

[0026] S102: Pattern-Based Rapid Analysis and Triggering capture Then, the real-time monitoring module starts a lightweight analysis pipeline. First, the module's built-in syntax parser will... The text is converted into an abstract syntax tree structure. Subsequently, a pattern matching engine based on a deterministic finite automaton traverses this abstract syntax tree.

[0027] Furthermore, the pattern matching engine is associated with a configurable rule base, which consists of a series of vulnerability feature templates. Each template encodes the syntactic features of a specific type of security vulnerability.

[0028] The job of the matching engine is to check The process of determining whether there exists a subtree structure in the abstract syntax tree that matches any vulnerability feature template will produce a numerical output, namely a preliminary risk score. . The calculation is the sum of the weight values ​​associated with each successfully matched template, i.e. ,in It is the first The preset weight of each successfully matched template reflects the severity and confidence level of the corresponding vulnerability pattern.

[0029] The module internally presets a dynamic first threshold. ,when At that time, When code is flagged as potentially vulnerable, the real-time monitoring module generates a structured trigger signal containing... Text content, metadata and The value is then sent to the central coordination service via network protocols.

[0030] S200: Hierarchical Scheduling and Deep Diagnostics Upon receiving a trigger signal, the hierarchical analysis scheduling module coordinates subsequent analysis processes. This module encapsulates the signal into a standardized analysis task object (Task) and creates and maintains a status flag for this Task to track its processing progress throughout the system.

[0031] S201: Task Scheduling and Priority Management The hierarchical analysis and scheduling module maintains a task queue. When a task arrives, the scheduling module determines its associated parameters based on the task's characteristics. The timing of its execution depends on the value and the current load of the deep diagnostic service in the system.

[0032] As a preferred implementation, the scheduling module employs a priority queue algorithm. The initial priority of a Task... Depend on Value determines, usually has The scheduling module continuously monitors the availability of each deep diagnostic service instance and distributes tasks with a status of "pending diagnosis" in the queue to idle service instances according to priority. Once a task is distributed, its status is updated to "diagnosing".

[0033] S202: Deep Semantic Analysis and Vulnerability Confirmation Once the selected deep diagnostic service instance receives the Task, it begins to perform deep semantic analysis.

[0034] S202.1: Program Model and Context Construction. Diagnostic Service Acquisition And its complete context in the source code file, including the function body, class definition and related import dependencies.

[0035] The system performs static analysis on this part of the code and constructs a program dependency graph, which is a directed graph. , where the node set Edge set represents a statement or expression in a program. It includes data dependency edges and control dependency edges.

[0036] S202.2: Impurity Propagation Analysis. The system predefines the set of source points. Collection of points and collection of purification points .

[0037] Analysis algorithm with graph Based on this, forward data flow analysis is performed, and the algorithm performs analysis on each node. Maintain a tainted state The state is a set whose elements are taint tags, each taint tag being used to uniquely identify a specific source of contamination.

[0038] Analysis from all nodes identified as source nodes The algorithm begins by initializing the taint state to the corresponding taint label. Then, iteratively propagates the taint state along the edge direction.

[0039] The propagation rule is defined as: if a node The operation will spread the stain, then It is the union of the tainted states of all its input nodes; if a node The operation belongs to ,but It is set to an empty set.

[0040] Furthermore, as a preferred implementation, when the analysis encounters a function call, inter-procedural analysis technology is used, and the system queries or dynamically constructs the project's call graph (CG).

[0041] For the called function The system uses its function summary The function summary It is a structured data object used to describe functions. Rules governing the propagation, cleansing, and impact on the taint status of parameters and return values.

[0042] For example, it can be implemented as a mapping table whose entries record functions. The position and return value of each parameter are correlated with tainted operations (such as propagate and sanitize) to define the rules for tainted state transitions.

[0043] The digest can be automatically generated during the project build phase by offline analysis of the function body and stored in the digest database in association with the function signature; for standard library or third-party library functions, a predefined secure digest is used.

[0044] During the analysis, the digest is quickly retrieved using function signatures. The taint state of the actual parameters is transformed according to this mapping to obtain the taint state after the call, thereby achieving efficient and accurate cross-function analysis. This analysis is performed iteratively until the taint state of all nodes in the graph no longer changes, reaching the data flow fixed point.

[0045] S202.3: Vulnerability Path Determination. After analysis, the system checks all sink nodes. For any sink node ,if This indicates that there exists a source point. to the remittance point Unpurified contamination transmission pathways Each such path corresponds to a confirmed security vulnerability.

[0046] S202.4: Diagnostic Report Generation. For each confirmed vulnerability, the system generates a structured diagnostic report. .

[0047] The report records the following information in a machine-readable format: vulnerability type, source location. Location of the rendezvous point After generating a report containing the taint propagation path and the sequence of variables involved in the path, the diagnostic service updates the Task's status to "Diagnosis Complete" and sends the Task along with... Return to the scheduling module.

[0048] S300: Repair Generation and Functionality Verification After receiving a Task with a status of "diagnosis completed", the hierarchical analysis and scheduling module updates its status to "pending repair" and forwards it to the repair generation module.

[0049] S301: Repair Strategy Selection and Code Integration After the repair generation module receives the Task, it parses it. The module internally maintains a repair strategy mapping table. This mapping table is a queryable knowledge base, and its entries are in the form of... This indicates that for a vulnerability type (type), within a specific code context, a code template (Template) should be used and the constraint set (Constraints) should be satisfied. These Constraints include, for example, requirements regarding the performance impact of the patched code and dependencies on specific software library versions.

[0050] The initial entries in the mapping table are constructed based on common vulnerability types and best practices for secure coding. The module first starts from... Extract the vulnerability type (type) and analyze it. The context is characterized by parsing metadata such as package import statements and class definition annotations in the code and converting them into a set of matching feature identifiers.

[0051] Subsequent inquiry Candidate repair strategies are obtained by performing rule matching or similarity calculation between context features and conditions in the entries. The module then parses... The path in the code is used to extract the key parameter set Params, such as the location of the core code that needs to be modified and the name of the polluting variable.

[0052] Finally, the module binds and instantiates the selected Template and Params, synthesizing the initial repaired code. .

[0053] S302: Equivalence verification of the fixed code To ensure that the repair does not introduce functional errors, the system... Verification is required.

[0054] S302.1: Test Case Generation. System Analysis of Original Code. The input interface and logic automatically generate a set of test inputs. .

[0055] The generation method can combine random generation with symbolic execution based on code paths to cover different execution branches.

[0056] S302.2: Behavior Execution and Comparison. The system operates in an isolated runtime environment (sandbox) and uses... Each input in the code executes the original code. and the repaired code and record the output set. and .

[0057] S302.3: Equivalence Determination. The system compares each item and outputs the results. The determination condition is: for , and Functionally equivalent, this includes taking into account the legitimate conversions introduced by security fixes.

[0058] Furthermore, the equivalence verification can be implemented using at least one technique or a combination of techniques such as symbolic execution, abstract interpretation, or test case-based regression testing.

[0059] As a preferred implementation, the system can be based on Cyclic complexity CC and currently available computing resources Dynamically select the verification strategy. For example, if the CC is below a threshold and If sufficient, symbolic execution is used for more rigorous verification; otherwise, efficient regression testing is used.

[0060] S302.4: Patch generation. If and only if When passing the equivalence verification, the calculation of the repair generation module is performed. and The module identifies the differences between the two and generates a standard-format patch. Simultaneously, it generates a natural language description (Desc) explaining the reason for the fix. Subsequently, the Task's status is updated to "Fix complete, awaiting user decision."

[0061] S400: User Interaction and Decision Making The hierarchical analysis and scheduling module will analyze the Tasks and their results (Patch, Desc, ...) whose status is "Pending User Decision". (Summary), pushed to the client component in the integrated development environment.

[0062] S401: Visualization of Security Recommendations The client-side component presents an interactive panel as a non-modal notification within the code editor's user interface. This panel displays a side-by-side comparison view of code differences, clearly using color to indicate added, deleted, or modified lines of code. Additionally, the panel integrates an interactive view for graphically displaying the changes from... The vulnerability data stream path extracted from the image allows users to click on nodes in the image to jump to the corresponding source code.

[0063] S402: Capturing Developer Decisions The interactive panel provides three clearly defined button controls: "App Repair", "Apply After Editing", and "Reject".

[0064] 1. When the developer clicks "App Repair," the client component automatically applies the patch to the source code file and generates a record as follows. Feedback.

[0065] 2. When the developer clicks "Apply After Editing," the client component inserts the suggested changes into the editor, making it editable. The developer then modifies and confirms the changes, saving the final code. Then, the system generates a record as follows Feedback.

[0066] 3. When the developer clicks "Reject," the client component provides a list of reasons to choose from. After the developer selects a reason, a record is generated. Feedback.

[0067] Regardless of the type of operation, the client component will generate an interaction feedback record: At the same time, the system will associate the complete case data (including...) with this Task. , The patch and feedback are marked as ready for subsequent learning.

[0068] S500: Feedback Learning and System Optimization The feedback learning module monitors the case readiness status and periodically consumes these complete case data for learning and optimization.

[0069] S501: Classification and Structured Storage of Feedback Data The feedback learning module categorizes and structures the complete case data based on the Action type in the feedback: like Then the case will be constructed as a positive sample. storage.

[0070] like Then calculate the code corresponding to the Patch and Editing differences Construct the cases into calibration samples. storage.

[0071] like If the Reason includes "false positives", then the case will be constructed as a negative sample. storage.

[0072] S502: Feedback-based model iteration and policy update The feedback learning module periodically initiates offline learning tasks, using accumulated feedback samples to optimize the system. The system periodically updates the model and policy through both incremental learning and batch retraining.

[0073] 1. Diagnostic Model and Rule Optimization: Module Usage and Construct the training dataset. (The sentence fragment "from the samples..." appears to be incomplete and lacks context.) Its context is transformed into feature vectors ,Will Convert to target label (for , (For "safety").

[0074] Stain Analysis Model For example, a model based on a graph neural network is used, whose input feature vector From the program dependency graph The node embedding and graph structure are composed of: node embedding is obtained by vectorizing and concatenating the semantic information of the node's syntax type and associated identifiers; the graph structure uses an adjacency matrix to represent the dependencies between nodes.

[0075] These data Used for Supervised fine-tuning is performed, while system analysis leads to... The case chain led to the vulnerability signature template that initially triggered the alert. and automatically reduce its weight. .

[0076] In addition, the system monitors the average false alarm rate over a period of time. And according to the current Compared with the system's preset target false alarm rate The deviation between them is dynamically adjusted by a feedback control algorithm to adjust the global detection threshold. For example, the system can use a proportional controller to calculate the adjustment amount proportionally in order to keep the false alarm rate within a preset range.

[0077] 2. Repair strategy mapping table optimization: Module analysis and correction of samples The system comes from a large number of The learning model was used to derive new mapping rules. .

[0078] For example, when For a specific type and within a context, if Frequent display of templates Replace with Then a new rule is generated. or adjust The priority and applicable conditions of existing entries.

[0079] As a preferred implementation, the system implements a hybrid update strategy: incremental learning can be triggered by events, such as starting when a certain number (e.g., 100) of new feedback records are collected, and small-scale gradient descent updates are performed on the model parameters. Batch retraining is triggered by a scheduled task, such as once every 24 hours, to retrain the model using all samples from a fixed period (e.g., 7 days).

[0080] Updated model parameters Optimized mapping table The adjusted rule weights and thresholds will be securely deployed and hot-loaded into the corresponding online real-time monitoring, diagnosis, and repair service modules, thereby completing the iteration and evolution of the system's overall analysis and repair capabilities without interrupting services.

[0081] Through the cyclical execution of S100 to S500, the system realizes a complete closed-loop process from real-time detection, accurate diagnosis, automatic repair, and continuous self-optimization. In the software development process, it achieves real-time vulnerability detection, accurate repair, and adaptive continuous enhancement of the system for AI-generated code.

[0082] Finally, the following points should be noted: First, in the description of this application, it should be noted that, unless otherwise specified and limited, the terms "installation", "connection", and "linkage" should be interpreted broadly, and can be mechanical or electrical connections, or internal connections between two components, or direct connections. "Up", "down", "left", "right", etc. are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may change. Secondly: The accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other. In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A real-time vulnerability detection and repair system for an AI code generation model, characterized in that, The application relates to a vulnerability processing system, comprising: a central coordinator for managing the state transition and inter-module scheduling of vulnerability processing tasks; a real-time monitoring module connected with the central coordinator, for monitoring code generation activities, preliminarily screening out code segments containing potential vulnerability patterns through rapid matching, and generating a trigger signal to the central coordinator; a deep analysis module called by the central coordinator, for performing semantic-level vulnerability analysis on the preliminarily screened code segments and contexts thereof, and generating a structured diagnostic report containing vulnerability causes and propagation paths; an intelligent repair module called by the central coordinator, for generating a code repair patch based on the structured diagnostic report under the condition of meeting functional equivalence constraints; a feedback learning module connected with the central coordinator, for collecting and analyzing developer handling operations on the code repair patch, and optimizing the strategies or parameters of the real-time monitoring module, the deep analysis module and the intelligent repair module based on the analysis results.

2. The real-time vulnerability detection and repair system of an AI code generation model according to claim 1, wherein, The deep analysis module performs semantic-level vulnerability analysis, specifically comprising the following steps: S1: constructing a program dependence graph of the code segments and contexts thereof; S2: performing inter-process taint propagation analysis on the program dependence graph to locate data flow paths from pollution source points to dangerous sink points without purification; S3: generating the structured diagnostic report based on the located data flow paths.

3. The real-time vulnerability detection and repair system of an AI code generation model according to claim 2, wherein, In the step S2, the inter-process taint propagation analysis is performed, specifically comprising: when the analysis involves function calls, preset abstract information of the called function is queried, the abstract information defines taint propagation and purification effects of the function on parameters and return values, and the taint state is updated according to the abstract information to realize cross-function analysis.

4. The real-time vulnerability detection and repair system of an AI code generation model according to claim 1, wherein, The intelligent repair module generates a code repair patch, specifically comprising the following steps: S1: according to the vulnerability type and code context in the structured diagnostic report, matching an applicable repair template and constraint condition from a repair strategy mapping table; S2: instantiating the repair template according to key parameters in the structured diagnostic report to generate preliminary repair code; S3: performing functional equivalence verification on the preliminary repair code, and generating the final code repair patch after verification.

5. The real-time vulnerability detection and repair system of an AI code generation model according to claim 4, wherein, The functional equivalence verification is realized by at least one of symbolic execution, abstract interpretation or regression testing based on test cases.

6. The system of claim 1, wherein, The feedback learning module is optimized according to the handling operations of the developers, and the specific implementation manner is as follows: when the handling operation is to adopt the repair patch, a corresponding case is used as a positive sample for optimizing the model of the deep analysis module; when the handling operation is to adopt after editing, differences between the repair patch generated by the system and the final code of the developer are compared, and the difference information is used as a correction sample for optimizing the repair strategy mapping table; when the handling operation is to reject and the reason is false alarm, a corresponding case is used as a negative sample for adjusting the screening strategy of the real-time monitoring module or the judgment threshold of the deep analysis module.

7. The real-time vulnerability detection and repair system of an AI code generation model according to claim 6, wherein, The feedback learning module periodically updates the internal models and strategies of the system by using the positive sample, the correction sample and the negative sample through incremental learning or batch retraining.

8. The real-time vulnerability detection and repair system of an AI code generation model according to claim 1, wherein, The central coordinator tracks the status of each vulnerability processing task by maintaining a state machine, the state including at least to be diagnosed, in diagnosis, to be repaired, in repair, to be user decision and learning completed, and dispatches corresponding modules to perform tasks according to the state.

9. The real-time vulnerability detection and repair system of an AI code generation model according to claim 1, wherein, The system further comprises a user interaction interface for visualizing the code repair patch, the vulnerability cause and propagation path to the developer, and providing interaction controls for the developer to perform adoption, edited adoption or rejection operations.

10. The real-time vulnerability detection and repair system of an AI code generation model according to any one of claims 1 to 9, characterized in that, The real-time monitoring module is embedded in the development environment in the form of a front-end plug-in, the central coordinator, the deep analysis module, the intelligent repair module and the feedback learning module are deployed in the form of a back-end service, and communicate through a message mechanism.

Images