Two-stage PHP vulnerability detection and automatic repair method based on large language model

Abstract

The invention discloses a two-stage PHP vulnerability detection and automatic repair method based on a large language model, and relates to the technical field of Web application security vulnerability detection and automatic repair, and the method comprises the steps: 1, extracting a feature vector from a to-be-detected source code by using the large language model, and carrying out vulnerability recognition based on a vulnerability detection model to obtain a detection result; step 2, if the vulnerability exists, performing vulnerability positioning on the to-be-detected source code by adopting a sequence detection mechanism based on incremental input, obtaining code vulnerability related information and entering step 3; if no vulnerability exists, outputting a security code; 3, performing cause reasoning according to the code vulnerability related information to obtain vulnerability causes and types; 4, decision reasoning is carried out according to related information of vulnerability causes, types and code vulnerabilities in combination with an expert knowledge base, and repair codes are generated for repair. According to the method, high-precision vulnerability detection and repair can be completed from end to end, and the controllability and interpretability of an automatic repair process are improved.

Description

Technical Field

[0001] This invention relates to the field of Web application security vulnerability detection and automated repair technology, and more specifically to a two-stage PHP vulnerability detection and automated repair method based on a large language model. Background Technology

[0002] In recent years, with the rapid development of the mobile internet, the number and types of web applications have exploded, bringing with them many hidden risks and posing a serious threat to user security. Traditional vulnerability detection methods mainly include rule-based static analysis, dynamic analysis, and symbolic execution techniques. Although they have good detection capabilities in specific scenarios, they often exhibit low generalization ability when facing new or variant vulnerabilities.

[0003] As research deepens, deep learning, knowledge graphs, and large language models are increasingly being applied to vulnerability discovery research. Furthermore, leveraging the strengths and characteristics of various technologies, different methods are being combined to create hybrid vulnerability discovery approaches. However, analysis reveals that existing solutions still suffer from issues with model accuracy, training time, and generalization ability. Moreover, how to remediate vulnerabilities after discovery also requires further research.

[0004] Therefore, how to solve the problems of insufficient extraction of code structure and semantic features and the susceptibility of detection models to noise interference in the process of Web vulnerability discovery and repair, and improve the controllability and interpretability of the automated repair process, are problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the above problems, this invention is proposed to provide a two-stage PHP vulnerability detection and automatic repair method based on a large language model to overcome or at least partially solve the above problems. This method addresses the problems existing in current Web vulnerability mining and repair technologies, such as insufficient extraction of code structure and semantic features, susceptibility of detection models to noise interference, and lack of controllability and interpretability of the automated repair process.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, embodiments of the present invention provide a two-stage PHP vulnerability detection and automatic repair method based on a large language model, comprising the following steps: Step 1: Extract feature vectors from the source code to be detected using a large language model, and identify vulnerabilities based on the vulnerability detection model to obtain detection results; Step 2: If the detection result indicates the existence of a vulnerability, an incremental input-based sequence detection mechanism is used to locate the vulnerability in the source code to be detected, obtain relevant information about the code vulnerability, and proceed to Step 3; if the detection result indicates no vulnerability, secure code is output. Step 3: Based on the information related to the code vulnerability, perform causal reasoning to obtain the cause and type of the vulnerability; Step 4: Based on the cause of the vulnerability, the type of vulnerability, and relevant information about the code vulnerability, and in conjunction with the expert knowledge base, make decision-making inferences, generate repair code, and use the repair code to correct the source code to be detected.

[0007] Preferably, the specific process of step 1 is as follows: Step 11: Convert the source code to be tested into an abstract syntax tree; Step 12: Extract feature vectors from the abstract syntax tree using a large language model; Step 13: Input the feature vector into the vulnerability detection model for binary classification to obtain the detection results, including whether there is a vulnerability or not.

[0008] Preferably, in step 2, the incremental input-based sequence detection mechanism is used to locate vulnerabilities in the source code to be detected, and the specific process for obtaining code vulnerability-related information is as follows: Step 21: Split the source code to be tested into several consecutive lines of code; Step 22: Input the first line of code as the input sequence into the vulnerability detection model to identify vulnerabilities and obtain detection results; if the detection result indicates the existence of a vulnerability, mark the current line of code as the vulnerability location and stop the loop to proceed to step 24; otherwise, proceed to step 23. Step 23: Use a progressive strategy to accumulate the next line of code in the input sequence and input it into the vulnerability detection model to identify vulnerabilities and obtain detection results; if the detection result indicates that a vulnerability exists, mark the currently accumulated line of code as the vulnerability location and stop the loop to proceed to step 24; otherwise, repeat step 23. Step 24: Use the annotated current input sequence as code vulnerability information. This information includes the vulnerability location and the line of code where the vulnerability was detected.

[0009] Preferably, PHP-Parser, Tree-sitter, or ANTLR are used as conversion tools to convert the source code to be detected into an abstract syntax tree; a vulnerability detection model is obtained by pre-training a Transformer-based deep neural network, and the vulnerability detection model is used to detect known vulnerabilities and discover unknown vulnerabilities.

[0010] Preferably, the vulnerability detection model includes a feature extractor and a classifier. The feature extractor extracts discriminative features from the input data, including semantic information and location information. The classifier classifies the data based on the discriminative features to obtain the detection results.

[0011] Preferably, CodeT5 is used as the feature extractor to map the input text into a high-dimensional vector representation to obtain discriminative features. The output of CodeT5 includes last_hidden_state, which is the sequence of hidden states in the last layer. The vector at each position contains semantic information about that position and its context. This context-aware feature representation is crucial for classification tasks because it can capture long-range dependencies in the text.

[0012] Preferably, the classifier includes an input layer, a multi-linear layer, an activation function layer, a normalization layer, a self-attention layer, an output layer, a dropout layer, and a residual connection layer. The input layer receives discriminative features, including semantic and positional information, and outputs 768 dimensions. The dropout layer enhances the generalization ability of the vulnerability detection model through random deactivation. The residual connection layer fuses the discriminative features from the input layer (which serves as the original features) using an identity mapping to obtain fused features, preventing gradient vanishing. The normalization layer assigns different code statement weights to different semantic information in the fused features and performs normalization to calculate bias terms. The self-attention layer calculates attention weights based on the bias terms using a self-attention mechanism, and adjusts the feature distribution of the fused features through weighted summation based on the attention weights to obtain normalized features. The multi-linear layer performs feature dimensionality reduction on the normalized features, mapping 768 dimensions to 1 dimension to obtain dimensionality-reduced features. The activation function layer uses the sigmoid activation function to convert the dimensionality-reduced features into probability values, combines them with a preset threshold to determine whether a vulnerability exists, and generates a detection result. The output layer outputs the detection result.

[0013] Preferably, in step 3, dynamic prompt words are designed by the user, and the prompting method of the thinking chain is used to perform cause reasoning and classification of code vulnerability-related information based on the dynamic prompt words using a large language model to obtain the cause and type of vulnerability.

[0014] Preferably, feasible remediation strategies are generated based on samples, remediation methods, and patches, and an expert knowledge base is constructed by associating various vulnerability types and causes. This expert knowledge base ensures that problem nodes are accurately located and source code vulnerability remediation is completed as precisely as possible during vulnerability remediation.

[0015] Preferably, in step 4, a large language model is used to generate repair code that meets security standards based on the cause of the vulnerability, the type of the vulnerability, the expert knowledge base, and relevant information about the code vulnerability.

[0016] Preferably, the specific process of step 4 is as follows: Step 41: Using the vulnerability type and vulnerability cause as the starting root node of the decision tree, retrieve all corresponding feasible remediation strategies from the expert knowledge base according to the vulnerability type. Match the feasible remediation strategies with the code lines corresponding to the input sequence in the vulnerability location and code vulnerability information. Generate the technical route applicable to the vulnerability location based on the matched feasible remediation strategies, and construct the remediation decision tree. The branch nodes of the remediation decision tree represent different technical route selections, and the leaf nodes represent specific code modification logic. Step 42: Repair the decision tree as a structured Prompt constraint generator, select a technical route from the repair decision tree to generate natural language instructions; Step 43: Based on the lines of code in the natural language instructions and code vulnerability information, and the patches in the expert knowledge base, use the large language model to perform fine-grained code refactoring to obtain the fix code; Step 44: Use the repair code to correct the source code to be detected and generate the corrected source code.

[0017] The large language model receives the instruction, combines the context of the original code with the standard patch templates provided by the expert library, and performs fine-grained code refactoring only on the specific line where the vulnerability is located (e.g., replacing concatenated SQL statements with parameterized queries) without disrupting the original business logic (such as loops and recursive structures). Finally, it outputs repair code that meets security standards, which can be used to patch the vulnerability in the code to be detected based on the location of the vulnerability.

[0018] Preferably, the specific process of matching feasible remediation strategies with the lines of code corresponding to the input sequence in the vulnerability location and code vulnerability-related information, and generating the applicable technical route for the vulnerability location based on the matched feasible remediation strategies is as follows: Semantic association analysis is performed on the code lines and the samples and repair methods corresponding to the feasible repair strategies stored in the expert knowledge base, and the cosine similarity is calculated. The vulnerability location and feasible remediation strategy are determined by comparing a preset similarity threshold with cosine similarity. If they match, the subgraph isomorphic matching algorithm of the abstract syntax tree is used to compare the syntax structure of the code line with the corresponding patch of the feasible remediation strategy. If they match, a technical roadmap is generated based on the corresponding patch; otherwise, an early warning error is issued. If they do not match, an early warning error is issued.

[0019] Preferred, feasible remediation strategies include input filtering rules, escape function mapping, and security framework call specifications.

[0020] Preferred technical approaches include using htmlspecialchars for escaping, refactoring into preprocessed statements, and replacing with security framework APIs.

[0021] Preferably, the method also includes step 5, which involves inputting the corrected source code into the vulnerability detection model for vulnerability identification. If the detection result indicates the existence of a vulnerability, the method returns to step 2; otherwise, the corrected source code is output.

[0022] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a two-stage PHP vulnerability detection and automatic repair method based on a large language model. It integrates abstract syntax tree, large language model and expert knowledge to assist in vulnerability mining and repair, and achieves high-precision vulnerability detection and repair end-to-end in mainstream Web development language environments such as PHP. It meets the requirements of vulnerability detection accuracy ≥99.7%, false negative rate ≤0.7%, and repair success rate ≥89%, and maintains low migration loss and strong generalization ability in unseen projects and new vulnerability scenarios. This invention addresses the problems of insufficient model granularity and the long response time, difficulty in preserving context structure, and poor effectiveness of directly using large language models for vulnerability detection and remediation. It conducts research on automated vulnerability remediation based on large language models and incremental sequence analysis-assisted reasoning. The invention implements vulnerability detection and localization using large language models and incremental sequence analysis-assisted reasoning, respectively, while retaining the reasoning and learning capabilities of large language models. The overall architecture involves a vulnerability detection model detecting input vulnerable code and determining the vulnerability type and location. Subsequently, dynamically generated prompts guide the large language model to analyze the vulnerability's causes and, combined with expert knowledge, classify the vulnerability type and recommend remediation strategies. Then, vulnerability information, remediation rules, and the results of the thought chain analysis are input into the large language model to generate remediation code that meets security standards. A decision tree method is used to filter remediation solutions, ensuring the remediated code meets both security and usability requirements. Finally, the vulnerability detection model is run repeatedly for verification to ensure the effectiveness of the remediation and avoid introducing new vulnerabilities.

[0023] The key features of this invention lie in its efficiency, interpretability, and security. Compared to directly using large language models to fix vulnerabilities, this solution constructs a more stable and controllable automated remediation process through vulnerability detection, expert knowledge input, and decision tree methods. First, it avoids the information loss problem of large language models in long contextual reasoning, making the remediation solution more accurate. Second, through thought chain reasoning technology, the logical derivation process of vulnerability remediation is made more transparent, enhancing the interpretability of the remediation solution. Finally, by using rule-driven + logical reasoning, it improves the accuracy and controllability of large language models in vulnerability remediation tasks, enhances the stability of the remediation solution, avoids additional security risks that may arise from erroneous remediation, and supports further optimization and expansion. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0025] Figure 1 This is a flowchart of a two-stage PHP vulnerability detection and automatic repair method based on a large language model provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the vulnerability identification process provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the vulnerability location, cause reasoning, and decision reasoning process provided in the embodiments of the present invention. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] This invention discloses a two-stage PHP vulnerability detection and automatic repair method based on a large language model, such as... Figure 1 As shown, it includes the following steps: S1: Use a large language model to extract feature vectors from the source code to be detected, and perform vulnerability identification based on the vulnerability detection model to obtain detection results; S2: If the detection result indicates the existence of a vulnerability, an incremental input-based sequence detection mechanism is used to locate the vulnerability in the source code to be detected, obtain relevant information about the code vulnerability, and proceed to S3; if the detection result indicates no vulnerability, secure code is output. S3: Based on information related to code vulnerabilities, perform causal reasoning to obtain the cause and type of the vulnerability; S4: Based on the cause of the vulnerability, the type of vulnerability, and relevant information about the code vulnerability, combined with the expert knowledge base, make decision-making inferences, generate repair code, and use the repair code to correct the source code to be detected.

[0028] In one specific embodiment, to address the problem of insufficient structural feature extraction when directly using large models for Web vulnerability mining, this invention proposes a vulnerability feature extraction framework based on abstract syntax trees and large language model embedding. For example... Figure 1As shown, the source code is first obtained from the dataset. Using a reliable transformation tool, the source code is converted into an abstract syntax tree (AST), aiming to help the large language model better understand the contextual relationships between code segments. Next, the large language model extracts features from the generated AST containing contextual information, converting it into feature vectors. These vectors are then input into a deep neural network model based on Transformer. Finally, the model outputs a binary classification result, indicating whether the source code segment contains vulnerabilities, thus enabling the detection of known vulnerabilities and the discovery of unknown vulnerabilities. The specific steps are as follows: S11: Convert the source code to be tested into an abstract syntax tree; S12: Extract feature vectors from the abstract syntax tree using a large language model; S13: Input the feature vector into the vulnerability detection model for binary classification to obtain the detection results, including whether there is a vulnerability or not.

[0029] An Abstract Syntax Tree (AST) is a tree-structured representation of source code. It preserves the program's logical hierarchy by discarding specific syntactic details. Nodes correspond to abstract symbols of language structures, and edges represent nested relationships between syntactic components. As a core intermediate representation for compilers and interpreters, ASTs support static analysis, optimization, and code generation, combining syntax-driven precision with structured operability. They are a fundamental tool in formal language theory and program analysis. As a tree structure representing the syntactic structure of code, the AST reflects the contextual relationships between code segments. Among PHP AST generation tools, PHP-Parser, Tree-sitter, and ANTLR each exhibit different characteristics and applicable scenarios. PHP-Parser, specifically designed for the PHP language, can accurately handle PHP syntactic features, including the latest language specifications. This tool provides a complete AST representation and rich operation interfaces, thus being widely used in PHP static analysis tools. However, its limitations lie in its support for only the PHP language, and due to its PHP implementation, its parsing performance is inferior to tools built on compiled languages.

[0030] Abstract syntax trees (ASTs) enable large language models to better understand the contextual relationships between code segments. By mapping discrete AST nodes to a continuous vector space, large language models capture subtle patterns in the code, including vulnerability features that are difficult to detect using traditional methods, such as abnormal control flow and dangerous data dependencies. This automated feature learning not only improves detection accuracy but also enables the model to generalize across projects and languages. It converts the process features in the AST into feature vectors, that is, it converts text vectors into number vectors. In this process, a tokenizer is used to segment the strings in the nodes of the AST and extract features. By pre-training a Transformer-based deep neural network, a vulnerability detection model is obtained, which is then used to detect known vulnerabilities and discover unknown vulnerabilities.

[0031] In one specific embodiment, the incremental input-based sequence detection mechanism used in S2 to locate vulnerabilities in the source code to be detected, and the specific process of obtaining code vulnerability-related information is as follows: S21: Split the source code to be tested into several consecutive lines of code; S22: Input the first line of code as the input sequence into the vulnerability detection model to identify vulnerabilities and obtain detection results; if the detection result indicates the existence of a vulnerability, mark the current line of code as the vulnerability location and stop the loop to proceed to S24; otherwise, proceed to S23. S23: Using a progressive strategy, the next line of code is added to the input sequence and input into the vulnerability detection model for vulnerability identification to obtain the detection result; if the detection result indicates that a vulnerability exists, the currently added line of code is marked as the vulnerability location, and the loop stops and proceeds to S24; otherwise, S23 is repeated. S24: Use the annotated current input sequence as code vulnerability-related information. This information includes the vulnerability location and the line of code where the vulnerability was detected.

[0032] To address the limitations of traditional vulnerability detection models, an incremental input-based sequence detection mechanism was designed and implemented. This mechanism provides a novel paradigm for vulnerability localization while maintaining model detection efficiency. Compared to black-box deep learning models, this method offers better interpretability because its detection results clearly point to the key trigger points of vulnerabilities, providing intuitive remediation suggestions for subsequent modules. The mechanism employs a progressive input strategy, gradually building a complete code context by adding code line by line. This strategy not only effectively captures potential relationships between code segments but also avoids the loss of contextual information that can occur when inputting large amounts of code at once. Furthermore, a dynamic evaluation mechanism is introduced during the detection process. After each new code input, the model re-evaluates the overall security of the code. This mechanism enables the model to promptly discover potential vulnerabilities in the code and accurately pinpoint their causes when detected.

[0033] In this method, the input code file is broken down into several consecutive code segments and progressively input into the model for detection in an ascending sequence. Initially, only the first line of code is input, and the model determines its security. Subsequently, the second line of code is added for another check. If it is still deemed secure, the input range is expanded. This process continues until the model first determines that the code contains a vulnerability; the newly added line of code at this point is the direct source of the vulnerability. This strategy effectively avoids the redundancy and interference caused by global scanning in traditional methods, enabling fine-grained analysis of the vulnerability trigger points during code evolution, thus achieving more accurate vulnerability cause analysis.

[0034] This invention employs an automated vulnerability repair method that combines large language models and incremental sequence analysis to assist reasoning. This method enables vulnerability detection and localization while retaining the reasoning and learning capabilities of large language models. It addresses the issues of insufficient model granularity and the problems of long response times, difficulty in preserving context structure, and poor performance when directly using large language models for vulnerability detection and repair.

[0035] In one specific embodiment, the vulnerability detection model includes a feature extractor and a classifier. The feature extractor extracts discriminative features from the input data, including semantic information and location information. The classifier classifies the vulnerability based on the discriminative features to obtain the vulnerability category and vulnerability location.

[0036] Furthermore, CodeT5 is used as the feature extractor to map the input text into a high-dimensional vector representation. The output of CodeT5 includes `last_hidden_state`, which is the sequence of hidden states in the last layer. The vector at each position contains semantic information about that position and its context. This context-aware feature representation is crucial for classification tasks because it can capture long-range dependencies in the text.

[0037] Furthermore, the classifier includes an input layer, a multi-layer linear layer, an activation function layer, a normalization layer, a self-attention layer, an output layer, a dropout layer, and a residual connection layer. The input layer receives a high-dimensional vector representation, including semantic and positional information, and outputs a 768-dimensional vector. The dropout layer enhances the generalization ability of the vulnerability detection model through random deactivation. The residual connection layer fuses the high-dimensional vector representation as the original feature using an identity mapping to obtain fused features, preventing gradient vanishing. The normalization layer assigns different code statement weights to different semantic information in the fused features and calculates the bias term using normalization. The self-attention layer calculates attention weights based on the bias term using a self-attention mechanism, and adjusts the feature distribution of the fused features through weighted summation based on the attention weights to obtain normalized features. The multi-layer linear layer performs feature dimensionality reduction on the normalized features, mapping 768 dimensions to 1 dimension to obtain dimensionality-reduced features. The activation function layer uses the sigmoid activation function to convert the dimensionality-reduced features into probability values, combines them with a preset threshold to determine the existence of vulnerabilities, and generates detection results. The output layer outputs the detection results.

[0038] Furthermore, the functions of each structural layer of the classifier: (1) Dropout layer Dropout is a regularization technique that prevents overfitting by randomly discarding some neurons during training. In classifiers, a Dropout layer is added after the output, randomly discarding some features with probability p=0.3. This random discarding mechanism forces the model to not rely on certain specific neurons during training, thereby enhancing the model's generalization ability. The Dropout layer is enabled during training and disabled during inference.

[0039] (2) Multilayer linear layer The function of a linear layer is to establish the relationship between input data features and the output result. A linear layer implements a linear transformation from input features to output results. The output of the CodeBERT model is a 768-dimensional feature vector. A linear layer can map a 768-dimensional vector to a one-dimensional vector. This mapping process is achieved through weight matrices and bias vectors. Linear layers are one of the fundamental components of neural networks. They can transform high-dimensional features into low-dimensional representations. This transformation helps simplify the computational complexity of the model. The design of linear layers allows the model to better capture the features of the input data.

[0040] (3) Activation function layer The purpose of an activation function is to transform the output of a multilinear layer into a probability value between 0 and 1. The sigmoid function used is a commonly used activation function, particularly suitable for binary classification tasks. The mathematical expression of the sigmoid function is as follows:

[0041] Here, x is the output of the linear layer, and e is the base of the natural logarithm. The Sigmoid function maps any real value x to a value between 0 and 1. As x approaches positive infinity, σ(x) approaches 1. As x approaches negative infinity, σ(x) approaches 0. The output of the Sigmoid function can be directly interpreted as a probability value. Therefore, the Sigmoid function is very useful in binary classification tasks.

[0042] (4) Normalization layer When training the model with data after obfuscating variable names, the accuracy improvement was insufficient. Therefore, different weights were assigned to different code statements to make the model focus on the code parts that are more likely to have vulnerabilities. The bias term was obtained by normalizing the weights of the code statements.

[0043] (5) Self-attention layer The attention weights are calculated using a self-attention mechanism based on the bias term. These weights are then used to sum the input features in a weighted manner, thereby generating a new context vector and obtaining normalized features.

[0044] The self-attention mechanism is represented as:

[0045] The bias term is the normalized value after weighting the code statements.

[0046] (5) Residual connection layer Residual connections are a technique used to mitigate the vanishing gradient problem. In classifiers, residual connections directly add input features to the output features, making it easier for the model to learn identity mappings. This design is particularly suitable for deep networks because it ensures that gradients do not vanish during backpropagation, thereby accelerating training and improving model performance.

[0047] In one specific embodiment, S3 designs dynamic prompt words and uses a thought chain prompting method to perform cause reasoning and classification of code vulnerability-related information based on the dynamic prompt words using a large language model to obtain the cause and type of vulnerability.

[0048] like Figure 3 As shown, the core task of this invention is to dynamically generate precise prompts based on the output of the vulnerability detection model, thereby guiding the large language model to reason about the causes of vulnerabilities and generate remediation solutions. Specifically, this step dynamically generates a list containing source code and vulnerability locations by combining the output of the vulnerability detection model. This facilitates subsequent classification of vulnerabilities using thought chain reasoning technology and step-by-step analysis of vulnerability causes, ensuring the rationality and effectiveness of the remediation solution.

[0049] Prompt generation is a key step in this invention, aiming to provide precise contextual information for the large language model to guide effective reasoning and remediation. Before generating prompts, security constraints need to be predefined, including input filtering and escaping, to prevent attackers from injecting malicious code into the model via prompts. Then, the output of the vulnerability detection model serves as the core content of the prompts, ensuring the large language model can accurately locate the vulnerability and analyze its type and cause. This content is integrated into the prompts using natural language descriptions, guiding the model to adhere to established security standards when generating remediation solutions. In this way, the model can fully understand the causes of vulnerabilities and remediation requirements during the remediation process, thereby improving the accuracy and controllability of the remediation solution.

[0050] In one specific embodiment, feasible remediation strategies are generated based on samples, remediation methods, and patches. An expert knowledge base is constructed by associating various vulnerability types and causes. A large language model is used to generate remediation code that conforms to security standards based on the vulnerability cause, vulnerability type, expert knowledge base, and the location of the vulnerability in the prompt. The expert knowledge base ensures that the problem node is well located during vulnerability remediation, and the source code vulnerability is remediated as accurately as possible. After the vulnerability cause reasoning and type analysis are completed using the online large language model, combined with the precise expert knowledge in the input expert knowledge base, as well as the vulnerability location and related code lines in the prompt, the vulnerable code is remediated. The methods include filtering, escaping, and using new frameworks, etc. A decision tree is generated, allowing the user to make a decision and ultimately achieving accurate vulnerability remediation.

[0051] An expert knowledge base is a crucial component in ensuring the accuracy, reliability, and security of remediation solutions. It systematically integrates the knowledge of domain experts into the vulnerability remediation process, providing high-quality knowledge support to the large language model through rule bases, experience bases, and dynamic feedback mechanisms. This enhances the model's performance in vulnerability causation reasoning and remediation solution generation. The expert knowledge base covers vulnerability types, causal analysis, remediation rules, and security standards. Its construction adheres to the principles of comprehensiveness, accuracy, and dynamic updates, ensuring coverage of common vulnerability types and providing expert-verified remediation rules. Specific remediation solutions are provided for each vulnerability, such as parameterized queries, input filtering, and memory management. Based on the vulnerability type obtained through causal reasoning, corresponding content is retrieved from the expert knowledge base and integrated into the decision-making process to guide the large language model in vulnerability remediation.

[0052] During the decision-making and reasoning process, based on the results of vulnerability detection, causal reasoning, and expert knowledge input, the decision tree method is used to assist in the final implementation of vulnerability remediation. By constructing a hierarchical decision path, the vulnerability remediation plan meets the requirements of security, availability, and stability, while avoiding over-remediation or erroneous remediation that could damage the code logic. To ensure the rationality of the remediation decisions, rule-driven approaches, logical reasoning, and the automatic remediation capabilities of large language models are comprehensively utilized, combined with user interaction, to achieve fine-grained control over vulnerability remediation.

[0053] The constructed multi-level remediation decision tree has a root node corresponding to the vulnerability category, branch nodes representing possible remediation schemes, and leaf nodes representing specific remediation measures. The selection of remediation schemes is based on best practices from an expert knowledge base, combined with code context information to ensure targeted remediation. While guaranteeing automated vulnerability remediation capabilities, it also supports manual intervention.

[0054] Furthermore, the specific process of S4 is as follows: S41: Using the vulnerability type and vulnerability cause as the root node of the decision tree, retrieve all feasible remediation strategies from the expert knowledge base according to the vulnerability type. Match the feasible remediation strategies with the code lines corresponding to the input sequence in the vulnerability location and code vulnerability information. Analyze the matched feasible remediation strategies to generate the technical route applicable to the vulnerability location and construct the remediation decision tree. The branch nodes of the remediation decision tree represent different technical route selections, and the leaf nodes represent specific code modification logic. S42: Repair decision tree as a structured Prompt constraint generator, select a technical route from the repair decision tree to generate natural language instructions; S43: Based on natural language instructions, lines of code related to code vulnerabilities, and patches in the expert knowledge base, use a large language model to perform refined code refactoring to obtain the fix code; S44: Use the repair code to correct the source code to be detected and generate the corrected source code.

[0055] The large language model receives instructions, combines the context of the original code with standard patch templates provided by the expert library, and performs refined code refactoring only on specific lines where vulnerabilities are located (e.g., replacing concatenated SQL statements with parameterized queries) without disrupting the original business logic (such as loops and recursive structures). The final output is security-compliant patch code, which can be used to repair vulnerabilities in the detected code based on the vulnerability location. Feasible remediation strategies include input filtering rules, escape function mapping, and security framework calling specifications. Technical approaches include using htmlspecialchars for escaping, refactoring into preprocessed statements, and replacing with security framework APIs.

[0056] Furthermore, the process of matching feasible remediation strategies with the lines of code corresponding to the input sequence in the vulnerability location and code vulnerability information, and generating the applicable technical route for the vulnerability location based on the matched feasible remediation strategies, is as follows: Semantic association analysis is performed on the code lines and the samples and repair methods corresponding to the feasible repair strategies stored in the expert knowledge base, and the cosine similarity is calculated. The vulnerability location and feasible remediation strategy are determined by comparing a preset similarity threshold with cosine similarity. If they match, the subgraph isomorphic matching algorithm of the abstract syntax tree is used to compare the syntax structure of the code line with the corresponding patch of the feasible remediation strategy. If they match, a technical roadmap is generated based on the corresponding patch; otherwise, an early warning error is issued. If they do not match, an early warning error is issued.

[0057] In one specific embodiment, the method further includes step S5, where the corrected source code is input into the vulnerability detection model for vulnerability identification. If the detection result indicates the existence of a vulnerability, the process returns to step S2; otherwise, the corrected source code is output. After the large language model generates a remediation plan, the user can review and adjust the remediation code based on the suggestions provided by the remediation decision tree. Especially when multiple remediation plans are available, the user can weigh security and availability based on specific business needs, while avoiding unnecessary code modifications caused by misjudgments from the large language model.

[0058] In summary, the overall process is as follows: The input code is detected using a vulnerability detection model to determine the vulnerability location and related lines of code. Then, causal reasoning is used to progressively analyze the vulnerability's causes and determine its type, ensuring the remediation plan is reasonable. Next, a decision tree is constructed by combining remediation rules, vulnerability causes, and vulnerability types from the expert knowledge base. The clues from the decision tree, the vulnerability-related lines of code, and the expert knowledge base are then input into the large language model to generate remediation code that meets security standards. Finally, the vulnerability detection model can be run repeatedly for verification to ensure the remediation is effective and to avoid introducing new vulnerabilities. This process, through rule-driven and logical reasoning, improves the accuracy and controllability of the large language model in vulnerability remediation tasks, while also supporting further optimization and expansion.

[0059] This invention employs a vulnerability discovery method based on the synergistic enhancement of abstract syntax trees (ASTs) and large language models (MLMs), addressing the issues of severe context loss and inadequate feature extraction inherent in directly using MLMs. First, the code is transformed into an AST as its representation. Next, the MLM is used to extract syntactic and semantic features from the processed source code. In this step, weights are used to guide the MLM to focus on the potential locations of vulnerabilities, thus completing feature extraction. After generating feature vectors, neural network models with different advantages are used for training and classification to complete vulnerability discovery. Furthermore, intelligent vulnerability remediation is achieved based on incremental sequence analysis and MLM-assisted reasoning. Addressing the performance limitations of directly using MLMs for vulnerability detection in long code snippets, an incremental input-based sequence detection mechanism is designed to locate single-line vulnerabilities. Then, based on the above, a dynamic prompt is generated, prompting the MLM to analyze the vulnerability type and cause. Finally, using an expert knowledge base, multiple vulnerability remediation solutions are generated, prioritizing those that do not affect code usability. Users can also manually select and generate other solutions, reducing manual remediation workload and improving the intelligence of vulnerability remediation. During the experiment, a balance was found between vulnerability repair rate and computing resource consumption. RIPS was used as a vulnerability repair rate detection tool, and its usability was discussed. The experimental results show that the method has achieved good results in a variety of vulnerability repair tasks.

[0060] This invention solves the problems of low performance and low accuracy in extracting syntactic and semantic features in source code vulnerability mining, providing new ideas for related research. At the same time, it realizes an automated vulnerability repair method, providing technical support for future research.

[0061] On the other hand, in one specific embodiment, a two-stage PHP vulnerability detection and automatic repair method based on a large language model is used to detect and repair hidden command injection vulnerabilities. The specific process is as follows: S1: Constructing shell commands from unauthenticated user input for a PHP code snippet: <?php $cmd = "tar -czf " . $_GET['file'] . ".tar.gz " . $_GET['path']; system($cmd); ?> This code constructs a system command by concatenating the user-inputted $_GET['file'] and $_GET['path'] and then calls system() to execute it; S2: The vulnerability detection module parses its abstract syntax tree, identifies the tainted data flow path from $_GET to system(), and inputs it into the CodeT5 encoder to generate feature vectors; S3: By using the risk-biased self-attention mechanism, we strengthened our attention to the high-risk function system() and external input sources, and confirmed that the fragment was a command injection vulnerability. S4: Enter the vulnerability remediation phase. Use incremental sequence analysis to locate the vulnerability triggering behavior in line 3, system($cmd), and generate the following message: { "Vulnerability Type": "Command Injection", "Cause Analysis": "User input of $_GET['file'] and $_GET['path'] was directly concatenated into system commands without validation, which could lead to the execution of arbitrary shell commands." "Line number involved": "3" } Guide large language models to perform causal reasoning and output structured analysis results; S5: Obtain the vulnerability type and specific cause as the root node of the decision tree. Retrieve candidate strategies from the expert knowledge base, such as "using escapeshellarg() to escape input, using a whitelist to verify the path, or replacing system() with a restricted execution interface", and match them with the context of the vulnerability code. Select the technical routes that are actually feasible at this location and build the branch nodes of the decision tree. Each branch represents a remediation technical path, such as "whether to escape each parameter individually", "whether to introduce a custom verification function", or "whether to use a security sandbox to execute commands". Finally, it will lead to the leaf node, which is the complete specific code modification logic, such as "call escapeshellcmd() and encapsulate the sanitize_path() utility function", thus forming the decision tree. S6: Select the optimal path from the decision tree: "Use escapeshellcmd() or escapeshellarg() to escape user input, and supplement it with path and filename validation." Transform this path into an explicit natural language instruction as a structured Prompt. The large language model, based on this instruction, the original code context, and standard patch templates from the expert library, reconstructs the vulnerability line and generates fix code. $path = sanitize_path($_GET['path']); $file = sanitize_filename($_GET['file']); $cmd = escapeshellcmd("tar -czf {$file}.tar.gz {$path}"); exec($cmd); The patch was able to compile successfully and pass the functional tests.

[0062] Experimental design and results analysis revealed that the method of this invention achieved a maximum accuracy of 89.3% without data preprocessing, while the accuracy reached 99.7% after data preprocessing. Furthermore, full dataset testing on other datasets also yielded an accuracy of 95.7%, demonstrating the advantages of this invention compared to other approaches.

[0063] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0064] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A two-stage PHP vulnerability detection and automatic repair method based on a large language model, characterized in that, Includes the following steps: Step 1: Extract feature vectors from the source code to be detected using a large language model, and identify vulnerabilities based on the vulnerability detection model to obtain detection results; Step 2: If the detection result indicates the existence of a vulnerability, an incremental input-based sequence detection mechanism is used to locate the vulnerability in the source code to be detected, obtain relevant information about the code vulnerability, and proceed to Step 3; if the detection result indicates no vulnerability, secure code is output. Step 3: Based on the information related to the code vulnerability, perform causal reasoning to obtain the cause and type of the vulnerability; Step 4: Based on the cause of the vulnerability, the type of vulnerability, and relevant information about the code vulnerability, and in conjunction with the expert knowledge base, make decision-making inferences, generate repair code, and use the repair code to correct the source code to be detected.

2. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, The specific process of step 1 is as follows: Step 11: Convert the source code to be tested into an abstract syntax tree; Step 12: Extract feature vectors from the abstract syntax tree using a large language model; Step 13: Input the feature vector into the vulnerability detection model for binary classification to obtain the detection results, including whether there is a vulnerability or not.

3. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, Step 2 employs an incremental input-based sequence detection mechanism to locate vulnerabilities in the source code to be detected. The specific process for obtaining code vulnerability-related information is as follows: Step 21: Split the source code to be tested into several consecutive lines of code; Step 22: Input the first line of code as the input sequence into the vulnerability detection model to identify vulnerabilities and obtain the detection results; If the detection result indicates the existence of a vulnerability, mark the current line of code as the vulnerability location and stop the loop to proceed to step 24; Otherwise proceed to step 23; Step 23: Use a progressive strategy to accumulate the next line of code in the input sequence and input it into the vulnerability detection model to identify vulnerabilities and obtain detection results; if the detection result is that a vulnerability exists, mark the currently accumulated line of code as the vulnerability location and stop the loop to proceed to step 24; Otherwise, repeat step 23; Step 24: Use the annotated current input sequence as code vulnerability information.

4. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, The vulnerability detection model includes a feature extractor and a classifier. The feature extractor extracts discriminative features, including semantic information and location information. The classifier classifies based on discriminative features to obtain detection results.

5. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 4, characterized in that, The classifier comprises an input layer, multiple linear layers, an activation function layer, a normalization layer, a self-attention layer, an output layer, a dropout layer, and residual connections. The input layer receives discriminative features. The dropout layer enhances the generalization ability of the vulnerability detection model through random deactivation. The residual connection layer fuses the discriminative features using an identity mapping to obtain fused features. The normalization layer assigns different code statement weights to different semantic information in the fused features and calculates bias terms through normalization. The self-attention layer calculates attention weights based on the bias terms using a self-attention mechanism, and adjusts the feature distribution of the fused features through weighted summation based on the attention weights to obtain normalized features. The multiple linear layers reduce the dimensionality of the normalized features to obtain dimensionality-reduced features. The activation function layer uses the sigmoid activation function to convert the dimensionality-reduced features into probability values, combines them with a preset threshold to determine the existence of vulnerabilities, and generates detection results. The output layer outputs the detection results.

6. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 4, characterized in that, CodeT5 is used as the feature extractor to map the input text into a high-dimensional vector representation.

7. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, In step 3, dynamic prompt words are set, and the prompt method of mind chain is used to perform cause reasoning and classification of code vulnerability-related information based on the dynamic prompt words using a large language model to obtain the cause and type of vulnerability.

8. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, Based on samples, remediation methods, and patches, feasible remediation strategies are generated, and an expert knowledge base is built by associating various vulnerability types and causes.

9. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 1, characterized in that, In step 4, a large language model is used to generate repair code based on the cause of the vulnerability, the type of vulnerability, the expert knowledge base, and relevant information about the code vulnerability.

10. The two-stage PHP vulnerability detection and automatic repair method based on a large language model as described in claim 8, characterized in that, The specific process of step 4 is as follows: Step 41: Using the vulnerability type and vulnerability cause as the starting root node of the decision tree, retrieve all corresponding feasible remediation strategies from the expert knowledge base according to the vulnerability type, match the feasible remediation strategies with the corresponding lines of code in the vulnerability location and code vulnerability information, generate the technical route applicable to the vulnerability location based on the matched feasible remediation strategies, and construct the remediation decision tree. Step 42: Select a technical route from the repair decision tree to generate natural language instructions; Step 43: Based on the lines of code corresponding to the natural language instructions and code vulnerability information, and the patches in the expert knowledge base, refactor the code using the large language model to obtain the fix code; Step 44: Use the repair code to correct the source code to be detected and generate the corrected source code.

Images