Generative code model reinforcement method and system oriented to software supply chain security and storage medium

Abstract

The invention discloses a software supply chain security-oriented generative code model reinforcement method and system and a storage medium, and the method comprises the steps: S1, constructing a security knowledge in an offline state, pre-constructing a machine-readable security knowledge base for providing guidance for the online generation of a subsequent large model; s2, online analysis of a request: after a system receives a code generation request of a user, carrying out intelligent analysis, and matching and screening out key security knowledge; and S3, generating a safe and reliable code: integrating the results of the step S1 and the step S2, actively guiding the large language model to avoid potential safety risks, and generating the safety code for user needs. The system and the storage medium are realized based on the method. The method has the advantages that the simplification rate is higher, the universality is higher, the significant program scale can be reduced, and the execution efficiency can be improved.

Description

Technical Field

[0001] This invention mainly relates to the field of software security technology, specifically a generative code model hardening method, system, and storage medium for software supply chain security. Background Technology

[0002] Throughout the long history of software development, coding has always been an intellectually intensive task heavily reliant on human expertise and experience. However, in recent years, with the rapid development of deep learning technology, artificial intelligence technologies, represented by large-scale pre-trained language models, are reshaping the entire software development process with unprecedented depth and breadth. These models can automatically generate code of varying granularities, from simple function snippets to complex program modules, based on high-level natural language descriptions provided by developers. This significantly improves development efficiency, lowers the programming threshold, and accelerates the prototyping and iteration cycles of software products. This technological revolution signifies that software development is moving from the traditional era of manual coding to a new intelligent paradigm of human-machine collaboration.

[0003] To further overcome the knowledge limitations of standard large language models (whose knowledge base ends at a certain point in time in the pre-training data) and the "illusion" problem that may occur in specific domain tasks, the industry has developed retrieval-enhanced generation technology and successfully applied it to the field of code generation, forming the so-called retrieval-enhanced code generation framework.

[0004] The core idea of ​​RACG is to retrieve the most relevant, high-quality code examples or knowledge fragments from a vast external knowledge base based on the user's query before code generation. This retrieved content is then used as contextual information and injected into the prompts of the large language model along with the user's original query. In this way, the model can "reference" these real-time, specific, and highly relevant examples, thereby generating code that is more functionally correct, logically rigorous, and conforms better to specific API usage specifications. RACG technology significantly improves the functional correctness of generated code and has become a core pillar technology for building advanced AI programming assistants.

[0005] However, existing technologies, in their pursuit of functional correctness, generally suffer from a fatal blind spot: a systematic neglect of security. Current mainstream RACG systems implicitly assume in their design that code examples retrieved from external knowledge bases are trustworthy and secure. This assumption is extremely fragile in the real world. First, LLMs themselves learn from a large amount of publicly available code with security vulnerabilities during the pre-training phase, leading to a natural risk of introducing security flaws into the generated code. Multiple studies have confirmed that a significant proportion of AI-generated code contains common security vulnerabilities.

[0006] Even more serious is that the introduction of the RACG framework has not alleviated this problem; instead, it has created a new and more destructive attack vector—knowledge base poisoning. Attackers can meticulously construct code snippets containing common security vulnerabilities (such as buffer overflows, SQL injection, and weak random number generation), disguise them as normal code implementing commonly used functions, and then upload them to open platforms such as GitHub. When the RACG system's search engine queries matching examples for users, these "poisoned" malicious samples may be selected due to their semantic similarity in functionality. Once these insecure code examples are injected into the LLM's hints, the model will highly likely mimic their coding patterns and logical flaws, thereby reproducing the same security vulnerabilities in the final generated code. This is equivalent to attackers using the RACG system as a springboard to directly and precisely implant security vulnerabilities into developers' projects. This threat is not a theoretical hypothetical; related research shows that even a single poisoned sample in the knowledge base can lead to up to 48% of the generated code containing vulnerabilities, posing a direct and serious threat to software supply chain security.

[0007] Faced with this serious challenge, existing mitigation measures are proving inadequate. The most common approach is to employ a "post-scanning" strategy, which involves scanning for vulnerabilities using traditional static application security testing tools after the AI ​​has generated the code. This approach has a fundamental flaw: First, it is passive and delayed, and cannot prevent the generation of vulnerabilities from the source. Secondly, it increases the complexity and time delay of the software development process, which runs counter to the original intention of AI-assisted development to pursue high efficiency. Third, automatically repairing vulnerabilities detected by scanning is itself a complex technical challenge.

[0008] Therefore, there is an urgent need in this field for a novel, proactive defense mechanism that can endow large language models with the ability to identify and avoid security risks during the code generation process, thereby fundamentally solving the inherent security vulnerability of RACG systems. Summary of the Invention

[0009] The technical problem to be solved by this invention is: addressing the technical problems existing in the field of RACG security, this invention provides a simple, highly secure, and widely applicable method, system, and storage medium for strengthening generative code models for software supply chain security, which can provide a more secure generation experience for users of large models.

[0010] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A method for hardening generative code models for software supply chain security includes: Step S1: Build a security knowledge base: In offline mode, a machine-readable security knowledge base is built in advance to provide guidance for the subsequent online generation of large models; Step S2: Online Request Analysis: When the system receives a user's code generation request, it performs intelligent analysis to match and filter out key security knowledge. Step S3: Generate secure and reliable code: Integrate the results of steps S1 and S2, proactively guide the large language model to avoid potential security risks, and generate secure code that meets user needs.

[0011] As a further improvement to the method of the present invention: step S1 includes: Step S11: Selection and preprocessing of data sources; Select a real-world vulnerability dataset and focus the data processing granularity at the function level; The system analyzes each vulnerability fix submission, locates the specific function change, and extracts the complete code text before and after the function fix; Step S12: Automated knowledge extraction based on a large language model; For each function-level "vulnerability-fix" pair, the system takes the vulnerability description, vulnerability type, and code differences before and after the function fix as input, feeds them into a pre-defined large language model; executes the core extraction task, and outputs the results in JSON format to ensure the structured nature of the results. Step S13: Vectorization and indexing of the knowledge base; store all extracted JSON-formatted security knowledge entries into the database; the system will use an advanced text embedding model to vectorize the functional description text in each security knowledge entry, generating a high-dimensional vector; then store these vectors in a dedicated vector database and create an index.

[0012] As a further improvement to the method of the present invention: step S12 includes: The model first analyzes the context of the vulnerable code to understand its business logic and generates a concise natural language description of the function's core functionality. Next, the model delves into the causes of the vulnerability and outputs two parts: a natural language description and a code example. Finally, the model analyzes the patched code, summarizes secure coding paradigms, and similarly outputs two parts: a natural language description and a code example.

[0013] As a further improvement to the method of the present invention: step S2 includes: Step S21: Refined decomposition of user queries; Step S22: Preliminary retrieval for subtasks; First, traverse each subtask generated in the previous step; Vectorize the description text of each subtask, and then perform a cosine similarity search on its vector in the knowledge base index built in the first step to find the k' security knowledge items that are most similar to the function of the subtask. Step S23: Risk perception reordering and filtering; Load a pre-statistical LLM vulnerability tendency model; This model records the frequency of different types of common vulnerabilities in the LLM-generated code; For each retrieved security knowledge item, the system will look up its associated CWE and use its corresponding frequency as the risk weight of that knowledge.

[0014] As a further improvement to the method of the present invention: in step S21, the user's original query is first input into a large language model configured with decomposed tasks; through the designed prompt template, the model will output a logically clear list of subtasks containing multiple steps.

[0015] As a further improvement to the method of the present invention: in step S23, for each subtask, the risk weights of all its candidate security knowledge are added together to obtain the total risk score of the subtask; according to the total risk score, all subtasks are sorted in descending order; only the k highest-ranked "high-risk subtasks" and their corresponding security knowledge are retained; all other subtasks and their associated knowledge are discarded.

[0016] As a further improvement to the method of the present invention: step S3 includes: Step S31: Construct dynamic security enhancement prompts; the prompts are dynamically generated for each user request, and their content depends entirely on the sub-tasks decomposed from the request and the relevant risk assessment results; Step S32: Guide the large language model to generate a secure model; send the "security enhancement hint" obtained in step S31 to the target code to generate the large language model.

[0017] As a further improvement to the method of the present invention: in step S31, the model output includes the user's original query and optional functional code examples retrieved by the RACG method; the selected "high-risk sub-tasks" and their corresponding structured security knowledge are clearly and systematically inserted into the specific area of ​​the prompt to form a prompt.

[0018] The present invention also provides a system including a computer or processor, the computer or processor being used to execute a computer program comprising any of the methods described above.

[0019] The present invention also provides a storage medium that can be read by a computer or processor, wherein the storage medium stores a computer program for executing any of the above methods.

[0020] Compared with the prior art, the advantages of the present invention are as follows: 1. The generative code model hardening method, system, and storage medium of this invention, aimed at software supply chain security, pioneers a proactive defense mechanism to address the vulnerability of existing RACG systems to knowledge base poisoning attacks. Instead of passively learning code, it proactively "injects" security knowledge, such as secure coding standards and risk warnings, into the large language model before generation. This enables the model to identify and avoid traps in retrieved "toxic" examples and perform self-correction. This "early warning" model fundamentally enhances system security and effectively fills a security gap in this field.

[0021] 2. The generative code model hardening method, system, and storage medium for software supply chain security of this invention have advantages such as low cost and wide applicability. Unlike other technologies, it does not require expensive and time-consuming fine-tuning (retraining) of the model. It injects security knowledge by dynamically modifying prompt words, like a plug-and-play "security plugin," which can flexibly adapt to any open-source or closed-source large language model. More importantly, it can achieve cross-language generalization by utilizing universal security principles, effectively improving code security even when specific language knowledge is lacking.

[0022] 3. The generative code model hardening method, system, and storage medium of this invention for software supply chain security transforms code security assurance from the traditional "post-event scanning" model to "pre-event prevention," moving away from passively generating code and then searching for vulnerabilities, and instead intervening during the generation process. By incorporating security knowledge and best practices into the prompts, this invention guides the model to avoid known security risks from the outset. This "security shift left" concept directly improves code quality from the source, avoiding delays and costs associated with subsequent scanning and remediation, resulting in a more efficient and thorough approach. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the method of the present invention.

[0024] Figure 2 This is a code diagram generated after the large model retrieves code snippets containing security flaws in specific application instances.

[0025] Figure 3 This is a diagram illustrating security knowledge built from historical vulnerabilities in specific application examples.

[0026] Figure 4 This is a schematic diagram illustrating the principle of generating secure and reliable code in specific application instances. Detailed Implementation

[0027] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] like Figure 1As shown, the generative code model hardening method for software supply chain security of the present invention includes: Step S1: Build a security knowledge base; In offline mode, a high-quality, machine-readable security knowledge base is pre-built to provide guidance for subsequent online generation of large models; Step S2: Analyze the request online; When the system receives a user's code generation request, it performs intelligent analysis to accurately match and filter out the most critical security knowledge. Step S3: Generate secure and reliable code; By integrating the results of steps S1 and S2, the large language model is proactively guided to avoid potential security risks and generate secure code that meets user needs.

[0029] In a specific application example, the detailed process of step S1 may include: Step S11: Selection and preprocessing of data source; Clearly select large-scale, high-quality real-world vulnerability datasets.

[0030] The key to choosing this type of dataset lies in its provision of precise pairings of "vulnerable code" and "fixed code," and this "before-and-after comparison" is the cornerstone for extracting high-quality security knowledge.

[0031] The data processing then focuses on the function level. The system analyzes each vulnerability fix submission, pinpoints the specific function changes, and extracts the complete code text before and after the function fix.

[0032] Step S12: Automated knowledge extraction based on a large language model; For each function-level "vulnerability-fix" pair, the system takes the vulnerability description (such as CVE description), vulnerability type (such as CWE classification), and the code differences before and after the function fix as input, and feeds them into a large language model with pre-defined tasks.

[0033] The LLM is instructed to perform three core extraction tasks and output them in JSON format to ensure the structured nature of the results, specifically including: Function Description: The model first analyzes the context of the vulnerable code to understand its business logic and generates a concise natural language description of the function's core functionality. This step is to enable semantic matching of the user's development intent with relevant security knowledge during subsequent retrieval. Root cause: The model then delves into the causes of the vulnerability and outputs two parts: a natural language description (clearly explaining why the vulnerability occurred) and a code example (precisely extracting the line or several lines of key code that caused the vulnerability, serving as a negative example). Repair Mode: Finally, the model analyzes the repaired code, summarizes safe coding paradigms, and outputs two parts: natural language description and code examples.

[0034] Step S13: Vectorization and indexing of the knowledge base; First, all security knowledge entries extracted in JSON format from step S12 are stored in the database. To achieve efficient semantic retrieval, the system uses an advanced text embedding model to vectorize the functional description text in each security knowledge entry, generating a high-dimensional vector.

[0035] These vectors are then stored in a dedicated vector database and indexed. This allows the system to quickly find relevant security knowledge based on semantic similarity, ensuring retrieval efficiency even with a massive knowledge base.

[0036] In a specific application example, step S2 includes: Step S21: Refined decomposition of user queries.

[0037] User requests are typically macroscopic, while security vulnerabilities often lie in microscopic implementation details. Therefore, macroscopic tasks must be broken down to accurately match security knowledge. First, the user's original query is input into a large language model configured with decomposed tasks. Through carefully designed prompt templates, the model outputs a logically clear list of subtasks containing multiple steps.

[0038] Step S22: Preliminary retrieval for subtasks.

[0039] First, iterate through each subtask generated in the previous step. Vectorize the description text of each subtask, and then perform a cosine similarity search on its vector within the knowledge base index built in the first step to find k' (e.g., k'=2) security knowledge points that are most similar to the function of that subtask. This results in a small, initially relevant set of security knowledge candidates for each subtask.

[0040] Step S23: Reordering and filtering of risk perception; Since not all subtasks carry the same level of risk, the system loads a pre-calculated LLM vulnerability propensity model. This model records the frequency of different types of common vulnerabilities (CWEs) appearing in the LLM-generated code. For each retrieved security knowledge entry, the system looks up its associated CWE and uses its frequency as the risk weight for that knowledge.

[0041] For each subtask, the risk weights of all candidate security knowledge are summed to obtain the total risk score for that subtask. Based on the total risk score, all subtasks are sorted in descending order. Only the top k (e.g., k=5) "high-risk subtasks" and their corresponding security knowledge are retained. All other subtasks and their associated knowledge are discarded.

[0042] In a specific application example, the detailed process of step S3 includes: Step S31: Construct dynamic security enhancement prompts; The model output includes the user's original query, along with optional functional code examples retrieved using traditional RACG methods. The selected "high-risk subtasks" and their corresponding structured security knowledge are clearly and systematically inserted into specific areas of the prompt. The prompt's structure explicitly states: "For the following subtasks, please be aware of the potential vulnerabilities described and adopt the recommended remediation methods." This prompt is dynamically generated for each user request, and its content depends entirely on the subtasks decomposed from the request and the relevant risk assessment results.

[0043] Step S32: Guide the large language model to generate securely; The "security enhancement hints" obtained in step S31 are sent to the target code generation large language model. At this point, the information received by the model is multi-dimensional. Even if the retrieved functional examples themselves may have vulnerabilities, the security knowledge explicitly injected in the hints (examples) forms a strong instruction constraint. This allows the model to prioritize following these explicit security rules when making decisions, rather than blindly imitating insecure functional examples.

[0044] In a specific application example, such as Figure 2 As shown, this is the code generated after a large model retrieves an example code snippet containing a security flaw. The specific application steps of the generative code model hardening method for software supply chain security proposed in this invention include: Step S1: Building a Security Knowledge Base: In offline mode, a high-quality, machine-readable security knowledge base is pre-built to guide the subsequent online generation of large models; security knowledge built from historical vulnerabilities, such as... Figure 3 As shown; Step S2: Online Request Analysis: After the system receives the user's code generation request, this step will perform intelligent analysis to accurately match and filter out the most critical security knowledge.

[0045] Step S3: Generate Secure and Reliable Code: This step integrates the results of steps S1 and S2, proactively guiding the large language model to avoid potential security risks and generate secure code tailored to user needs. Examples of steps S2 and S3 are provided. Figure 4 As shown.

[0046] The present invention also provides a system including a computer or processor, the computer or processor being used to execute a computer program comprising any of the methods described above.

[0047] The present invention also provides a storage medium that can be read by a computer or processor, wherein the storage medium stores a computer program for executing any of the above methods.

[0048] Those skilled in the art will understand that the above embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0049] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for hardening generative code models for software supply chain security, characterized in that, include: Step S1: Build a security knowledge base: In offline mode, a machine-readable security knowledge base is built in advance to provide guidance for the subsequent online generation of large models; Step S2: Online Request Analysis: When the system receives a user's code generation request, it performs intelligent analysis to match and filter out key security knowledge. Step S3: Generate secure and reliable code: Integrate the results of steps S1 and S2, proactively guide the large language model to avoid potential security risks, and generate secure code that meets user needs.

2. The generative code model hardening method for software supply chain security according to claim 1, characterized in that, Step S1 includes: Step S11: Selection and preprocessing of data sources; Select a real-world vulnerability dataset and focus the data processing granularity at the function level; The system analyzes each vulnerability fix submission, locates the specific function change, and extracts the complete code text before and after the function fix; Step S12: Automated knowledge extraction based on a large language model; For each function-level "vulnerability-fix" pair, the system takes the vulnerability description, vulnerability type, and code differences before and after the function fix as input, feeds them into a pre-defined large language model; executes the core extraction task, and outputs the results in JSON format to ensure the structured nature of the results. Step S13: Vectorization and indexing of the knowledge base; store all extracted JSON-formatted security knowledge entries into the database; the system will use an advanced text embedding model to vectorize the functional description text in each security knowledge entry, generating a high-dimensional vector; then store these vectors in a dedicated vector database and create an index.

3. The generative code model hardening method for software supply chain security according to claim 2, characterized in that, Step S12 includes: The model first analyzes the context of the vulnerable code to understand its business logic and generates a concise natural language description of the function's core functionality. Next, the model delves into the causes of the vulnerability and outputs two parts: a natural language description and a code example. Finally, the model analyzes the patched code, summarizes secure coding paradigms, and similarly outputs two parts: a natural language description and a code example.

4. The method for strengthening generative code models for software supply chain security according to any one of claims 1-3, characterized in that, Step S2 includes: Step S21: Refined decomposition of user queries; Step S22: Preliminary retrieval for subtasks; First, traverse each subtask generated in the previous step; Vectorize the description text of each subtask, and then perform a cosine similarity search on its vector in the knowledge base index built in the first step to find the k' security knowledge items that are most similar to the function of the subtask. Step S23: Risk perception reordering and filtering; Load a pre-statistical LLM vulnerability tendency model; This model records the frequency of different types of common vulnerabilities in the LLM-generated code; For each retrieved security knowledge item, the system will look up its associated CWE and use its corresponding frequency as the risk weight of that knowledge.

5. The generative code model hardening method for software supply chain security according to claim 4, characterized in that, In step S21, the user's original query is first input into a large language model configured with decomposed tasks; through the designed prompt template, the model will output a logically clear list of subtasks containing multiple steps.

6. The generative code model hardening method for software supply chain security according to claim 4, characterized in that, In step S23, for each subtask, the risk weights of all its candidate security knowledge are added together to obtain the total risk score of the subtask. Based on the total risk score, all sub-tasks are sorted in descending order; Only the top k "high-risk subtasks" and their corresponding security knowledge will be retained; all other subtasks and their associated knowledge will be discarded.

7. The method for strengthening generative code models for software supply chain security according to any one of claims 1-3, characterized in that, Step S3 includes: Step S31: Construct dynamic security enhancement prompts; the prompts are dynamically generated for each user request, and their content depends entirely on the sub-tasks decomposed from the request and the relevant risk assessment results; Step S32: Guide the large language model to generate a secure model; send the "security enhancement hint" obtained in step S31 to the target code to generate the large language model.

8. The method for strengthening generative code models for software supply chain security according to claim 7, characterized in that, In step S31, the model output includes the user's original query and optional functional code examples retrieved through the RACG method; the selected "high-risk sub-tasks" and their corresponding structured security knowledge are clearly and systematically inserted into the specific area of ​​the prompt to form a prompt.

9. A system comprising a computer or processor, characterized in that, The computer or processor is used to execute a computer program that includes any one of the methods of claims 1 to 8.

10. A storage medium capable of being read by a computer or processor, characterized in that, The storage medium stores a computer program for executing any one of the methods of claims 1 to 8.

Images