Code vulnerability automatic detection tool for basic software development
The intelligent detection system, which combines multi-level composite abstract syntax trees and graph neural networks, solves the problems of high false alarm rate and low coverage in vulnerability detection in basic software development. It achieves accurate identification and self-optimization of complex vulnerabilities, improving detection effectiveness and automation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JIANGSU YANYUTONG ELECTRONIC TECHNOLOGY CO LTD
- Filing Date
- 2026-01-29
- Publication Date
- 2026-05-08
AI Technical Summary
Existing code vulnerability detection tools have high false positive rates and low coverage in basic software development, struggle to handle complex patterns and concurrent vulnerabilities, and lack adaptation to the specific paradigms of basic software, resulting in poor detection performance.
An intelligent detection system is formed by constructing a multi-level composite abstract syntax tree, a vulnerability rule knowledge base enhanced with domain knowledge, and a context-sensitive analysis module based on graph neural networks, combined with symbolic execution and constraint solving. The composite abstract syntax tree is represented in depth by graph neural networks and continuously optimized using a feedback-driven adaptive optimization engine.
It significantly improves the accuracy of vulnerability pattern recognition, reduces the false negative rate, and can effectively detect complex vulnerabilities that are difficult to find using traditional methods. It achieves a high degree of automation and continuous learning capabilities, reducing reliance on manual adjustments by security experts.
Smart Images
Figure CN121997343A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software security testing and static program analysis technology, specifically to an automatic code vulnerability detection tool for basic software development. Background Technology
[0002] As the cornerstone of the computing ecosystem, the security of foundational software is of paramount importance. This type of software is typically large-scale, long-lived, and involves complex concurrency, and it heavily utilizes low-level languages such as C / C++, making vulnerabilities such as memory corruption and race conditions difficult to detect and potentially leading to serious security incidents.
[0003] Automated code vulnerability detection primarily relies on dynamic and static analysis. Dynamic analysis (such as fuzzing) has a low false positive rate but limited coverage, making it difficult to reach deep states and complex branches. Static analysis offers higher theoretical coverage, but traditional tools face significant limitations: pattern-matching methods suffer from high false positive rates due to a lack of deep semantic understanding; the introduction of context- and path-sensitive analysis (such as symbolic execution) is hampered by path explosion, making it difficult to handle large-scale code; the ability to model complex patterns such as concurrent vulnerabilities is insufficient, and relying on expert rules makes it difficult to cover unknown variants; general-purpose tools are not adapted to the specific paradigms of basic software (such as pointer arithmetic and inline assembly), resulting in poor performance; and the overall level of automation and intelligence is low, requiring significant manual intervention.
[0004] In recent years, deep learning-based detection methods have captured vulnerability patterns by learning from code samples. However, existing methods often treat code as a sequence or a simple syntax tree, failing to fully model key structured semantic information such as data flow and control flow. As a result, there is still significant room for improvement in detection capabilities in basic software scenarios that require accurate understanding of long-distance dependencies. Summary of the Invention
[0005] To address the aforementioned technical problems, this invention provides an automatic code vulnerability detection tool for basic software development, which is part of an intelligent automatic code vulnerability detection system for basic software development. The tool comprises: The source code preprocessing and standardization module is used to receive the target source code, perform code standardization, macro expansion, comment removal, and configuration association with the target compilation environment, and generate standardized intermediate code. A multi-level composite abstract syntax tree construction module is connected to the source code preprocessing and standardization module. It is used to parse the standardized intermediate code, generate a basic abstract syntax tree, and further integrate control flow graphs, data flow graphs, and basic software-specific semantic annotations to construct a composite abstract syntax tree containing syntax, structure, and some semantic information. A domain knowledge-enhanced vulnerability rule knowledge base stores rule sets for typical vulnerability patterns in basic software. The rule sets include traditional static analysis rules based on formal logic description, feature vectors of historical vulnerability code fragments, and vulnerability pattern features extracted by machine learning models. The context-sensitive analysis module based on graph neural networks is connected to the multi-level composite abstract syntax tree construction module and the domain knowledge-enhanced vulnerability rule knowledge base. It is used to convert the composite abstract syntax tree into a graph structure that can be processed by heterogeneous graph neural networks, extract deep representations of the code graph using a pre-trained graph neural network model, and perform pattern matching and anomaly detection in combination with the knowledge base to generate a preliminary set of suspicious points. The symbolic execution and constraint solving guidance module is connected to the context-sensitive analysis module based on graph neural networks. It is used to prioritize the preliminary suspicious point set, initiate selective symbolic execution for high-priority paths, generate path constraints, and call the constraint solver to verify the reachability of the vulnerability, thereby filtering false alarms. The vulnerability association and root cause localization module is connected to the symbolic execution and constraint solving guidance module. It is used to construct a vulnerability propagation chain for confirmed vulnerability points by tracing back data dependencies and control dependencies, identify the root cause location and triggering conditions of the vulnerability, and generate a detailed report containing vulnerability type, location, severity level, root cause chain and remediation suggestions. The feedback-driven adaptive optimization engine is connected to the domain knowledge-enhanced vulnerability rule knowledge base and the graph neural network-based context-sensitive analysis module. It is used to collect false positives, false negatives, and newly confirmed vulnerability patterns in the analysis results, dynamically update the vulnerability rule knowledge base, and fine-tune the graph neural network model to achieve continuous optimization of the system.
[0006] This invention provides an intelligent automatic code vulnerability detection method for basic software development applied to the aforementioned system, characterized by comprising the following steps: S1: Obtain the source code of the target basic software, perform preprocessing and standardization, and generate standardized intermediate code; S2: Parse standardized intermediate code and construct a multi-level composite abstract syntax tree that integrates CFG, DFG and domain semantic annotations; S3: Convert the composite AST into a heterogeneous graph, input it into a pre-trained graph neural network model for context-sensitive analysis, and combine it with a vulnerability rule knowledge base to output a preliminary set of suspected vulnerability points; S4: Prioritize the initial set of suspicious points, initiate selective symbolic execution and constraint solving for high-priority points, verify vulnerability reachability, filter false alarms, and confirm the real vulnerability; S5: For confirmed real vulnerabilities, construct the vulnerability propagation chain using static slicing technology, locate the root cause, and generate a structured vulnerability report; S6: Adaptively update the vulnerability rule knowledge base and optimize the graph neural network model parameters based on new samples in the detection results.
[0007] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described intelligent code vulnerability automatic detection method for basic software development.
[0008] The present invention has the following beneficial effects: 1. By modeling the composite AST (Abstract Strategy) that incorporates rich semantic information using graph neural networks, we can more accurately understand the context and long-distance dependencies of the code, significantly improving the accuracy of vulnerability pattern recognition and reducing the false negative rate. Subsequent selective symbolic execution verification further filters out false positives that may be generated by the deep learning model, forming a dual protection mechanism of "coarse screening + fine verification".
[0009] 2. GNN models are particularly good at processing graph-structured data. They can naturally encode and learn complex relationships such as control flow and data flow in a program, thereby effectively detecting complex vulnerabilities involving interactions between multiple code locations that are difficult to find using traditional methods (such as specific types of race conditions and cross-function data flow violations).
[0010] 3. The system design fully considers the characteristics of basic software. It adapts to the compilation environment through a preprocessing module, injects domain semantic annotations into the composite AST, and has built-in rule sets for core issues of basic software such as memory safety and concurrency safety in the knowledge base, making the analysis more targeted.
[0011] 4. The entire process, from code parsing and model inference to result verification and report generation, is highly automated. In particular, the introduction of the feedback optimization engine enables the system to evolve itself using historical analysis data, reducing reliance on manual rule adjustments by security experts and providing continuous learning capabilities. Attached Figure Description
[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0013] Figure 1 This is a flowchart of the automatic code vulnerability detection system of the present invention; Figure 2This is a flowchart of an automated method for detecting vulnerabilities in domestically produced code. Detailed Implementation The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0014] Example 1: This example provides an intelligent automatic code vulnerability detection system for basic software development. The system mainly includes the following seven core modules, which work together to form a complete detection closed loop.
[0015] 1. Source code preprocessing and standardization module 110 This module serves as the starting point for analysis, handling the diversity and complexity of the original source code and providing a clean, unified, and target-environment-compliant intermediate representation for subsequent analysis. It contains three sub-modules: Encoding unification submodule 111: Identifies the original encoding of the source code file (such as GBK, ASCII, UTF-16, etc.) and converts it losslessly to the unified UTF-8 encoding to ensure that the subsequent parser can correctly process all characters.
[0016] Compiler Environment Simulation Submodule 112: This is a key component for complex build environments of foundational software. It allows users to specify, or the system to automatically detect, the compiler (such as GCC, Clang), architecture (x86, ARM), compilation options (optimization level, macro definitions), and header file search paths used by the target software. This submodule simulates the preprocessing stage, correctly expanding conditional compilation directives (#ifdef, #if) and loading the correct macro definitions and header file contents. For example, for Linux kernel code, it is necessary to load key macro definitions such as -D__KERNEL__ and the kernel header file paths.
[0017] Structure Normalization Submodule 113: After preprocessing, this submodule further normalizes the code. This includes: expanding C++ template instantiation, lambda expressions, and other syntactic sugar into more basic representations; performing inline expansion of simple inline functions before AST construction (optional); removing all single-line and multi-line comments; and removing preprocessing directive lines. The output is "normalized intermediate code" that conforms to standard language syntax but is bound to the specific compilation environment.
[0018] 2. Multi-level compound abstract syntax tree construction module 120 This module is responsible for generating an information-rich intermediate code representation from standardized intermediate code. For example... Figure 2 As shown, its construction process is layered: Step S21: Invoke a parser that matches the programming language (such as LibTooling for C / C++ based on LLVM / Clang, or a multilingual parser based on Tree-sitter) to generate a standard abstract syntax tree. The standard AST accurately reflects the syntactic structure of the source code.
[0019] Step S22: Based on the standard AST, perform program analysis and construct two key program diagrams: Control Flow Graph (CFG): Using functions as the basic unit, code is decomposed into basic blocks, which are connected by edges such as conditional branches, loops, and jumps, representing all possible execution paths of the program.
[0020] Data Flow Graph (DFG): Analyzes the definition-use relationships between variables in the CFG nodes. For each variable, traces its definition points (such as assignments) and all use points (such as reads), establishing a definition-use chain.
[0021] Step S23: First-level enhancement: Projecting or labeling the information from the CFG and DFG onto the standard AST. Specifically, each statement or expression node in the AST is associated with its basic block ID in the CFG, its predecessor / successor relationships, and the set of variables it defines and uses. This makes the AST node contain not only syntactic information but also preliminary structured semantic information.
[0022] Step S24: Second-layer enhancement (domain knowledge injection): The system has a built-in basic software domain knowledge base, which defines semantic patterns that require special attention. For example: Memory operations: Calls nodes marked as "memory allocation / deallocation / copy".
[0023] Lock operations: These are marked as "lock / unlock" nodes and associated with lock variables.
[0024] Interruption control: flag.
[0025] Specific APIs: Mark APIs that are known to be error-prone or have specific resource management responsibilities.
[0026] When constructing the AST, the parser identifies these patterns and creates additional "semantic annotation nodes" linked to the corresponding AST nodes. The final output is a composite AST, where the nodes are grammatical nodes and the edges include not only grammatical parent-child relationships but also control flow edges, data flow edges, and semantic annotation edges.
[0027] 3. Domain-Knowledge-Enhanced Vulnerability Rule Knowledge Base (130) This knowledge base uses a hybrid representation to store multi-dimensional, machine-readable vulnerability information: Formal rule subset 131: Describe classic vulnerability patterns using domain-specific languages (DSLs) or SMT-LIB-like logical expressions. For example, a "use-and-free" rule might be described as: for a pointer variable P, there exists a path on which P is freed (free(P)), and then dereferenced without being reassigned (…). These rules can be directly interpreted and executed by the static analysis engine.
[0028] Historical vulnerability feature vector subset 132: Code snippets are extracted from publicly available vulnerability databases (such as CVE, NVD) or internal historical vulnerabilities, converted into a composite AST graph representation by this system, and then used by a GNN encoder to extract fixed-dimensional feature vectors. These vectors represent how known vulnerabilities appear in the model's eyes and are used for similarity matching.
[0029] Machine learning pattern subset 133: Statistical or anomalous patterns automatically extracted from a large number of vulnerability codes by offline-trained auxiliary models (such as frequent subgraph mining and autoencoders), and stored in the form of model parameters or rule templates.
[0030] The knowledge base can be organized by vulnerability type (memory security, concurrency security, etc.), and each piece of knowledge is accompanied by metadata such as severity, confidence level, and applicable conditions. It is the core asset of the system's detection capabilities and can be dynamically updated.
[0031] 4. Context-Sensitive Analysis Module Based on Graph Neural Networks 140 This module is the core of the system's intelligent detection.
[0032] Graph Transformation Submodule 141: Formally transforms the composite AST into a heterogeneous graph G = (V, E, R). Here, node V corresponds to the syntactic nodes and semantic annotation nodes in the AST. Edge E has multiple types, R, including: syntactic parent-child relationships, control flow order, data definition, data usage, semantic annotation relationships, etc. Each node and edge can be assigned an initial feature vector, such as node type, operator, word embeddings of variable names, etc.
[0033] Graph Neural Network Model Submodule 142: Employs a pre-trained heterogeneous graph neural network model, such as a relational graph convolutional network or a heterogeneous graph attention network. The model uses a multi-layered message-passing mechanism, allowing nodes to aggregate information from their neighboring nodes based on their edge types. After L layers of iteration, each node obtains a final embedding vector h_v that incorporates rich contextual information from its local graph structure (L-hop neighborhood). This vector implicitly encodes the node's semantic and structural role in the program, as well as its interaction patterns with surrounding code.
[0034] Vulnerability detection head submodule 143: For each target vulnerability type t (e.g., "buffer overflow"), the detection head can be a multilayer perceptron classifier. It receives the node embedding h_v and outputs a scalar score s_v^t, representing the probability that the node has a vulnerability of type t. Simultaneously, it can also calculate the cosine similarity between h_v and the vulnerability feature vectors in knowledge base 132 as another auxiliary score. Finally, all node locations with scores exceeding a preset threshold, along with their vulnerability types and confidence levels, are combined to form a preliminary suspicious point set.
[0035] 5. Symbolic Execution and Constraint Solving Guidance Module 150 This module is responsible for processing the initial results of the GNN to verify the authenticity of vulnerabilities using formal methods. S41: Priority Ranking. For the initial set of suspicious points, a comprehensive priority score is calculated for each suspicious point, taking into account the GNN confidence score, the preset severity weight of the vulnerability type, and the path complexity estimate to reach the point (such as path length and number of branches).
[0036] S42: Selective Path Exploration. Not all suspicious points undergo full-path symbolic execution. The system selects the top K points with the highest priority (K can be dynamically adjusted based on time budget) as guiding targets. The symbolic execution engine is activated, but unlike traditional blind exploration, the engine is guided to prioritize exploring program paths that can reach the suspicious target points.
[0037] S43: Constraint Generation and Solving. As symbolic execution progresses along the guiding path, program variables are replaced with symbolic values, and all branch conditions are collected to form path constraints Φ. When a suspicious target point is reached, vulnerability condition Ψ is constructed. Then, the conjunction of path constraint Φ and vulnerability condition Ψ (Φ ∧ Ψ) is submitted to the constraint solver.
[0038] S44: Result Determination. If the solver returns SAT (Satisfiable) and provides a specific counterexample input (i.e., a test case that triggers the vulnerability), the vulnerability is confirmed. If it returns UNSAT (Unsatisfiable), it means that the vulnerability condition cannot be satisfied under the current program semantics, and this is a false alarm. The result is fed back to the next module.
[0039] 6. Vulnerability Association and Root Cause Analysis Module (160) For real vulnerabilities confirmed by Module 150, this module provides in-depth analysis, going beyond simple point localization.
[0040] It leverages existing data and control dependencies in the composite AST, performing a backward static slice starting from the vulnerability trigger point (such as an out-of-bounds write statement). It traces back all statements affecting the variable values at that point, including assignments, function parameter passing, and return values. Simultaneously, it considers the conditions controlling the execution of these statements. This backtracking process continues until the root cause of the vulnerability is found, for example: An unverified source of user input (taint source).
[0041] An incorrect boundary calculation.
[0042] A missing or faulty lock protection area.
[0043] The generated vulnerability propagation chain clearly demonstrates how data / control flows from the source to the trigger point, greatly helping developers understand the nature of the vulnerability. The module ultimately generates a structured report, including a vulnerability description, CWE classification, CVSS score (estimated), root cause location, complete propagation chain, and specific remediation recommendations (such as adding boundary checks, validating input, and proper locking).
[0044] 7. Feedback-driven adaptive optimization engine 170 This module is crucial for the system's self-evolution. Its workflow is as follows: Collection: After the system is put into use, feedback is collected through two main channels: (a) Manual review: Security experts mark false positives and false negatives in the automated reports (vulnerabilities discovered in dynamic testing or actual attacks but not reported by the system). (b) Cross-validation results with high-precision dynamic analysis tools (such as targeted fuzzing).
[0045] Representation: The source code of these positive and negative samples (false positives are negative, false negatives and confirmed vulnerabilities are positive) is converted into a unified composite AST graph representation through the processing of modules 110 and 120.
[0046] renew: Model fine-tuning: A small batch of new samples is used to incrementally train or fine-tune the GNN model (142) to adjust the model parameters so that it can better fit the current code features and vulnerability distribution.
[0047] Knowledge base expansion: For newly confirmed vulnerability patterns, experts can summarize and refine them into new formal rules, adding them to rule 131; on the other hand, the feature vectors of their code graphs can be calculated and stored in rule 132. For frequently occurring false positive patterns, "safety pattern" feature vectors or rules can be generated for suppression during the inference phase.
[0048] Through continuous feedback loops, the system's detection accuracy and adaptability will continuously improve over time.
[0049] Example 2: This embodiment provides an intelligent automatic code vulnerability detection method for basic software development using the above-described system. The specific steps are as follows: Step S501: Source Code Acquisition and Preprocessing. Input the root directory of the target base software project's source code. System initialization, loading project-related compilation configurations (e.g., by reading Makefile, CMakeLists.txt, or configuration files). The preprocessing module traverses all source files (.c, .cpp, etc.), performs encoding conversion, conditional compilation expansion, and code normalization, outputting a standardized intermediate representation of the entire project.
[0050] Step S502: Construct a composite abstract syntax tree. For the standardized code, the parser and analyzer are called sequentially, unit by unit (usually a .c file and its header file), to construct a composite AST for each function. Ultimately, the code for the entire project is represented as a set of interconnected composite AST subgraphs (connected by function call edges).
[0051] Step S503: Graph Neural Network Intelligent Screening. Input the graph set generated in step S502 into the pre-trained GNN model. The model performs forward propagation inference on the entire project code, outputting preliminary scores for various vulnerabilities at all code locations. Based on a preset global threshold, all suspicious points are selected, forming an initial report A.
[0052] Step S504: Selective Symbolic Execution Verification. For each entry in Report A, read its corresponding composite AST subgraph and associated CFG path information. Start the guided symbolic execution engine and verify highly suspicious entries in priority order. This step may take a long time; a timeout mechanism can be set in the system. Output the verified Report B, which removes false positive entries proven to be unreachable and provides reachability proofs (possibly including simple trigger inputs) for real vulnerabilities.
[0053] Step S505: Root Cause Analysis and Report Generation. For each confirmed vulnerability in Report B, launch the static segmentation analyzer to generate a vulnerability propagation chain. Analyze all information comprehensively and generate a final detailed report C according to a standard template (such as SARIF format). This report can be pushed to developers or the security team via web interface, IDE plugin, or email.
[0054] Step S506: Iterative Updates of the Model and Knowledge Base. Developers or security experts review Report C and provide feedback. The system's backend optimization engine collects this feedback data and periodically (e.g., weekly or after accumulating a certain number of samples) initiates a round of model fine-tuning and knowledge base update tasks to prepare for the next analysis.
[0055] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.
Claims
1. An intelligent automatic code vulnerability detection system for basic software development, characterized in that, include: The source code preprocessing and standardization module is used to receive the target source code, perform code standardization, macro expansion, comment removal, and configuration association with the target compilation environment, and generate standardized intermediate code. A multi-level composite abstract syntax tree construction module is connected to the source code preprocessing and standardization module. It is used to parse the standardized intermediate code, generate a basic abstract syntax tree, and further integrate control flow graphs, data flow graphs, and basic software-specific semantic annotations to construct a composite abstract syntax tree containing syntax, structure, and some semantic information. A domain knowledge-enhanced vulnerability rule knowledge base stores rule sets for typical vulnerability patterns in basic software. The rule sets include traditional static analysis rules based on formal logic description, feature vectors of historical vulnerability code fragments, and vulnerability pattern features extracted by machine learning models. The context-sensitive analysis module based on graph neural networks is connected to the multi-level composite abstract syntax tree construction module and the domain knowledge-enhanced vulnerability rule knowledge base. It is used to convert the composite abstract syntax tree into a graph structure that can be processed by heterogeneous graph neural networks, extract deep representations of the code graph using a pre-trained graph neural network model, and perform pattern matching and anomaly detection in combination with the knowledge base to generate a preliminary set of suspicious points. The symbolic execution and constraint solving guidance module is connected to the context-sensitive analysis module based on graph neural networks. It is used to prioritize the preliminary suspicious point set, initiate selective symbolic execution for high-priority paths, generate path constraints, and call the constraint solver to verify the reachability of the vulnerability, thereby filtering false alarms. The vulnerability association and root cause localization module is connected to the symbolic execution and constraint solving guidance module. It is used to construct a vulnerability propagation chain for confirmed vulnerability points by tracing back data dependencies and control dependencies, identify the root cause location and triggering conditions of the vulnerability, and generate a detailed report containing vulnerability type, location, severity level, root cause chain and remediation suggestions. The feedback-driven adaptive optimization engine is connected to the domain knowledge-enhanced vulnerability rule knowledge base and the graph neural network-based context-sensitive analysis module. It is used to collect false positives, false negatives, and newly confirmed vulnerability patterns in the analysis results, dynamically update the vulnerability rule knowledge base, and fine-tune the graph neural network model to achieve continuous optimization of the system.
2. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The source code preprocessing and standardization module specifically includes: The encoding unification submodule is used to convert source code in different encoding formats into UTF-8 format. The compiler environment simulation submodule is used to load the compiler configuration, header file paths, and macro definition set that match the target base software, and to execute the correct branch expansion of conditional compilation instructions; The structure normalization submodule is used to standardize and expand syntactic sugar and inline functions in the source code, and remove all comments and non-functional code elements.
3. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The multi-level composite abstract syntax tree construction module performs the following operations: The basic parser is invoked to generate a standard AST corresponding to the programming language; Construct function-level and module-level control flow graphs and data flow graphs based on standard ASTs; The node and edge information in CFG and DFG are labeled as attributes onto the corresponding AST nodes to form the first layer of enhancement. By integrating a knowledge base of basic software domains, semantic annotation nodes are added to specific API calls, resource management operations, and synchronization primitives to form a second layer of enhancement, ultimately generating a composite AST.
4. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The rule set in the domain knowledge-enhanced vulnerability rule knowledge base includes at least the following: A subset of memory safety rules covers null pointer dereferencing, buffer overflows, use-after-free, double-free, and memory leak patterns. Concurrency safety rules subset: covers race conditions, deadlock, atomicity violations, and sequence violation patterns; A subset of logic and API misuse rules: covering integer overflow, division by zero errors, unchecked error return values, and unsafe function call patterns; Rules are stored in an extensible DSL or intermediate representation, along with confidence weights and trigger conditions.
5. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The context-sensitive analysis module based on graph neural networks specifically includes: The graph transformation submodule is used to map nodes in a composite AST to graph nodes, and to map syntactic parent-child relationships, control flow edges, data flow edges, and semantic annotation edges to different types of graph edges, thus constructing a heterogeneous graph. The graph neural network model submodule employs a multi-layer graph attention network or graph isomorphic network to perform message passing and node embedding updates on heterogeneous graphs, learning the global and local features of the code. The vulnerability detection head module receives the final embedding vector of the graph nodes, calculates similarity using a classifier or feature vectors in the knowledge base, and outputs the probability that a specific type of vulnerability exists at each code location.
6. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The symbolic execution and constraint solving guidance module adopts a selective symbolic execution strategy. The selection criteria include: the vulnerability probability output by the GNN model, the potential severity level of the vulnerability, and the complexity estimate of the execution path. This module uses the suspicious program points screened by GNN as the guidance targets for symbolic execution, rather than exploring the entire path, in order to balance the detection depth and time overhead.
7. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The vulnerability association and root cause localization module uses static slicing technology to perform forward and backward analysis along the data dependency and control dependency edges marked in the composite AST, generating a complete evidence chain from the vulnerability trigger point to the source defect, and visually presenting this evidence chain in the final analysis report.
8. The intelligent automatic code vulnerability detection system for basic software development according to claim 1, characterized in that, The workflow of the feedback-driven adaptive optimization engine includes: Collection module: Collects false positives and false negatives from manual review results or cross-validation with dynamic analysis tools; Characterization module: Converts the collected samples into a composite AST representation; Update module: Incrementally learns or fine-tunes the graph neural network model using new samples; Extension module: Abstracts the confirmed new vulnerability patterns into rules or feature vectors and stores them in the vulnerability rule knowledge base.
9. An intelligent automatic code vulnerability detection method for basic software development applied to the system described in any one of claims 1-8, characterized in that, Includes the following steps: S1: Obtain the source code of the target basic software, perform preprocessing and standardization, and generate standardized intermediate code; S2: Parse standardized intermediate code and construct a multi-level composite abstract syntax tree that integrates CFG, DFG and domain semantic annotations; S3: Convert the composite AST into a heterogeneous graph, input it into a pre-trained graph neural network model for context-sensitive analysis, and combine it with a vulnerability rule knowledge base to output a preliminary set of suspected vulnerability points; S4: Prioritize the initial set of suspicious points, initiate selective symbolic execution and constraint solving for high-priority points, verify vulnerability reachability, filter false alarms, and confirm the real vulnerability; S5: For confirmed real vulnerabilities, construct the vulnerability propagation chain using static slicing technology, locate the root cause, and generate a structured vulnerability report; S6: Adaptively update the vulnerability rule knowledge base and optimize the graph neural network model parameters based on new samples in the detection results.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the intelligent code vulnerability automatic detection method for basic software development as described in claim 9.