Warehouse-level vulnerability detection method and device based on large model function semantic abstract

Abstract

The invention belongs to the technical field of software security, and particularly discloses a warehouse-level vulnerability detection method and device based on a large model function semantic abstract. The method comprises the following steps: generating a vulnerability detection abstract syntax tree according to a to-be-detected source code; generating an assembly prompt word according to the complete source code of the node function in the unprocessed state and the target semantic abstract, and analyzing the node function in the unprocessed state according to the assembly prompt word by calling the target large model; and determining a vulnerability detection result of the to-be-detected source code according to the initial function semantic abstract and the structured function semantic abstract. Through the above mode, the vulnerability detection abstract syntax tree is generated by using the program structure modeling strategy and the full function call graph is constructed, and then the semantic abstract of the structured function is determined by using the semantic understanding capability of the target large model, that is, deep security analysis and vulnerability mining are performed from the local function to the global context. Therefore, the accuracy and comprehensiveness of warehouse-level vulnerability detection can be effectively improved.

Description

Technical Field

[0001] This application belongs to the field of software security technology, and more specifically, relates to a repository-level vulnerability detection method and apparatus based on large model function semantic summarization. Background Technology

[0002] With the continuous expansion of software scale and the significant increase in system complexity, cybersecurity faces severe challenges. Traditional vulnerability detection methods targeting isolated code snippets are no longer sufficient to address the security risks arising from complex interactions across modules and files in modern large-scale and structurally complex software projects. Therefore, repository-level vulnerability detection technology has emerged.

[0003] Currently, common methods for repository-level vulnerability detection rely on rule matching, static analysis tools, or machine learning algorithms based on code patterns. However, these methods typically require manual definition of vulnerability patterns or features, making it difficult to cover complex and diverse vulnerability scenarios. Furthermore, they have limited capabilities in cross-file and cross-function semantic understanding, hindering fine-grained semantic association analysis. This results in high false negative and false positive rates, as well as a somewhat one-sided view of the final repository-level vulnerability detection results. Therefore, the accuracy and comprehensiveness of these methods for repository-level vulnerability detection are low. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this application aims to provide a repository-level vulnerability detection method and apparatus based on large model function semantic summarization. This addresses the problem that existing technologies suffer from low accuracy and incompleteness in repository-level vulnerability detection due to their inability to cover complex and diverse vulnerability scenarios and their difficulty in achieving fine-grained semantic association analysis.

[0005] To achieve the above objectives, firstly, this application provides a repository-level vulnerability detection method based on large model function semantic summarization, including: Obtain the source code to be detected from the target code repository, and generate a vulnerability detection abstract syntax tree based on the source code to be detected; Construct a full function call graph based on the vulnerability detection abstract syntax tree, and identify the node functions in the full function call graph that are in an unprocessed state; Based on the complete source code of the node function in the unprocessed state and the target semantic summary, assembly prompt words are generated. Then, by calling the target large model, the node function in the unprocessed state is analyzed based on the assembly prompt words to obtain a structured function semantic summary. The vulnerability detection result of the source code to be detected is determined based on the initial function semantic summary corresponding to the node function in the processing state and the structured function semantic summary.

[0006] In one embodiment, the step of obtaining the source code to be detected from the target code repository and generating a vulnerability detection abstract syntax tree based on the source code to be detected includes: Obtain the source code to be detected from the target code repository, and perform lexical analysis on the source code to be detected based on a lexical analysis device; Based on the syntax analysis device, the lexical analysis results of the source code to be detected are subjected to syntax analysis according to the syntax rules of the programming language, and a tree-like hierarchical structure is generated based on the syntax analysis results. An initial abstract syntax tree is generated based on the tree-like hierarchical structure; The initial abstract syntax tree is standardized to obtain a vulnerability detection abstract syntax tree.

[0007] In one embodiment, the step of constructing a full function call graph based on the vulnerability detection abstract syntax tree and determining the node functions in the full function call graph that are in an unprocessed state includes: The vulnerability detection abstract syntax tree is identified, and the set of functions and the set of call edges between functions are determined based on the identification results; Construct a full function call graph based on the set of functions and the set of call edges between functions; The current state of each node function in the full function call graph is tracked by the activated state recording device; The node functions in the full function call diagram that are currently in an unprocessed state are selected.

[0008] In one embodiment, the step of generating assembly prompts based on the complete source code and target semantic summary of the node function in the unprocessed state, and analyzing the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary includes: Type identification is performed on the node functions in the unprocessed state, and leaf node functions and non-leaf node functions in the unprocessed state are obtained based on the type identification results. Determine the call hierarchy of the leaf node functions that are in an unprocessed state and the non-leaf node functions that are in an unprocessed state, respectively; Based on a bottom-up propagation strategy, the leaf node functions that are in an unprocessed state and the non-leaf node functions that are in an unprocessed state are sorted according to the calling level; Based on the complete source code and target semantic summary of the sorted unprocessed leaf node functions and unprocessed non-leaf node functions, assembly prompts are generated. Then, by calling the target large model, the unprocessed node functions are analyzed based on the assembly prompts to obtain a structured function semantic summary.

[0009] In one embodiment, the step of generating assembly prompts based on the complete source code and target semantic summary of the sorted unprocessed leaf node functions and unprocessed non-leaf node functions, and then analyzing the unprocessed node functions based on the assembly prompts by calling the target large model to obtain a structured function semantic summary, includes: Obtain the first complete source code of the sorted leaf node function that is in an unprocessed state, and generate the first assembly prompt word based on the first complete source code; Obtain the second complete source code of the sorted, unprocessed non-leaf node functions and the function semantic summary of the sub-functions; A target semantic summary is generated based on the function semantic summary of each of the sub-functions, and a second assembly prompt word is generated based on the second complete source code and the target semantic summary; The first assembly prompt and the second assembly prompt are analyzed separately, and the analyzed first assembly prompt and the second assembly prompt are encoded. By calling the target large model, the sorted unprocessed leaf node functions and the sorted unprocessed non-leaf node functions are analyzed according to the encoded first assembly prompt and second assembly prompt, respectively, to obtain a structured function semantic summary.

[0010] In one embodiment, the step of determining the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest includes: The overall function semantic summary is obtained based on the initial function semantic summary corresponding to the node function in the processing state and the structured function semantic summary; Deterministic vulnerability entries are extracted from the semantic summary of the total function, and a set of deterministic vulnerability entries is generated based on each of the deterministic vulnerability entries; The set of deterministic vulnerability entries is deduplicated by calling the path deduplication function, and the call chain is restored and the scope of impact is analyzed after deduplication. By calling the report merging function, vulnerability detection results of the source code to be detected are generated in report form based on multi-dimensional analysis results.

[0011] Secondly, this application provides a repository-level vulnerability detection device based on large model function semantic summarization, comprising: The generation module is used to obtain the source code to be detected in the target code repository and generate a vulnerability detection abstract syntax tree based on the source code to be detected; The determination module is used to construct a full function call graph based on the vulnerability detection abstract syntax tree, and to determine the node functions in the full function call graph that are in an unprocessed state. The analysis module is used to generate assembly prompts based on the complete source code and target semantic summary of the node function in the unprocessed state, and to analyze the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary. The determining module is further configured to determine the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest.

[0012] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method described in the first aspect or any possible implementation thereof.

[0013] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0014] Fifthly, this application provides a computer program product that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0015] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0016] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art: (1) This application utilizes program structure modeling strategy and target big model to construct a hierarchical, context-aware function-level security summary mechanism. That is, it uses program structure modeling strategy to generate vulnerability detection abstract syntax tree and construct full function call graph. Based on vulnerability detection abstract syntax tree and the construction of full function call graph, it ensures that the analysis process has complete call context support. Then, it uses the semantic understanding capability of target big model to determine structured function semantic summary, that is, to carry out in-depth security analysis and vulnerability mining from local function to global context, significantly reducing the false negative rate caused by local analysis, and realizing the effective identification of complex cross-function vulnerabilities in repository-level code, thereby effectively improving the accuracy and comprehensiveness of repository-level vulnerability detection.

[0017] (2) This application also introduces a parallel scheduling mechanism to maximize processing throughput while ensuring the order of dependencies, which can effectively improve the overall analysis efficiency. In addition, the design of structured function semantic summary makes the output of the target large model highly consistent and parsable, which is convenient for subsequent automated parsing and result summarization. The structured function semantic summary includes, but is not limited to, function function description, vulnerability analysis results, suspected / possible vulnerability list and deterministic vulnerability entries, which not only supports automated vulnerability aggregation and call chain tracing, but also facilitates manual auditing and subsequent integration. Finally, a high-credibility vulnerability detection report covering the target code repository is determined, which can greatly improve the comprehensiveness and maintainability of source code auditing.

[0018] In summary, this application obtains the source code to be detected from the target code repository and generates a vulnerability detection abstract syntax tree based on the source code. It then constructs a full function call graph based on the vulnerability detection abstract syntax tree and identifies the unprocessed node functions in the full function call graph. Based on the complete source code of the unprocessed node functions and the target semantic summary, it generates assembly prompts and analyzes the unprocessed node functions using the assembly prompts by calling the target large model to obtain a structured function semantic summary. Finally, it determines the vulnerability detection result of the source code to be detected based on the initial function semantic summary corresponding to the processed node functions and the structured function semantic summary. Through this method, a vulnerability detection abstract syntax tree and a full function call graph are generated using a program structure modeling strategy. Then, the semantic understanding capability of the target large model is used to determine the structured function semantic summary, i.e., in-depth security analysis and vulnerability mining are performed from local functions to the global context, thereby effectively improving the accuracy and comprehensiveness of repository-level vulnerability detection. Attached Figure Description

[0019] Figure 1 This is one of the flowcharts illustrating the repository-level vulnerability detection method based on large model function semantic summarization provided in this application embodiment; Figure 2 This is the second flowchart of the repository-level vulnerability detection method based on large model function semantic summarization provided in the embodiments of this application; Figure 3 This is a schematic diagram of the module structure of the repository-level vulnerability detection device based on large model function semantic summarization provided in the embodiments of this application; Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A exists alone, A and B exist simultaneously, and B exists alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0022] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. For example, "first response message" and "second response message," etc., are used to distinguish different response messages, not to describe a specific order of response messages.

[0023] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0024] Based on this, embodiments of this application provide a repository-level vulnerability detection method based on large model function semantic summarization, referring to... Figure 1 , Figure 1 This is one of the flowcharts illustrating the repository-level vulnerability detection method based on large model function semantic summarization provided in this application embodiment. In this embodiment, the repository-level vulnerability detection method based on large model function semantic summarization includes steps S10 to S40: Step S10: Obtain the source code to be detected from the target code repository, and generate a vulnerability detection abstract syntax tree based on the source code to be detected.

[0025] It should be noted that the target code repository refers to an independent repository storing the source code generated during the development of a software project. This target code repository can be a Git repository or a folder at a specified path. This embodiment does not impose any restrictions on this. There can be multiple source codes to be detected in the target code repository. These source codes can be obtained through syntax parsing. After obtaining the source codes to be detected in the target code repository, a vulnerability detection abstract syntax tree can be generated based on the source codes to be detected. Each node in the vulnerability detection abstract syntax tree represents a structure in the source code to be detected, such as function definition, variable declaration, control flow statements (if, for, while), and function calls.

[0026] Further, step S10 includes: obtaining the source code to be detected from the target code repository, and performing lexical analysis on the source code to be detected based on a lexical analysis device; performing syntactic analysis on the lexical analysis results of the source code to be detected based on a syntax analysis device according to the syntax rules of the programming language, and generating a tree-like hierarchical structure based on the syntax analysis results; generating an initial abstract syntax tree based on the tree-like hierarchical structure; and performing standardization processing on the initial abstract syntax tree to obtain a vulnerability detection abstract syntax tree.

[0027] It should be understood that, for a lexical analysis device, after acquiring the source code to be tested from the target code repository, it reads the source code character by character, segmenting it into a series of meaningful lexical units. This process ignores irrelevant content such as spaces and comments, and identifies keywords, identifiers, operators, and literals to perform lexical analysis. This lexical analysis device can be a lexical analyzer. For a syntax analysis device, after acquiring the lexical analysis results of the source code to be tested, it performs syntax analysis according to the syntax rules of the programming language to check whether the code structure of the source code conforms to the syntax specifications. Here, the syntax analysis device can be a syntax analyzer.

[0028] Understandably, the initial abstract syntax tree strictly follows grammatical production rules, recording the complete derivation process. To effectively improve the accuracy of generating vulnerability detection abstract syntax trees, after obtaining the initial abstract syntax tree, it needs to be standardized. This standardization process includes, but is not limited to, simplification, transformation, and normalization operations, converting the unstructured source code to be detected into a vulnerability detection abstract syntax tree that can be understood and processed by a computer.

[0029] Step S20: Construct a full function call graph based on the vulnerability detection abstract syntax tree, and determine the node functions in the full function call graph that are in an unprocessed state.

[0030] Understandably, the full function call graph is used to represent the dependencies between code modules, and at the same time provides structural support for subsequent function semantic summary generation and vulnerability propagation path identification. After it is constructed, it also needs to be serialized and stored as a graph database or structured format for easy subsequent analysis.

[0031] Further, step S20 includes: identifying the vulnerability detection abstract syntax tree, and determining the function set and the set of call edges between functions based on the identification result; constructing a full function call graph based on the function set and the set of call edges between functions; tracking the current state of each node function in the full function call graph through a started state recording device; and filtering the node functions in the full function call graph whose current state is unprocessed.

[0032] It should be noted that after generating the vulnerability detection abstract syntax tree, the vulnerability detection abstract syntax tree can be identified, and structured information such as function definitions, function call relationships, parameter information, and call chains can be extracted from it based on the identification results. After determining the set of functions and the set of call edges between functions, a full function call graph is constructed, specifically as follows:

[0033] in, Represents the full function call graph. Represents a set of functions. This represents the set of call edges between functions, i.e., functions. Calling functions .

[0034] It should be understood that, in this embodiment, a state recording device is continuously maintained to track the current state of each node function in the full function call graph. Initially, all node functions are in an unprocessed state. If there are node functions in the full function call graph that are currently in an unprocessed state, the target large model needs to be called to process and analyze the node functions. At this time, the node functions in the full function call graph that are currently in an unprocessed state are selected.

[0035] Step S30: Generate assembly prompts based on the complete source code of the node function in the unprocessed state and the target semantic summary, and analyze the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary.

[0036] It should be understood that for node functions in an unprocessed state, this embodiment initiates parallel processing tasks. Each task targets one node function. Before calling the target large model, assembly prompts need to be generated. These assembly prompts are specially designed and include at least the complete source code of the node function and the target semantic summary. At this time, the unprocessed node function can be analyzed based on the assembly prompts by calling the target large model. The target large model can be a large speech model based on artificial intelligence.

[0037] It should be noted that after generating the structured function semantic digest, the structured function semantic digest is associated with the node function in the unprocessed state and saved to the database or memory. At the same time, the state of the node function is changed to the processed state.

[0038] Step S40: Determine the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest.

[0039] Understandably, the initial function semantic digest refers to the function semantic digest generated by the node function in the processing state. After the initial function semantic digest is generated, it is directly saved to the database or memory. After the structured function semantic digest is obtained by calling the target large model, it is combined with the initial function semantic digest to form a complete total function semantic digest. Based on the deterministic vulnerability entries in the total function semantic digest, the vulnerability detection result of the source code to be detected is determined. This vulnerability detection result can be output in the form of a report, which clearly lists all confirmed vulnerabilities found in the target code repository, including but not limited to vulnerability location, type, severity level, and possible remediation suggestions.

[0040] Further, step S40 includes: obtaining a total function semantic summary based on the initial function semantic summary corresponding to the node function in the processing state and the structured function semantic summary; extracting deterministic vulnerability entries from the total function semantic summary, and generating a set of deterministic vulnerability entries based on each of the deterministic vulnerability entries; deduplicating the set of deterministic vulnerability entries by calling a path deduplication function, and performing call chain restoration and impact scope analysis on the deduplicated set of deterministic vulnerability entries; and generating vulnerability detection results of the source code to be detected in report form based on the multi-dimensional analysis results by calling a report merging function.

[0041] It should be noted that after obtaining the overall function semantic summary based on the initial function semantic summary and the structured function semantic summary corresponding to the node function in the processing state, all extracted deterministic vulnerability entries are summarized, i.e., the set of deterministic vulnerability entries. This set of deterministic vulnerability entries may contain multiple different path descriptions for the same vulnerability. Especially when different entry functions in the call chain trigger the same vulnerability through different paths, it is easy to cause redundancy and duplicate reporting. Therefore, in order to prevent the same vulnerability from being reported multiple times, it is necessary to call the path deduplication function to deduplicate the set of deterministic vulnerability entries. This path deduplication function can be expressed as:

[0042] in, This represents the set of deterministic vulnerability entries. This represents a path deduplication function. This represents a Boolean function used to determine deterministic vulnerability entries. Is the transmission path blocked? Included (i.e.) The call path is (Supersets of vulnerabilities or vulnerabilities with the same vulnerability type and impact path).

[0043] It should be understood that the core logic of the aforementioned Boolean function is to retain the "most complete" or "most representative" propagation path and remove its sub-paths or duplicate paths to avoid path redundancy. After deduplication, it is necessary to perform call chain reconstruction and impact scope analysis on the deduplicated set of deterministic vulnerability entries, analyze and evaluate the propagation path of the vulnerability in the target code repository, the affected modules, and the possible attack surface. Then, by calling the report merging function, a report-style vulnerability detection result of the source code to be detected is generated based on the multi-dimensional analysis results. Specifically:

[0044] in, This indicates the vulnerability detection results of the source code to be tested, presented in report form. This indicates the report merging function. This indicates a deterministic vulnerability entry.

[0045] Understandably, for the report merging function, the merging process includes, but is not limited to, merging multiple reports with the same vulnerability type, matching propagation paths and triggering conditions into one, recording all potential triggering entry points and propagation paths for each vulnerability, and sorting them according to the severity of the vulnerability.

[0046] It should also be emphasized that the vulnerability detection results of the source code to be tested in the above-mentioned report format can ensure that users can fully grasp the potential security risks in the target repository, improve the ease of use through the visual presentation, and assist security personnel in analysis, verification and handling.

[0047] This embodiment acquires the source code to be detected from the target code repository and generates a vulnerability detection abstract syntax tree based on the source code. It then constructs a full function call graph based on the vulnerability detection abstract syntax tree and identifies the unprocessed node functions in the full function call graph. Based on the complete source code of the unprocessed node functions and the target semantic summary, it generates assembly prompts and analyzes the unprocessed node functions using the assembly prompts by calling the target large model, obtaining a structured function semantic summary. Finally, it determines the vulnerability detection result of the source code to be detected based on the initial function semantic summary corresponding to the processed node functions and the structured function semantic summary. Through this method, a vulnerability detection abstract syntax tree and a full function call graph are generated using a program structure modeling strategy. Then, the semantic understanding capability of the target large model is used to determine the structured function semantic summary, i.e., in-depth security analysis and vulnerability mining are performed from local functions to the global context, thereby effectively improving the accuracy and comprehensiveness of repository-level vulnerability detection.

[0048] In one specific implementation, this application provides steps for determining the semantic summary of a structured function. Please refer to... Figure 2 , Figure 2 This is the second flowchart illustrating the repository-level vulnerability detection method based on large model function semantic summarization provided in this application embodiment. Step S30 includes steps S301 to S304: Step S301: Perform type identification on the node functions in the unprocessed state, and obtain the leaf node functions and non-leaf node functions in the unprocessed state based on the type identification results.

[0049] It's important to note that since leaf node functions do not call other functions, there will be no function semantic summary for sub-functions when generating assembly prompts. Therefore, it's necessary to distinguish between leaf node functions in an unprocessed state and non-leaf node functions in an unprocessed state. A leaf node function refers to a function that has no outgoing edges in the full function call graph (i.e., does not call any other user-defined functions). This leaf node function represents the lowest level of the call dependency relationship and is the starting point for analysis.

[0050] Step S302: Determine the call hierarchy of the leaf node functions in the unprocessed state and the non-leaf node functions in the unprocessed state, respectively.

[0051] It is understandable that the call hierarchy refers to the call hierarchy of each function node in the full function call graph. For example, the call hierarchy of a leaf node function that is in an unprocessed state is higher than the call hierarchy of a non-leaf node function that is in an unprocessed state.

[0052] Step S303: Based on the bottom-up propagation strategy, sort the leaf node functions in the unprocessed state and the non-leaf node functions in the unprocessed state according to the calling hierarchy.

[0053] It should be understood that since the leaf node functions in the unprocessed state are at the lowest level of the call dependency relationship and the call hierarchy of the leaf node functions in the unprocessed state is higher than that of the non-leaf node functions in the unprocessed state, it is necessary to place the leaf node functions in the unprocessed state at the upper level so that they can be processed layer by layer.

[0054] Step S304: Generate assembly prompts based on the complete source code and target semantic summary of the sorted unprocessed leaf node functions and unprocessed non-leaf node functions. Then, by calling the target large model, analyze the unprocessed node functions based on the assembly prompts to obtain a structured function semantic summary.

[0055] It is understandable that structured function semantic summarization refers to the structured function semantic summary output by calling the target large model. The design of this structured function semantic summary ensures high consistency and parsability of the target large model's output, facilitating subsequent automated parsing and result aggregation. The structured function semantic summary can be in a four-element structured function semantic summary format, specifically:

[0056] in, Represents a semantic summary of structured functions. This describes the function's functionality. This indicates the results of the vulnerability analysis. This indicates a list of suspected / potential vulnerabilities. This indicates a deterministic vulnerability entry.

[0057] It should be noted that the function description can be a concise and accurate natural language summary of the core functionality, input / output behavior, and main execution logic of the node function. This part is used to establish an understanding of the function's intent and provide a semantic foundation for subsequent vulnerability analysis. The vulnerability analysis results can be based on the semantic information in the complete source code of the node function and its calling context to identify potential security flaws (e.g., buffer overflows, null pointer dereferences, privilege escalation, etc.) and assess their exploitability and vulnerability type. This part is used to systematically determine whether there are behaviors in the code that violate security policies. The suspected / potential vulnerability list lists the code locations in the function node that have security risks but lack sufficient evidence and cannot be definitively confirmed. Each record includes, but is not limited to, the specific code location, possible triggering conditions, and the function call chain path leading to the risk, preserving clues to uncertain vulnerabilities and supporting subsequent manual or automated verification. Deterministic vulnerability entries refer to security vulnerabilities that can be clearly determined to exist and be triggered. Each entry includes, but is not limited to, the vulnerability type, triggering conditions, scope of impact, and the complete call chain path from the entry function to the vulnerability point. This part constitutes the core basis for vulnerability detection output.

[0058] Further, step S304 includes: obtaining the first complete source code of the sorted, unprocessed leaf node functions, and generating a first assembly prompt word based on the first complete source code; obtaining the second complete source code of the sorted, unprocessed non-leaf node functions and the function semantic summary of the sub-functions; generating a target semantic summary based on the function semantic summary of each sub-function, and generating a second assembly prompt word based on the second complete source code and the target semantic summary; analyzing the first assembly prompt word and the second assembly prompt word respectively, and encoding the analyzed first assembly prompt word and the second assembly prompt word; and analyzing the sorted, unprocessed leaf node functions and the sorted, unprocessed non-leaf node functions respectively by calling the target large model and based on the encoded first assembly prompt word and the second assembly prompt word to obtain a structured function semantic summary.

[0059] It should be noted that since leaf node functions do not call other functions, there will be no function semantic summaries of sub-functions when generating assembly prompts. In this case, the first assembly prompt can be generated based on the first complete source code of the sorted, unprocessed leaf node functions. Since non-leaf nodes call other functions, the target semantic summary can be generated based on the function semantic summaries of each sub-function, and combined with the second complete source code to generate the second assembly prompt. At this point, the target large model can be called to analyze and process the sorted, unprocessed leaf node functions and the sorted, unprocessed non-leaf node functions layer by layer to generate a structured function semantic summary, specifically:

[0060] in, Representing node functions Function semantic summary, ) represents a node function The complete source code, Representing node functions The set of sub-functions A function representing the target large model.

[0061] It should be understood that the above-mentioned structured function semantic summary generation mechanism follows the dependency order of the call hierarchy, specifically: it prioritizes analyzing leaf node functions that have no dependencies and are in an unprocessed state, i.e. (Without child functions), then progressively generate a function semantic summary of the parent node functions to ensure the contextual completeness of the analysis.

[0062] Understandably, the above-mentioned function semantic summary generation task, which generates functions by scheduling multiple node functions in parallel, can effectively improve the overall analysis efficiency without violating the dependency order. It not only ensures the hierarchy and completeness of semantic analysis, but also utilizes the contextual understanding capabilities of the target large model to accurately track potential vulnerability paths in complex call chains.

[0063] This embodiment performs type identification on the unprocessed node functions and obtains the unprocessed leaf node functions and unprocessed non-leaf node functions based on the type identification results. It then determines the call hierarchy of each unprocessed leaf and non-leaf node function. Based on a bottom-up propagation strategy, the unprocessed leaf and non-leaf node functions are sorted according to the call hierarchy. Assembly prompts are generated based on the complete source code and target semantic summaries of the sorted unprocessed leaf and non-leaf node functions. By calling the target large model and analyzing the unprocessed node functions according to the assembly prompts, a structured function semantic summary is obtained. Through this method, addressing the differences between unprocessed leaf and non-leaf node functions, a bottom-up propagation strategy is introduced, combined with call hierarchy sorting, and then the target large model is called to analyze the node functions layer by layer according to the assembly prompts. This effectively improves the accuracy of determining the structured function semantic summary and enables precise tracking of potential vulnerability paths.

[0064] The following describes the repository-level vulnerability detection device based on large model function semantic summarization provided in this application. The repository-level vulnerability detection device described below corresponds to the repository-level vulnerability detection method based on large model function semantic summarization described above. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of the module structure of the repository-level vulnerability detection device based on large model function semantic summarization provided in this application embodiment, including: The generation module T10 is used to obtain the source code to be detected in the target code repository and generate a vulnerability detection abstract syntax tree based on the source code to be detected.

[0065] The determination module T20 is used to construct a full function call graph based on the vulnerability detection abstract syntax tree, and to determine the node functions in the full function call graph that are in an unprocessed state.

[0066] The analysis module T30 is used to generate assembly prompts based on the complete source code and target semantic summary of the node function in the unprocessed state, and to analyze the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary.

[0067] The determining module T20 is further configured to determine the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest.

[0068] This embodiment acquires the source code to be detected from the target code repository and generates a vulnerability detection abstract syntax tree based on the source code. It then constructs a full function call graph based on the vulnerability detection abstract syntax tree and identifies the unprocessed node functions in the full function call graph. Based on the complete source code of the unprocessed node functions and the target semantic summary, it generates assembly prompts and analyzes the unprocessed node functions using the assembly prompts by calling the target large model, obtaining a structured function semantic summary. Finally, it determines the vulnerability detection result of the source code to be detected based on the initial function semantic summary corresponding to the processed node functions and the structured function semantic summary. Through this method, a vulnerability detection abstract syntax tree and a full function call graph are generated using a program structure modeling strategy. Then, the semantic understanding capability of the target large model is used to determine the structured function semantic summary, i.e., in-depth security analysis and vulnerability mining are performed from local functions to the global context, thereby effectively improving the accuracy and comprehensiveness of repository-level vulnerability detection.

[0069] It is understood that the detailed functional implementation of each of the above modules can be found in the description of the aforementioned method embodiments, and will not be repeated here.

[0070] It should be understood that the above-described device is used to execute the methods in the above embodiments. The implementation principle and technical effect of the corresponding program modules in the device are similar to those described in the above methods. The working process of the device can be referred to the corresponding process in the above methods, and will not be repeated here.

[0071] Based on the methods in the above embodiments, this application provides an electronic device, please refer to... Figure 4 , Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.

[0072] It should be noted that the system may include: a processor 10, a communications interface 20, a memory 30, and a communication bus 40. The processor 10, communications interface 20, and memory 30 communicate with each other via the communication bus 40. The processor 10 can invoke logical instructions stored in the memory 30 to execute the methods described in the above embodiments.

[0073] Furthermore, the logical instructions in the aforementioned memory 30 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0074] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0075] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0076] It is understood that the processor in the embodiments of this application can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field-programmable gate arrays, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0077] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0078] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. Those skilled in the art will readily understand that the above descriptions are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A repository-level vulnerability detection method based on large model function semantic summarization, characterized in that, include: Obtain the source code to be detected from the target code repository, and generate a vulnerability detection abstract syntax tree based on the source code to be detected; Construct a full function call graph based on the vulnerability detection abstract syntax tree, and identify the node functions in the full function call graph that are in an unprocessed state; Based on the complete source code of the node function in the unprocessed state and the target semantic summary, assembly prompt words are generated. Then, by calling the target large model, the node function in the unprocessed state is analyzed based on the assembly prompt words to obtain a structured function semantic summary. The vulnerability detection result of the source code to be detected is determined based on the initial function semantic summary corresponding to the node function in the processing state and the structured function semantic summary.

2. The method as described in claim 1, characterized in that, The step of obtaining the source code to be detected from the target code repository and generating a vulnerability detection abstract syntax tree based on the source code to be detected includes: Obtain the source code to be detected from the target code repository, and perform lexical analysis on the source code to be detected based on a lexical analysis device; Based on the syntax analysis device, the lexical analysis results of the source code to be detected are subjected to syntax analysis according to the syntax rules of the programming language, and a tree-like hierarchical structure is generated based on the syntax analysis results. An initial abstract syntax tree is generated based on the tree-like hierarchical structure; The initial abstract syntax tree is standardized to obtain a vulnerability detection abstract syntax tree.

3. The method as described in claim 1, characterized in that, The step of constructing a full function call graph based on the vulnerability detection abstract syntax tree and determining the unprocessed node functions in the full function call graph includes: The vulnerability detection abstract syntax tree is identified, and the set of functions and the set of call edges between functions are determined based on the identification results; Construct a full function call graph based on the set of functions and the set of call edges between functions; The current state of each node function in the full function call graph is tracked by the activated state recording device; The node functions in the full function call diagram that are currently in an unprocessed state are selected.

4. The method as described in claim 1, characterized in that, The step of generating assembly prompts based on the complete source code and target semantic summary of the node function in the unprocessed state, and analyzing the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary includes: Type identification is performed on the node functions in the unprocessed state, and leaf node functions and non-leaf node functions in the unprocessed state are obtained based on the type identification results. Determine the call hierarchy of the leaf node functions that are in an unprocessed state and the non-leaf node functions that are in an unprocessed state, respectively; Based on a bottom-up propagation strategy, the leaf node functions that are in an unprocessed state and the non-leaf node functions that are in an unprocessed state are sorted according to the calling level; Based on the complete source code and target semantic summary of the sorted unprocessed leaf node functions and unprocessed non-leaf node functions, assembly prompts are generated. Then, by calling the target large model, the unprocessed node functions are analyzed based on the assembly prompts to obtain a structured function semantic summary.

5. The method as described in claim 4, characterized in that, The step of generating assembly prompts based on the complete source code and target semantic summary of the sorted unprocessed leaf node functions and unprocessed non-leaf node functions, and then analyzing the unprocessed node functions based on the assembly prompts by calling the target large model to obtain a structured function semantic summary includes: Obtain the first complete source code of the sorted leaf node function that is in an unprocessed state, and generate the first assembly prompt word based on the first complete source code; Obtain the second complete source code of the sorted, unprocessed non-leaf node functions and the function semantic summary of the sub-functions; A target semantic summary is generated based on the function semantic summary of each of the sub-functions, and a second assembly prompt word is generated based on the second complete source code and the target semantic summary; The first assembly prompt and the second assembly prompt are analyzed separately, and the analyzed first assembly prompt and the second assembly prompt are encoded. By calling the target large model, the sorted unprocessed leaf node functions and the sorted unprocessed non-leaf node functions are analyzed according to the encoded first assembly prompt and second assembly prompt, respectively, to obtain a structured function semantic summary.

6. The method according to any one of claims 1 to 5, characterized in that, The step of determining the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest includes: The overall function semantic summary is obtained based on the initial function semantic summary corresponding to the node function in the processing state and the structured function semantic summary; Deterministic vulnerability entries are extracted from the semantic summary of the total function, and a set of deterministic vulnerability entries is generated based on each of the deterministic vulnerability entries; The set of deterministic vulnerability entries is deduplicated by calling the path deduplication function, and the call chain is restored and the scope of impact is analyzed after deduplication. By calling the report merging function, vulnerability detection results of the source code to be detected are generated in report form based on multi-dimensional analysis results.

7. A repository-level vulnerability detection device based on large model function semantic summarization, characterized in that, include: The generation module is used to obtain the source code to be detected in the target code repository and generate a vulnerability detection abstract syntax tree based on the source code to be detected; The determination module is used to construct a full function call graph based on the vulnerability detection abstract syntax tree, and to determine the node functions in the full function call graph that are in an unprocessed state. The analysis module is used to generate assembly prompts based on the complete source code and target semantic summary of the node function in the unprocessed state, and to analyze the node function in the unprocessed state based on the assembly prompts by calling the target large model to obtain a structured function semantic summary. The determining module is further configured to determine the vulnerability detection result of the source code to be detected based on the initial function semantic digest corresponding to the node function in the processing state and the structured function semantic digest.

8. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on the processor, it causes the processor to perform the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is run on a processor, the processor causes the processor to perform the method as described in any one of claims 1-6.

Images