Intelligent agent collaborative vulnerability reasoning method and system based on logic modeling and structured prompt

Abstract

The invention provides an agent collaborative vulnerability reasoning method and system based on logic modeling and structured prompt. The method comprises the following steps: modeling each vulnerability type by adopting a structured prompt language, generating a structured vulnerability expression of each vulnerability type and taking the structured vulnerability expression as a matching rule, and querying and matching in a code warehouse to obtain a matched code snippet; constructing a positive sample and a negative sample by utilizing all the matched code snippets and the structured vulnerability expression to form a training sample set, so as to finely tune the pre-trained large language model and enable the pre-trained large language model to learn a mapping relationship between the code snippets and vulnerability types, thereby obtaining a finely tuned vulnerability model; inputting a to-be-detected program and the corresponding structured vulnerability expression into the fine-tuned vulnerability model, and predicting to obtain candidate vulnerability codes; and inputting the candidate vulnerability codes and the corresponding structured vulnerability expressions into a preset agent, and performing context-aware verification on the candidate vulnerability codes in combination with the atomic operation toolkit to obtain a vulnerability detection result.

Description

Technical Field

[0001] This invention relates to the field of computer application technology, and in particular to a method and system for intelligent agent collaborative vulnerability reasoning based on logical modeling and structured prompts. Background Technology

[0002] With the continuous development of internet and software technologies, modern software systems have significantly increased in scale and complexity. Developing accurate and interpretable vulnerability detection has become a core challenge in software security. Traditional vulnerability detection techniques mainly include symbolic execution, static code analysis, and pattern matching. However, with the advancement of deep learning, methods have explored LLM-based vulnerability detection approaches. These models can learn vulnerability patterns from large-scale code corpora, improving detection performance to some extent. However, these methods mostly rely on human experience or simple automated tools, which have significant limitations. Specifically: Limited understanding of code context: Large models rely on patterns in the training data for semantic understanding of code, but complex vulnerabilities require in-depth program analysis (such as data flow and control flow), while models may only capture surface syntactic features.

[0003] Poor understanding of deep semantic logic: Vulnerabilities in code often rely on implicit logic (such as time race conditions and the order of asynchronous callbacks), while large models may not be able to deeply understand the semantic logic of the code, resulting in weak vulnerability identification capabilities.

[0004] Weak interpretability: The model prioritizes the accuracy of the results over the interpretability of the reasoning. Summary of the Invention

[0005] To address the common problems of "illusionary output" and "uninterpretable reasoning process" in existing vulnerability detection methods based on Large Language Models (LLM), as well as their low adaptability to constantly evolving code structures and variant vulnerability patterns, this invention provides an agent-based collaborative vulnerability reasoning method and system based on logical modeling and structured prompts.

[0006] In a first aspect, the present invention provides an agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts, comprising: Step 1: Model each vulnerability type using a pre-defined structured hint language to generate structured vulnerability expressions for each vulnerability type; Step 2: Use the structured vulnerability expressions of each vulnerability type as matching rules, and query and match them in the given code repository based on the matching rules to obtain code snippets that match each structured vulnerability expression; use all the matched code snippets and structured vulnerability expressions to construct positive and negative samples, thereby forming a training sample set; Step 3: Fine-tune the pre-trained large language model using the training sample set, so that the pre-trained large language model learns the mapping relationship between code snippets and vulnerability types, thereby obtaining the fine-tuned vulnerability model; Step 4: Input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict candidate vulnerability code in the program to be detected; input the predicted candidate vulnerability code and the corresponding structured vulnerability expression into a preset agent so that the agent can call a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code and obtain vulnerability detection results.

[0007] Furthermore, the structured prompt language consists of multiple keywords, which specifically include operation node, operation node type, operation result type, comparison type, protection conditions for operation node, operation parameters, right / left operands of the operation, whether the operation node is protected by conditions, whether the conditions indicate the operation, whether all conditions must be true / any one of the conditions is true, whether certain operation conditions exist, and the maximum / minimum value of the parameters.

[0008] Furthermore, in step 4, the atomic operation toolkit specifically includes function indexing and expansion operations, code slicing operations, and numerical boundary recognition operations; wherein: Function indexing and expansion operations: A function index set is established for all functions in the program to be detected, so that when a function is called during the inference process, if the called function exists in the function index set, the context of the called function is expanded based on the function index set; Code slicing operation: Treat the candidate vulnerable code as a suspected risk node, and backtrack from the suspected risk node to perform data flow-sensitive reverse slicing on the program to be detected; Numerical boundary identification operation: Extract variable definition-related code from the candidate vulnerability code, extract variable types, and obtain the upper and lower bounds of the variables based on the variable types.

[0009] Furthermore, an index is established for all functions in the program to be tested, so that when a function is called during inference, if the called function exists in the function index set, the context of the called function is expanded based on the function index set, specifically including: Generate the abstract syntax tree of the program to be tested; The abstract syntax tree is traversed to identify all function nodes, and the function name, parameter list, return type and function body of each function node are extracted to form the index of the function node. The function index set is obtained by combining the indices of all function nodes. When a function call is encountered during inference, the function name and current recursion depth of the called function are obtained. It is then determined whether the current recursion depth is less than the preset maximum recursion depth. If it is less, the function body corresponding to the function name of the called function is queried in the function index set as the context of the called function.

[0010] Furthermore, starting from the suspected risk node, a data flow-sensitive reverse slice is performed on the program to be detected, specifically including: Generate the abstract syntax tree of the program to be tested; Traverse all nodes in the abstract syntax tree and perform the following relevance judgment for each node: determine whether the variable contained in the node exists in the variable set of the suspected risk node. If it does, the node is determined to be related to the suspected risk node; otherwise, it is not related. Obtain the program code corresponding to all nodes related to the suspected risk node and aggregate all related program code to form a reverse slicing result set.

[0011] Secondly, the present invention provides an agent-based collaborative vulnerability reasoning system based on logical modeling and structured prompts, comprising: The vulnerability coding module is used to model each vulnerability type using a preset structured hint language and generate structured vulnerability expressions for each vulnerability type. The training sample construction module is used to use the structured vulnerability expressions of each vulnerability type as matching rules, and to query and match them in a given code repository based on the matching rules to obtain code snippets that match each structured vulnerability expression; positive samples and negative samples are constructed using all the matched code snippets and structured vulnerability expressions, thereby forming a training sample set; The model fine-tuning module is used to fine-tune the pre-trained large language model using the training sample set, so that the pre-trained large language model learns the mapping relationship between code snippets and vulnerability types, thereby obtaining the fine-tuned vulnerability model. The vulnerability inference module is used to input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict candidate vulnerability code in the program to be detected; the predicted candidate vulnerability code and the corresponding structured vulnerability expression are input into a preset intelligent agent, so that the intelligent agent can call a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code to obtain vulnerability detection results.

[0012] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in the first aspect.

[0013] Fourthly, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect.

[0014] The beneficial effects of this invention are as follows: (1) This invention designs a formal vulnerability modeling mechanism based on first-order logic, which links formal vulnerability semantics with LLM understanding, performs structured representation of common vulnerability types, and obtains structured vulnerability expressions for each vulnerability type as an intermediary representation to guide LLM reasoning with precise semantic constraints. Furthermore, it implements instruction adjustment strategies on a large-scale code corpus, enabling LLM to learn from SPL-based expressions. This effectively alleviates the uncertainty problem of traditional LLM-driven tools when facing deep path judgment, and ultimately realizes LLM's understanding of vulnerability triggering behavior and efficient detection and accurate triggering of deep vulnerabilities in complex software.

[0015] (2) By using the structured vulnerability expressions of each vulnerability type as matching rules, this invention constructs a high-quality Alpaca format instruction fine-tuning dataset, enabling LLM to learn the mapping relationship between code snippets and vulnerability types, and output structured semantic expressions during the reasoning process to guide subsequent verification and refined reasoning.

[0016] (3) This invention proposes an intelligent agent collaborative reasoning framework, which combines intelligent agents with atomic operation toolkits to perform fine-grained analysis of variable boundaries, pointer validity, and control flow paths through a modular verification mechanism. Each module is responsible for verifying specific types of program attributes, ensuring that the vulnerability candidate paths output by the LLM are syntactically reasonable and meet the execution prerequisites under actual runtime conditions. This hybrid reasoning mechanism of "semantic fuzziness and numerical precision" not only improves the accuracy of vulnerability identification but also significantly improves testing efficiency and vulnerability discovery effectiveness. Attached Figure Description

[0017] Figure 1 A flowchart illustrating an agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts, provided in an embodiment of the present invention; Figure 2 A schematic diagram of the structure of an agent collaborative vulnerability reasoning system based on logical modeling and structured prompts provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] like Figure 1 As shown, this embodiment of the invention provides a method for intelligent agent collaborative vulnerability reasoning based on logical modeling and structured prompts, including: S101: Model each vulnerability type using a pre-defined structured hint language and generate structured vulnerability expressions for each vulnerability type; Specifically, this embodiment designs a Structured Prompting Language (SPL) as an intermediary representation between formal vulnerability semantics and code-level reasoning. This language can encode common vulnerability patterns into a format compatible with LLM instruction tuning and agent-driven verification, bridging the gap between symbolic logic and natural code understanding.

[0020] Unlike traditional rule-based or statistical learning methods, SPL is not limited to predefined vulnerability types. Instead, it provides a general framework for modeling various security vulnerabilities, transforming first-order logic-based vulnerability models into query-like expressions that can be used to train LLMs and provide guidance.

[0021] As one possible implementation method, the keywords included in SPL are shown in Table 1.

[0022] Table 1. Keyword and Meaning of Structured Hint Language S102: Using the structured vulnerability expressions of each vulnerability type as matching rules, query and match in the given code repository based on the matching rules to obtain code fragments that match each structured vulnerability expression; construct positive and negative samples using all the matched code fragments and structured vulnerability expressions to form a training sample set; for ease of description, the code fragments matched according to the structured vulnerability expressions will also be referred to as "expected output" in the following text.

[0023] Specifically, such as Figure 1 As shown in “Instruction”, “Input” and “Output”, by introducing SPL as a vulnerability code matching rule, it is possible to build a massive number of training samples in instruction format and realize the automation of sample generation, avoiding the problems of traditional vulnerability detection relying on manual annotation and poor scalability.

[0024] One approach is to use a large-scale open-source code repository as a given code repository and then use existing static analysis tools such as CodeQL and CppCheck to scan the repository to extract code snippets that match various structured vulnerability expressions.

[0025] S103: Use the training sample set to fine-tune the pre-trained large language model, so that the pre-trained large language model learns the mapping relationship between code snippets and vulnerability types, thereby obtaining the fine-tuned vulnerability model. Specifically, structured vulnerability expressions (i.e., vulnerability type descriptions), raw code, and expected outputs are integrated into the training samples. This format enables LLM to learn the mapping from raw code to specific vulnerability types during training. To strike a balance between inference efficiency and the ability to capture structured vulnerability patterns, a supervised fine-tuning (SFT) strategy is adopted during the training phase. The raw code and its corresponding structured vulnerability expressions are input into the pre-trained large language model. The model quantifies the difference between its predictions and expected outputs and updates its weights through backpropagation, thereby allowing the model to learn the mapping relationship between raw code and vulnerability types and gradually improve its understanding of vulnerability patterns.

[0026] Furthermore, to further enhance training stability and convergence, a cosine annealing learning rate scheduler was incorporated to dynamically adjust the learning rate throughout the training process. The learning rate calculation formula is as follows: in, Let represent the learning rate at training step t, and T represent the total number of training steps. and These represent the maximum and minimum learning rates during the training process, respectively.

[0027] S104: Input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict candidate vulnerability code in the program to be detected; input the predicted candidate vulnerability code and the corresponding structured vulnerability expression into a preset intelligent agent so that the intelligent agent can call a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code and obtain vulnerability detection results.

[0028] Specifically, after obtaining the candidate vulnerability code output by the fine-tuned vulnerability model, a context-sensitive fine-grained reasoning agent is introduced. This agent, combined with a pre-defined atomic operation toolkit, performs fine-grained verification of variable boundaries, pointer validity, and control flow paths. Based on structured prompts, the agent automatically executes atomic operations (such as function indexing and expansion, code slicing, and variable boundary identification), achieving a hybrid reasoning mechanism that is "semantically ambiguous but numerically precise." This mechanism effectively alleviates the uncertainty problem of traditional LLM-driven tools when facing deep path judgments, significantly improving the accuracy and reliability of vulnerability identification. This stage involves performing context-sensitive, fine-grained reasoning on the output of the fine-tuned vulnerability model, thereby improving the accuracy and interpretability of the detection results.

[0029] In this embodiment of the invention, a vulnerability-sensitive area identification mechanism integrating first-order logic modeling and Structured Hint Language (SPL) is constructed. This mechanism formalizes common vulnerability types into a unified logical expression and further maps them to a semantic representation understandable by a large language model, achieving automated identification of vulnerability patterns. Simultaneously, an intelligent agent collaborative reasoning framework is constructed: a modular verification mechanism is used to perform fine-grained analysis of variable boundaries, pointer validity, and control flow paths, and to verify these aspects, thereby improving the credibility and interpretability of the detection results.

[0030] In one embodiment, step S104 specifically includes the atomic operation toolkit, which includes function indexing and expansion operations, code slicing operations, and variable boundary identification operations; wherein: S201, Function indexing and expansion operation: Establish a function index set for all functions in the program to be detected, so that when a function is called during the inference process, if the called function exists in the function index set, the context of the called function is expanded based on the function index set; S202, Code slicing operation: Treat the candidate vulnerable code as a suspected risk node, trace back from the suspected risk node, and perform data flow-sensitive reverse slicing on the program to be tested; thereby removing code noise.

[0031] S203, Variable boundary identification operation: Extract variable definition-related code from the candidate vulnerability code, extract variable types, and obtain the upper and lower bounds of variables based on variable types to solve the numerical illusion problem existing in traditional LLM.

[0032] This invention proposes a context-dependent, fine-grained reasoning method for LLM output, which aims to solve the problem that traditional vulnerability detection tools usually only provide binary judgments—"vulnerability exists" or "no vulnerability found"—without providing insight into the underlying triggering conditions or contextual dependencies; at the same time, it reduces false positives in the model reasoning process.

[0033] Based on the above embodiments, step S201 specifically includes the following steps: S301: Generate the abstract syntax tree of the program to be tested; S302: Traverse the abstract syntax tree to identify all function nodes and extract the function name of each function node. Parameter list Return type and function body Using the indices that constitute the function nodes, a set of function indexes is obtained by combining the indices of all function nodes; S303: When a function call is encountered during inference, obtain the function name and current recursion depth of the called function, determine whether the current recursion depth is less than the preset maximum recursion depth, and if it is less, query the function body corresponding to the function name of the called function in the function index set as the context of the called function.

[0034] Specifically, in many existing LLM-based vulnerability detection methods, function calls are often treated as opaque operations and ignored, or inferences are assumed to occur in a specific manner based on their names or calling patterns. This leads to inaccurate inferences when variables flow through unchecked functions, increasing the risk of false positives and reducing the accuracy of data flow and control flow analysis. To address these issues, this invention employs steps S301 to S303 (referred to as the function indexing and expansion algorithm). This is a structured atomic operation capable of accurately indexing and expanding function definitions in the codebase. Unlike traditional analyzers that stop at function boundaries, the function indexing and expansion algorithm actively retrieves and slices function bodies for further semantic inference, ensuring the system maintains visibility into how input variables are handled within the function scope, thus improving the accuracy of inference. The code for the function indexing and expansion algorithm is shown in the table below.

[0035] Based on the above embodiments, step S202 specifically includes the following steps: S401: Generate the abstract syntax tree of the program to be tested; S402: Traverse all nodes in the abstract syntax tree and perform the following relevance judgment for each node: determine whether the variable contained in the node exists in the variable set of the suspected risk node. If so, the node is determined to be related to the suspected risk node; otherwise, it is not related. S403: Obtain the program code corresponding to all nodes related to the suspected risk node and aggregate all related program code to form a reverse slicing result set.

[0036] Specifically, after identifying candidate vulnerable code, a lightweight reverse slicing technique based on Abstract Syntax Tree (AST) is used to extract relevant code fragments from the program under test. The candidate vulnerable code is treated as a suspected risk node. Starting from this suspected risk node, the process backtracks through the AST, gradually collecting parent nodes and variable definition points related to the semantics of the current operation. The goal is to isolate the minimal but sufficient contextual information required for vulnerability verification, thereby reducing the cognitive burden on the LLM while preserving basic program semantics.

[0037] Specifically, this embodiment of the invention constructs an abstract syntax tree (AST) of the program to be detected and analyzes the variable relationships between nodes to identify relevant code fragments that overlap with the target node in terms of variable usage, thereby achieving fine-grained context awareness and code association. For each function's internal AST nodes... Determine the source node With the target node Does it involve the same variables? If the variable sets of the two systems intersect, then they are considered related and returned. Otherwise return For each relevant AST node, it is remapped back to the source code, thus implementing a data flow-sensitive code slicing method that removes code noise unrelated to vulnerabilities during model inference. The code for the data flow-sensitive reverse slicing algorithm is shown in the table below.

[0038] The agent-based reasoning framework proposed in this invention incorporates a set of atomic operation toolkits tailored to vulnerability semantics, enabling context-aware verification of the initial predictions of a fine-tuned vulnerability model. The entire reasoning process begins with the output of candidate vulnerability code from the fine-tuned vulnerability model and utilizes multiple atomic operations for refined reasoning, including function indexing and expansion operations, code slicing operations, and variable boundary identification operations. The agent operates according to a predefined formal model, invoking corresponding atomic operations to perform hierarchical verification of key program attributes. This not only determines the existence of vulnerabilities but also explains the reasons for their occurrence, the execution path under which they are triggered, and which variables contribute to their triggering; significantly enhancing the practical utility of LLM-driven vulnerability detection systems.

[0039] Based on the same inventive concept, such as Figure 2 As shown, this embodiment of the invention provides an intelligent agent collaborative vulnerability inference system based on logical modeling and structured prompts, including a vulnerability encoding module, a training sample construction module, a model fine-tuning module, and a vulnerability inference module.

[0040] The vulnerability encoding module is used to model various vulnerability types using a preset structured vulnerability hint language, generating structured vulnerability expressions for each vulnerability type. The training sample construction module uses the structured vulnerability expressions for each vulnerability type as matching rules, queries and matches them in a given code repository based on the matching rules, and obtains code snippets that match each structured vulnerability expression. Positive and negative samples are constructed using all the matched code snippets and structured vulnerability expressions, thus forming a training sample set. The model fine-tuning module uses the training sample set to fine-tune a pre-trained large language model, enabling the pre-trained large language model to learn the mapping relationship between code snippets and vulnerability types, thereby obtaining a fine-tuned vulnerability model. The vulnerability inference module inputs the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model, predicts candidate vulnerability code in the program to be detected, and inputs the predicted candidate vulnerability code and the corresponding structured vulnerability expression into a preset intelligent agent, so that the intelligent agent can call a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code, and obtain vulnerability detection results.

[0041] It should be noted that the agent-based collaborative vulnerability inference system provided in the above embodiments is for the purpose of the above agent-based collaborative vulnerability inference method. Its specific functions can be referred to in the above method embodiments, and will not be repeated here.

[0042] This invention achieves high-precision and interpretable detection of various types of software vulnerabilities through a formal vulnerability modeling mechanism and a fine-grained verification process. Specifically, this invention constructs a Structured Hint Language (SPL), converting common vulnerability types from first-order logical expressions into query-like statements. These queries serve as training signals and inference guides for supervised fine-tuning of a large language model, enabling it to identify potential vulnerability candidates in the code. Based on this, this invention designs an agent-driven verification mechanism, utilizing a set of atomic operations to perform layer-by-layer logical verification of candidate vulnerabilities, ensuring that the inference process conforms to formal semantic constraints. For vulnerability type matching, fuzzy matching using structured vulnerability expressions is employed, primarily focusing on the vulnerability model. For vulnerability detail inference, an agent combined with static analysis tools is used to achieve refined numerical inference, resulting in an overall approach that is fuzzy in vulnerability matching but precise in vulnerability details. While maintaining the model's generalization ability, this invention improves the detection accuracy for specific vulnerability types, enabling the system to adapt to new or variant vulnerability patterns while ensuring rigorous verification of known vulnerabilities. The entire detection process of this invention is completed collaboratively by the initial identification of vulnerability code led by LLM and the deep verification of the intelligent agent module. High-quality training samples are generated by combining static analysis tools and organized into an instruction follow-up dataset in a unified format for model training. Finally, a hybrid vulnerability detection framework that integrates semantic understanding and program verification is constructed, which effectively solves the problems of traditional static analysis relying on hard-coded rules, deep learning methods lacking formal verification mechanisms, and existing LLM detection methods being prone to false positives and logical inconsistencies.

[0043] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include: a processor 301, a communication interface 302, a memory 303, and a communication bus 304. The processor 301, communication interface 302, and memory 303 communicate with each other via the communication bus 304. The processor 301 can call logical instructions in the memory 303 to execute an agent-based collaborative vulnerability reasoning method based on logical modeling and structured hints. This method includes: Step 1: Modeling each vulnerability type using a preset structured hint language to generate structured vulnerability expressions for each vulnerability type; Step 2: Using the structured vulnerability expressions for each vulnerability type as matching rules, querying and matching in a given code repository based on the matching rules to obtain code fragments that match each structured vulnerability expression; constructing positive and negative samples using all matched code fragments and structured vulnerability expressions, thereby... Step 3: Use the training sample set to fine-tune the pre-trained large language model, so that the pre-trained large language model learns the mapping relationship between code fragments and vulnerability types, thereby obtaining the fine-tuned vulnerability model; Step 4: Input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict the candidate vulnerability code in the program to be detected; Input the predicted candidate vulnerability code and the corresponding structured vulnerability expression into a preset intelligent agent, so that the intelligent agent can call a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code and obtain the vulnerability detection result.

[0044] Furthermore, when the logical instructions in the aforementioned memory 303 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0045] This invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute an agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts provided in the above-described method embodiments.

[0046] This invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts provided in the above-described method embodiments.

[0047] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for collaborative vulnerability reasoning of intelligent agents based on logical modeling and structured prompts, characterized in that, include: Step 1: Model each vulnerability type using a pre-defined structured hint language to generate structured vulnerability expressions for each vulnerability type; Step 2: Use the structured vulnerability expressions of each vulnerability type as matching rules, and query and match them in the given code repository based on the matching rules to obtain code snippets that match each structured vulnerability expression; Positive and negative samples are constructed using all matched code snippets and structured vulnerability expressions, thus forming a training sample set; Step 3: Fine-tune the pre-trained large language model using the training sample set, so that the pre-trained large language model learns the mapping relationship between code snippets and vulnerability types, thereby obtaining the fine-tuned vulnerability model; Step 4: Input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict the candidate vulnerability code in the program to be detected; The predicted candidate vulnerability code and the corresponding structured vulnerability expression are input into a preset intelligent agent, which then calls a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code and obtain vulnerability detection results.

2. The agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts according to claim 1, characterized in that, The structured prompt language consists of multiple keywords, which specifically include operation node, operation node type, operation result type, comparison type, protection conditions for operation node, operation parameters, right / left operands of the operation, whether the operation node is protected by conditions, whether the conditions indicate the operation, whether all conditions must be true or any one condition is true, whether certain operation conditions exist, and the maximum / minimum value of the parameters.

3. The agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts according to claim 1, characterized in that, In step 4, the atomic operation toolkit specifically includes function indexing and expansion operations, code slicing operations, and variable boundary identification operations; wherein: Function indexing and expansion operations: A function index set is established for all functions in the program to be detected, so that when a function is called during the inference process, if the called function exists in the function index set, the context of the called function is expanded based on the function index set; Code slicing operation: Treat the candidate vulnerable code as a suspected risk node, and backtrack from the suspected risk node to perform data flow-sensitive reverse slicing on the program to be detected; Variable boundary identification operation: Extract variable definition-related code from the candidate vulnerability code, extract variable types, and obtain the upper and lower bounds of the variables based on the variable types.

4. The agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts according to claim 3, characterized in that, An index is created for all functions in the program to be tested, so that when a function is called during inference, if the called function exists in the function index set, the context of the called function is expanded based on the function index set, specifically including: Generate the abstract syntax tree of the program to be tested; The abstract syntax tree is traversed to identify all function nodes, and the function name, parameter list, return type and function body of each function node are extracted to form the index of the function node. The function index set is obtained by combining the indices of all function nodes. When a function call is encountered during inference, the function name and current recursion depth of the called function are obtained. It is then determined whether the current recursion depth is less than the preset maximum recursion depth. If it is less, the function body corresponding to the function name of the called function is queried in the function index set as the context of the called function.

5. The agent-based collaborative vulnerability reasoning method based on logical modeling and structured prompts according to claim 3, characterized in that, Starting from the suspected risk node, backtracking is performed on the program to be detected using data flow-sensitive reverse slicing, specifically including: Generate the abstract syntax tree of the program to be tested; Traverse all nodes in the abstract syntax tree and perform the following relevance judgment for each node: determine whether the variable contained in the node exists in the variable set of the suspected risk node. If it does, the node is determined to be related to the suspected risk node; otherwise, it is not related. Obtain the program code corresponding to all nodes related to the suspected risk node and aggregate all related program code to form a reverse slicing result set.

6. A collaborative vulnerability reasoning system for intelligent agents based on logical modeling and structured prompts, characterized in that, include: The vulnerability coding module is used to model each vulnerability type using a preset structured hint language and generate structured vulnerability expressions for each vulnerability type. The training sample construction module is used to use the structured vulnerability expressions of each vulnerability type as matching rules, and to query and match in a given code repository based on the matching rules to obtain code snippets that match each structured vulnerability expression. Positive and negative samples are constructed using all matched code snippets and structured vulnerability expressions, thus forming a training sample set; The model fine-tuning module is used to fine-tune the pre-trained large language model using the training sample set, so that the pre-trained large language model learns the mapping relationship between code snippets and vulnerability types, thereby obtaining the fine-tuned vulnerability model. The vulnerability inference module is used to input the program to be detected and the corresponding structured vulnerability expression into the fine-tuned vulnerability model to predict the candidate vulnerability code in the program to be detected. The predicted candidate vulnerability code and the corresponding structured vulnerability expression are input into a preset intelligent agent, which then calls a preset atomic operation toolkit to perform context-aware verification on the candidate vulnerability code and obtain vulnerability detection results.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 5.

Images