Software vulnerability mining method and device based on static analysis and big and small model collaboration, computer equipment and medium

Abstract

The embodiment of the invention provides a software vulnerability mining method and device based on static analysis and big and small model collaboration.The method comprises the following steps that attack faces are recognized and classified, and a code line annotation node set is generated; performing first-stage filtering on the code line annotation node set based on rules, and performing second-stage filtering on the annotation node set after primary filtering based on a twin neural network; taking a high-confidence node in the high-confidence attack surface set as a tracking starting point, generating a basic data flow diagram, obtaining a front-edge node set through static analysis, expanding the front-edge node set through a large language model and a path expansion algorithm, and generating a complemented data flow diagram; and detecting vulnerabilities based on the complemented data flow diagram to obtain a software vulnerability mining result. According to the scheme, through cooperation of the large language model and the twinning neural network, the false alarm rate is reduced, and the coverage rate and accuracy of vulnerability mining are improved.

Description

Technical Field

[0001] This invention relates to the field of data mining technology, and in particular to a software vulnerability mining method, apparatus, computer equipment, and medium based on static analysis and size model collaboration. Background Technology

[0002] Software vulnerabilities pose a serious threat to system security, potentially leading to data breaches, service interruptions, and substantial economic losses. Among existing vulnerability discovery techniques, static analysis is widely used due to its ability to perform global reasoning without executing code. Taint analysis is one of the core techniques of static analysis; its basic principle is to track whether untrusted input data can propagate and trigger sensitive operations, thereby detecting serious vulnerabilities such as code injection and SQL injection. The vulnerability detection process based on taint analysis typically includes three key steps: first, identifying externally controllable inputs that form the attack surface; second, tracing the propagation path of these inputs along the data flow; and finally, verifying whether the data flows to sensitive operations and triggers vulnerabilities. However, with the increasing scale and complexity of software, this classic process is facing severe challenges in practical applications.

[0003] Currently, industry and academia primarily employ two types of methods for vulnerability discovery: The first type is traditional static analysis tools based on rules and configurations. Representative tools include CodeQL, Semgrep, and FlowDroid. These tools typically rely on scalable configurations or API models to automatically discover attack surfaces and perform path tracing through control flow graphs and data flow graphs. Some tools, such as PyCG and PyAnalyzer, also introduce pointer analysis or object modeling to enhance support for specific language features. The second type is auxiliary analysis methods based on large language models. With the development of deep learning technology, recent research has emerged using LLMs for vulnerability detection, such as IRIS and LLift. These methods leverage the semantic reasoning capabilities of large models to assist in identifying high-risk sources and sinks and, to some extent, infer missing propagation paths, attempting to compensate for the shortcomings of traditional static analysis in semantic understanding.

[0004] Despite some progress in vulnerability discovery, existing technologies still have the following significant shortcomings when dealing with modern, large-scale, and highly dynamic software code: Attack surface identification suffers from numerous false positives: Traditional static analysis tools often struggle to distinguish between genuine attack surfaces—those that could potentially introduce malicious data—and harmless internal calls or constants when identifying program entry points. As projects grow in size, the number of potential entry points explodes, and existing automated tools lack effective pruning mechanisms. This leads to wasted computational resources in subsequent analysis and generates a large number of false positives, significantly increasing the cost of manual auditing.

[0005] Data flow graph fragmentation leads to missed vulnerabilities: Modern programming languages ​​(such as Python) are highly dynamic, containing numerous dynamic types, aliases, dynamic dispatch, and implicit information flows. Traditional static analyzers struggle to accurately parse these complex semantic relationships, resulting in fragmented and discontinuous data flow graphs. When the data propagation chain breaks in the middle, analysis tools cannot trace the final sensitive operation, leading to serious missed vulnerabilities.

[0006] Limitations of a single technical approach: Relying solely on static analysis is prone to path explosion, making it difficult to complete the analysis within a reasonable timeframe; while methods relying solely on large language models are limited by the context window size, making it difficult to perform global reasoning across the entire code repository, and are susceptible to the "illusion" problem, potentially fabricating non-existent vulnerabilities or paths. Existing technologies lack a synergistic mechanism that effectively combines the accuracy of static analysis with the semantic reasoning capabilities of large models. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide a software vulnerability mining method based on the synergy of static analysis and large / small models, to solve the technical problems in existing large-scale software vulnerability detection, such as the huge number of false positives in traditional static analysis, and the inability to trace complete attack paths due to the dynamic characteristics and implicit calls of programming languages ​​leading to broken data flow graphs. The method includes: The attack surface is identified and classified, a set of line comment nodes is generated, the set of line comment nodes is filtered firstly based on rules, a set of comment nodes after one filtering is generated, and the set of comment nodes after one filtering is filtered secondly based on Siamese neural network to generate a set of high-confidence attack surfaces. Using the high-confidence nodes in the high-confidence attack surface set as the starting point for tracing, data flow analysis is performed to generate a basic data flow graph. Based on the basic data flow graph, a set of leading nodes is obtained through static analysis. The set of leading nodes is then expanded using a large language model and path expansion algorithm to generate a complete data flow graph. The multi-agent-based vulnerability verification method detects vulnerabilities based on the completed data flow graph to obtain the results of software vulnerability discovery.

[0008] This invention also provides a software vulnerability mining device based on the synergy of static analysis and large / small models, to address the technical problems in existing large-scale software vulnerability detection, such as the huge number of false positives in traditional static analysis, and the inability to trace complete attack paths due to data flow graph fragmentation caused by the dynamic characteristics and implicit calls of programming languages. The device includes: A confidence node module is constructed to identify and classify the attack surface, generate a set of line comment nodes, perform a first-level filtering on the set of line comment nodes based on rules, generate a set of comment nodes after one-level filtering, and perform a second-level filtering on the set of comment nodes after one-level filtering based on a Siamese neural network to generate a set of high-confidence attack surfaces. The data flow reconstruction module is used to take the high-confidence nodes in the high-confidence attack surface set as the tracing starting point, perform data flow analysis, generate a basic data flow graph, obtain a frontier node set through static analysis based on the basic data flow graph, and expand the frontier node set through a large language model and path expansion algorithm to generate a complete data flow graph. The vulnerability verification module is used for a multi-agent-based vulnerability verification method to detect vulnerabilities based on the completed data flow graph and obtain the results of software vulnerability discovery.

[0009] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned software vulnerability mining methods based on static analysis and size model collaboration. This addresses the technical problems in existing large-scale software vulnerability detection, such as the huge number of false positives in traditional static analysis, and the data flow graph breakage and inability to trace the complete attack path due to the dynamic characteristics and implicit calls of programming languages.

[0010] This invention also provides a computer-readable storage medium storing a computer program that executes any of the above-described software vulnerability mining methods based on static analysis and size model collaboration. This addresses the technical problems in existing large-scale software vulnerability detection, such as the huge number of false positives in traditional static analysis, and the data flow graph being broken and unable to trace the complete attack path due to the dynamic characteristics and implicit calls of programming languages.

[0011] Compared with the prior art, the beneficial effects that at least one technical solution adopted in the embodiments of this specification can achieve include at least: To address the challenges of large-scale software vulnerability detection, traditional static analysis suffers from a massive number of false positives on the attack surface, as well as data flow graph fragmentation and the inability to trace complete attack paths due to the dynamic nature and implicit calls of programming languages. This approach utilizes a collaborative technique combining large models (large language models) and small models (Siamese neural networks) to achieve precise screening of potential attack surfaces and semantic-level completion of fragmented data flow paths. This constructs a complete vulnerability propagation chain, significantly improving the coverage and accuracy of vulnerability discovery while reducing false positive rates. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a software vulnerability mining method based on static analysis and size model collaboration provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating an embodiment of the software vulnerability discovery method based on the collaboration of static analysis and size model provided by this invention. Figure 3 This is a structural block diagram of a computer device provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a software vulnerability mining device based on static analysis and size model collaboration provided in an embodiment of the present invention. Detailed Implementation

[0014] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0015] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] In this embodiment of the invention, a software vulnerability discovery method based on static analysis and size model collaboration is provided, such as... Figure 1 As shown, the method includes: Step S101: Identify the attack surface and classify the attack surface, generate a set of line comment nodes, perform a first-level filter on the set of line comment nodes based on rules, generate a set of comment nodes after one-level filtering, and perform a second-level filter on the set of comment nodes after one-level filtering based on Siamese neural network to generate a set of high-confidence attack surfaces. Step S102: Using the high-confidence nodes in the high-confidence attack surface set as the tracing starting point, perform data flow analysis to generate a basic data flow graph. Based on the basic data flow graph, obtain the frontier node set through static analysis, and expand the frontier node set through a large language model and path expansion algorithm to generate a completed data flow graph. Step S103: A multi-agent vulnerability verification method is used to detect vulnerabilities based on the completed data flow graph to obtain the results of software vulnerability discovery.

[0017] In specific implementation, the following steps are used to identify and classify attack surfaces, generate a set of line comment nodes, and perform a first-level filtering on the set of line comment nodes based on rules to generate a set of comment nodes after one filtering: A static scan of the target software project is performed, identifying all potential input points based on a pre-defined attack surface classification system, and generating a corresponding line comment node for each potential input point. The line comment node encapsulates the identifier of a variable or function and the complete text line information of the encapsulated variable or function in the source code, generating a set of line comment nodes. A heuristic rule set is defined, including one or more rules such as removing literal constants and variables statically inferred to be of a safe basic type, removing variable definition nodes located within exception handling structures, and removing nodes containing only built-in function calls with no system impact. Based on the heuristic rule set, the set of line comment nodes undergoes a first-level risk filtering, removing low-risk nodes and generating a set of comment nodes after one filtering.

[0018] In specific implementation, the following steps are used to perform a second-level filtering on the set of annotated nodes after the first filtering based on a Siamese neural network, generating a high-confidence attack surface set: The identifier content and complete source code of each node in the first-filtered annotated node set are vectorized to generate a composite semantic feature vector for each node; a Siamese neural network based on two weight-sharing sub-networks is constructed; the composite semantic feature vector is input into the trained Siamese neural network to infer the nodes in the first-filtered annotated node set, and the average semantic distance between the output vector of each node and a preset vulnerability data source reference set is calculated; nodes with an average semantic distance less than a preset judgment threshold are judged as high-risk nodes, and all high-risk nodes are combined to generate the high-confidence attack surface set.

[0019] In practice, the following steps are used to construct a Siamese neural network based on two subnetworks with shared weights: Two weight-sharing sub-networks are constructed, each using a multi-layer bidirectional long short-term memory network as the core feature extractor. The Siamese neural network is used to extract bidirectional long-distance dependent semantic features from the code sequence and output a high-dimensional dense vector. Based on vulnerability samples labeled as real attack surfaces and non-vulnerability security noise samples, training data consisting of positive and negative sample pairs is constructed, and the Siamese neural network is trained based on the training data. The Siamese neural network is optimized using a contrastive loss function, so that the Euclidean distance of positive sample pairs in the feature space is reduced, and the distance of negative sample pairs is increased to a preset marginal threshold.

[0020] In specific implementation, the following steps are used to obtain a set of leading nodes based on the basic data flow graph through static analysis, and then expand the set of leading nodes using a large language model and path expansion algorithm to generate a complete data flow graph: From the basic data flow graph, identify all nodes with zero out-degree and non-sensitive operations to form a front node set; for each front node in the front node set, perform static analysis to extract the code context information of the front node, input it into a large language model for semantic reasoning and prediction, and generate an implicit successor node set; merge the implicit successor node set into the basic data flow graph, and establish directed edges from the front nodes to the corresponding successor nodes to obtain a preliminary expanded data flow graph; based on the preliminary expanded data flow graph, re-execute static analysis to explore the propagation path of the newly added nodes, and iteratively execute the expansion until the termination condition is met to generate the completed data flow graph.

[0021] In specific implementation, the following steps are used to perform static analysis to extract the code context information of each front node in the front node set, input it into a large language model for semantic reasoning and prediction, and generate an implicit successor node set: For each front node in the set of front nodes, perform the following steps to obtain an implicit successor node, until all front nodes have been processed, generating a set of implicit successor nodes: Determine whether the current leading edge node has been expanded, and whether the number of nodes in the current propagation path has reached a preset threshold; if it has not been expanded and the preset threshold has not been reached, extract the code line comment node information corresponding to the current leading edge node and the contextual semantics of the code segment where the current leading edge node is located, and construct structured prompt information through the code line comment node information and the contextual semantics; input the prompt information into a large language model, and obtain the possible flow of data from multiple perspectives through the large language model, and predict one or more implicit successor nodes based on the possible flow of data; remove duplicate nodes from the predicted implicit successor nodes.

[0022] In specific implementation, the multi-agent-based vulnerability verification method is implemented through the following steps: vulnerabilities are detected based on the completed data flow graph to obtain the results of software vulnerability discovery: A first agent is configured as a sensitive operation analyzer, and the completed data flow graph is input into the first agent. In the first agent, all end nodes of all paths in the completed data flow graph are scanned, and the end nodes are analyzed using a general defect enumeration knowledge base to determine whether they constitute sensitive operations. A first structured report is output, wherein the first structured report includes the identifier of the sensitive operation node and the defect type corresponding to the sensitive operation node. A second agent is configured as a vulnerability verifier, and the completed data flow graph and the first structured report are input into the second agent. In the second agent, for each sensitive operation node identified in the first structured report, the process traces back from the sensitive operation node to the data flow source point, analyzes the contextual semantics of the complete propagation path, checks whether there is data purification processing or conditional constraints on the complete propagation path, and outputs a second structured report. For each analyzed complete propagation path, the second structured report includes the vulnerability exploitability determination result and the determination reason. Based on the second structured report, the software vulnerability discovery result is obtained.

[0023] In one embodiment of the present invention, such as Figure 2 As shown, the embodiments of the present invention mainly include three modules: a semantically enhanced attack surface screening module, a multi-view data stream reconstruction module, and a multi-agent-based vulnerability detection module.

[0024] 1. Semantic-enhanced attack surface filtering module.

[0025] This module addresses the high false positive rate of attack surfaces in traditional static analysis by constructing semantically rich nodes and combining a dual filtering mechanism of "rules + small models (Siamese neural networks)".

[0026] Step 1.1: Initial identification and detailed modeling of the attack surface.

[0027] In the initial phase, the system first identifies all potential input points in the program. This invention establishes an attack surface classification system for modern software architectures, including multiple categories such as web request inputs, file system inputs, and network communication inputs, and uses automated static analysis tools for initial identification.

[0028] To compensate for the lack of semantic information in traditional control flow graphs (CFGs) or data flow graphs (DFGs), this method constructs line-of-speech comment nodes to perform fine-grained modeling of the attack surface. Each line-of-speech comment node not only contains the identifier of the variable or function but also encapsulates the complete text line information of that node in the source code. The structure of the line-of-speech comment node explicitly preserves the contextual semantics of the variable definition, including surrounding operators, data types (such as List, Dict, str), control structures, and function call relationships, providing a data foundation for subsequent feature extraction.

[0029] In implementation, the system of this embodiment first performs an initial static scan on the target software project. The scan applies pre-set heuristic attack surface identification rules and is executed using the static analysis tool CodeQL. The specific rules are shown in Table 1 below.

[0030] Table 1. Description of Data Source Types

[0031] This invention proposes and constructs a semantically rich underlying data structure—the line comment node (CLAN). Its specific definition is as follows.

[0032] Each CLAN node is defined as a structured tuple. The specific physical structure includes: a node identifier (recording the original name of the variable or function call and its unique index in the program) and the complete line of code (automatically capturing the complete text line where the node is located in the source code file). For example, if the variable `user_input` is detected, CLAN will record the entire line of code `user_input = request.args.get('name')`.

[0033] Step 1.2: Rule-based first-level filtering.

[0034] For the set of code line comment nodes generated in step 1.1, a pre-set heuristic rule set is applied to perform initial risk screening in order to quickly eliminate low-risk nodes that do not have the potential to be attacked.

[0035] This rule set is built upon a deep analysis of the inherent security attributes and attack surface characteristics of programming languages. It aims to quickly eliminate nodes that are semantically immune or logically incapable of serving as entry points for external threats through low-computational-cost static feature identification. Specifically, the rule set encompasses, but is not limited to, multi-dimensional judgments based on data attributes (such as eliminating literal constants and basic security types), control flow context (such as excluding exception handling logic), and operational behavior security (such as filtering built-in functions without side effects). By identifying the immutability, closure, and defensive semantics of data, it significantly reduces the scale of analysis while retaining potential threats.

[0036] After obtaining the CLAN set, the system applies a set of rules built upon the knowledge of security domain experts for initial screening. The implementation logic of this step is to use low-computational-cost rule matching to quickly eliminate low-risk nodes that are semantically immune or logically unable to withstand attack loads, thereby achieving the first convergence of the search space.

[0037] Specific filtering criteria: Constant and deterministic type elimination rules: Identify and eliminate all literal constants, such as fixed configuration strings and numbers, through static type inference. Simultaneously, eliminate variables inferred as secure basic types (such as bool, int, float), because these types are generally difficult for attackers to directly manipulate in dynamic languages ​​to inject malicious payloads.

[0038] Exception handling filtering rules: The system analyzes the control flow topology of the code to locate the scope of variable definitions. If a variable definition is located in the except branch of a try-except structure or in a dedicated logging error block, it is determined to be internal exception handling logic rather than an external business interface and is therefore excluded.

[0039] Auditing rules for functions with no side effects: Perform blacklist and whitelist filtering on function calls in code lines. If the line corresponding to a CLAN only contains built-in operations that have no system impact (such as len() to calculate length, print() to print information, type() to check type), and does not contain high-risk trigger words such as open, eval, and subprocess, it is considered a safe node.

[0040] Step 1.3: Second-level filtering based on Siamese networks.

[0041] For implicit risk nodes that cannot be covered by heuristic rules, this step implements deep semantic screening based on metric learning.

[0042] First, construct a composite semantic representation of the code. Vectorize the identifier content of the code line comment node formed in step 1.1 and its corresponding complete source code line to simultaneously capture local variable features and line-level context logic.

[0043] The representation is then fed into a Siamese neural network architecture consisting of two subnetworks with shared weights, with a core employing a multi-layer bidirectional long short-term memory network. BiLSTM accurately extracts long-distance dependencies in code sequences through bidirectional temporal modeling, mapping unstructured text into high-dimensional dense feature vectors.

[0044] During the training phase, a contrastive learning strategy and a contrastive loss function are adopted. By constructing positive and negative sample pairs, the geometric structure of the feature space is optimized, so that samples with similar vulnerability patterns are clustered in the space, while safe samples are pushed out of the marginal threshold.

[0045] In the final inference stage, a prototype matching mechanism based on the reference set is adopted to calculate the average semantic distance between the candidate node vector and the pre-set reference sample sets of "real attack surface" and "fake attack surface". Only when the candidate node is significantly close to the real attack surface reference set in the feature space and the distance is less than the judgment threshold, it is retained as a high confidence node in the candidate set, thereby achieving accurate capture of potential vulnerability entry points.

[0046] 1.3.1 Model architecture design.

[0047] This invention constructs a Siamese architecture consisting of two sub-networks with shared weights. The two sub-networks have identical structures and are used to map paired input code text to the same high-dimensional feature space.

[0048] Bidirectional Long Short-Term Memory (BiLSTM) Core Layer: Given the strong temporal logic and bidirectional dependency characteristics of the source code (e.g., the danger of a variable is often determined by both its preceding assignment and subsequent function call), this model employs a 4-layer bidirectional LSTM as the feature extraction engine. The bidirectional interpretation is as follows: Forward path: Captures the logical evolution of code from left to right.

[0049] Backward channel: Captures the right-to-left context constraints of the code.

[0050] Feature fusion logic: At the output of the BiLSTM layer, the model extracts the forward and backward hidden states from the last step and performs vector concatenation. This operation compresses the code snippet into a fixed-length dense vector that incorporates the bidirectional semantic features of the entire line.

[0051] 1.3.2 Sample construction and contrastive learning strategies.

[0052] Because real-world CVE vulnerability attack surface samples are relatively scarce, direct classification training can easily lead to overfitting. This invention employs a contrastive learning strategy, exponentially expanding the amount of training data by constructing sample pairs.

[0053] Positive sample pair construction: Randomly select two lines of code, both labeled as "real attack surface", from the real CVE vulnerability dataset of 2023, and form a pair with the label "0" (indicating similarity / same type).

[0054] Negative sample pair construction: Extract a "real attack surface" sample and a "non-vulnerability security noise" sample to form a pair labeled "1" (indicating dissimilarity / different type).

[0055] Data preprocessing: Code lines are tokenized using a custom tokenizer, and a vocabulary is constructed. During batch processing, padding techniques are used to ensure the consistency of code sequence lengths within the same batch, thereby adapting to the input requirements of BiLSTM.

[0056] 1.3.3. Contrast loss function based on Euclidean distance.

[0057] The goal of model training is not to directly predict the category, but to learn a kind of "distance". The system uses a contrastive loss function to optimize the geometric distribution of the feature space, and its mathematical logic is as follows:

[0058] Where d is the Euclidean distance between the two output vectors, Y is the label (0 for the same class, 1 for the different class), and m is the margin threshold (1.0 in this embodiment).

[0059] Optimization results: Through gradient descent, the model continuously "closes" the distance between positive sample pairs in the feature space and forces the distance between negative sample pairs to be pushed beyond the marginal threshold m. Ultimately, all potentially risky attack surface nodes will form a tight cluster in the feature space.

[0060] 1.3.4 Discriminative reasoning and high-confidence screening.

[0061] In the actual data mining process, the system uses a pre-trained model to perform automated screening. The specific steps are as follows: Reference set comparison: After vectorizing the candidate node to be tested, calculate the average Euclidean distance between it and the samples in the preset "vulnerability data source reference set".

[0062] Threshold determination: Set a threshold (e.g., 0.5). If the distance between the node under test and the data source of the vulnerability is within a very small range (i.e., highly similar), it is determined to be a high-risk node.

[0063] Output convergence: Remove all security noise that is far from the vulnerability data source in the feature space, and finally output a set of attack surfaces with high confidence.

[0064] 2. Multi-view data stream reconstruction module.

[0065] This module utilizes the semantic reasoning capabilities of large language models to repair data flow paths that are broken due to dynamic characteristics or other reasons in static analysis. This process is implemented through an iterative path expansion algorithm.

[0066] Step 2.1: Construction of basic data flow graph and identification of leading edge nodes.

[0067] This step aims to establish the basic framework for data flow analysis and locate the breakpoints in the data flow.

[0068] First, the system uses a high-confidence attack surface set, after deep screening, as the starting point for tracing. It then performs a full scan of the source code using static analysis tools to construct an initial basic data flow graph describing the propagation relationships of variables. After the graph structure is generated, a breadth-first search algorithm is used to traverse the graph hierarchically. By calculating the topological depth of nodes in the propagation path, nodes at the end of the path that have no subsequent outgoing edges under static semantics are accurately identified—these are the "frontier nodes." Logically, these nodes constitute the boundary of the current static analysis capability, representing the locations where data flow is interrupted due to dynamic language characteristics, implicit calls, or cross-module communication, providing clear inference targets for subsequent semantic completion.

[0069] This module first uses the high-confidence attack surface set output by Module 1 as seed points. These system calls are analyzed by a static analysis engine (in this embodiment, CodeQL is used as the analysis engine) to construct a basic data propagation model by parsing the abstract syntax tree of the source code. Under the current static semantic constraints, this model can plot the propagation path of variables in assignment statements, arithmetic operations, and explicit function calls.

[0070] This module introduces a leading node identification mechanism. A breadth-first search (BFS) algorithm is used to perform a topological hierarchical traversal of the generated basic graph structure. During the traversal, the system calculates the in-degree and out-degree of each node and monitors the data propagation status. Leading nodes are strictly defined as nodes that satisfy the following combined conditions: First, the out-degree of this node in the current data flow graph is zero; Second, this node is not a preset sensitive operation point; Third, the line of code corresponding to this node is not the logical end point of the program.

[0071] Step 2.2: Node expansion based on multi-perspective reasoning.

[0072] The core task of this step is to leverage the open semantic capabilities of large language models to detect and complete "implicit edges" that static analysis tools cannot identify.

[0073] The input to this step is the set of leading nodes at the propagation boundary in the current data flow graph, and the output is the newly discovered successor node and its corresponding connecting edge.

[0074] Specifically, the system traverses each leading node, extracts its code line context, and constructs structured prompts. It then requests the larger model to infer the next logical location (such as dynamic attribute assignment or asynchronous callbacks) from multiple perspectives, including library function behavior, framework distribution mechanisms, and implicit calls, thus compensating for the limitations of static analysis. To ensure robustness of the inference, this stage incorporates a multi-trial and deduplication mechanism, only incorporating logically sound and non-redundant new nodes into the graph structure, thereby achieving initial patching of data flow breakpoints.

[0075] This step leverages the semantic modeling capabilities of large language models to perform deep completion on breakpoints that static analysis cannot reach.

[0076] First, the system traverses each node in the set of leading nodes, extracting its associated line-of-speech annotations and the contextual semantics of its code snippets, constructing structured prompts which are then input into the large language model. The large language model leverages its deep understanding of programming language characteristics, standard library function behavior, and specific middleware framework logic to infer the implicit flow of data in a dynamic environment from multiple semantic perspectives, thereby identifying behaviors that are difficult to detect with traditional static tools, such as implicit function calls, reflection assignments, or automatically triggered data bindings. For the successor nodes predicted by the model, the system performs normalization and deduplication to generate a new set of nodes; subsequently, by establishing directed edges from the leading nodes to the newly predicted nodes in the original graph, the system achieves dynamic expansion and semantic stitching of the data flow graph structure.

[0077] This step is mainly based on the NodeExtend algorithm, whose core task is to detect and complete "implicit edges" that static analysis tools cannot identify.

[0078] Multi-perspective semantic reasoning process: against Each frontier node The system will perform the following detailed steps: Status check: First check Has it been expanded, or what is the current number of path nodes? Has the set threshold `MAX_NODE_IN_PATH` been reached (to prevent path explosion)?

[0079] LLM Interaction and Retry Mechanism: The system will... The code context is constructed as a Prompt submitted to the large language model. To ensure robustness of inference, the system sets a maximum number of retries, `MAX_RETRY`. The LLM will analyze from multiple perspectives. The data may flow to predict implicit successor nodes.

[0080] Successor node verification and deduplication: The predicted candidate nodes are processed by the deduplicate function, and the system verifies whether these nodes already exist in the original graph. or current extended set In this process, we ensure that no redundant loops are generated.

[0081] Graph update mapping: Once a valid successor node is determined... The system will add nodes to the graph. And establish directed edges This process captures the propagation logic obscured by dynamic dispatching, complex branching, or library abstraction layers, connecting the originally fragmented image segments.

[0082] Step 2.3: Iterative path expansion (path expansion algorithm).

[0083] By adopting a recursive, hierarchical strategy, the aforementioned node expansion capabilities are transformed into a systematic path search.

[0084] The input to this step is the initial fragmented data flow graph, and the output is an enhanced data flow graph that covers the entire graph.

[0085] Specifically, the system first initiates step 2.2, node expansion, to identify newly discovered data flow nodes. Then, static analysis tools (such as CodeQL) are immediately invoked to use these starting points as a baseline to uncover continuous propagation paths with deterministic logic within the code. After each round of hybrid expansion, the system uses breadth-first search (BFS) to recalculate the propagation depth of the entire graph and accurately locates the new leading edge node at the furthest point, thus initiating the next iteration. This cycle continues until a preset limit on the number of expansions, node size limitations, or the inability to predict new nodes is met. This spiraling upward strategy effectively stitches together discrete code fragments into a complete vulnerability chain across modules.

[0086] Through the cascading operation of the above two stages, this invention can bridge the parsing gap of dynamic languages, transforming the originally damaged path into an enhanced data flow graph with high connectivity, providing a complete chain of evidence for subsequent vulnerability verification.

[0087] To achieve complete coverage of deep vulnerability propagation paths in software projects, this step adopts an iterative expansion strategy that alternates between static analysis and large-scale model reasoning. The core motivation for this design is to use the "determinism" of static analysis to verify the "possibility" of large-scale model reasoning, and to use the "semantic insight" of the large-scale model to overcome the "logical breakpoints" of static analysis.

[0088] First, the system uses the new nodes predicted by the model in the previous stage as the starting point for subsequent analysis, restarting the static analysis tool to uncover the propagation paths of these new nodes with deterministic logic in the code space. By continuously updating the topology of the global data flow graph and relocating new leading-edge breakpoints, the system constructs an alternating ascending evolutionary loop: the endpoint of each step of static tracing becomes the starting point for the next model inference, while each semantic completion of the model opens up new areas of exploration for static analysis. To balance analysis depth and computational overhead, this iterative process is controlled by a termination mechanism that includes expansion frequency limits, node size thresholds, and inference validity judgments. This cyclical strategy aims to break the limitations of single analysis methods, ultimately stitching fragmented code snippets into a connected and fully covered enhanced data flow graph, providing solid data support for discovering complex vulnerability chains across functions and modules.

[0089] This step is based on the PathExtend algorithm. The PathExtend algorithm is built on top of NodeExtend and implements a recursive, hierarchical graph expansion strategy designed to systematically cover complex propagation paths.

[0090] 2.3.1 Re-intervention of static analysis.

[0091] After the initial NodeExtend extension is completed, the system will acquire a new set of nodes. In order to take advantage of the determinism of static analysis, the algorithm will... Each newly discovered node in the graph calls the `run_codeql` function. This means the system uses the new position "guessed" by the model as the new starting point for static scanning, and then mines a specific code logic propagation path (generating a subgraph). and ), and incorporate it into the main image.

[0092] 2.3.2. Hierarchical evolution based on depth perception.

[0093] After each round of hybrid expansion (LLM inference + static scanning), the system rebuilds the global graph. Subsequently, the algorithm performs a breadth-first search traversal, calculating the depth of all nodes in the graph relative to the source node.

[0094] Locating the farthest frontier: The system calculates the maximum depth of the current graph. The nodes at that depth are extracted to form the latest frontier node set for the next round of iteration. .

[0095] Recursive iteration: A new round Enter NodeExtend again for reasoning, forming a spiral upward process of "reasoning - scanning - re-reasoning".

[0096] 2.3.3 Convergence control and termination conditions.

[0097] To ensure the feasibility and efficiency of the algorithm, PathExtend is subject to a triple termination condition: 1. Extension count limit: The maximum number of extension rounds can be reached (MAX_EXTEND_TIMES).

[0098] 2. Size limit: The total number of graph nodes exceeds the predefined threshold MAX_NODE_IN_PATH.

[0099] 3. Result convergence: LLM is unable to find any new valid successor nodes ( (Empty).

[0100] 2.3.4 Module Implementation Results and Outputs By iteratively using NodeExtend and PathExtend, this invention gradually transforms fragmented basic data flow graphs into connected and fully covered enhanced data flow graphs. This diagram not only compensates for the shortcomings of static analysis in handling string concatenation, conditional branching, and multi-level variable reassignment, but also reveals hidden propagation paths across function and module boundaries. The final generated... This provides a high-quality, high-confidence logical basis for the multi-agent vulnerability verification in the subsequent Module 3, significantly improving the detection accuracy and depth of vulnerability mining in complex software systems.

[0101] 3. Vulnerability verification module based on multi-agent system.

[0102] This module introduces a multi-agent system and combines it with the CWE (General Defect Enumeration) knowledge base to automate the auditing of enhanced data flow graphs.

[0103] Step 3.1: Sensitive operation identification.

[0104] This step primarily involves identifying sensitive operations on the completed data flow graph.

[0105] Specifically, the configuration agent (Sink-Analyzer) is responsible for scanning all path-end nodes in the enhanced data flow graph $G_{final}$. During inference, the agent combines its built-in Common Vulnerability Enumeration (CWE) classification knowledge (covering common vulnerability features such as SQL injection and command execution) to deeply analyze whether these end nodes constitute potential sensitive operations (Sinks). The final output includes the ID of the sensitive operation node, the corresponding CWE number, and the preliminary judgment criteria; if no sensitive operation node is found after scanning, the current detection process ends directly.

[0106] This step is performed by an agent configured as a "code security expert" to accurately pinpoint risk convergence points from the completed, enhanced data flow graph.

[0107] 3.1.1 Construction of expert prompts.

[0108] The system provides agents with highly integrated structured prompts, including: CWE Knowledge Base: Covers concise definitions of several typical vulnerabilities, including SQL injection and command execution. Users can add configurations based on the types of vulnerabilities they wish to review.

[0109] CLAN node set: Provides semantically rich nodes that preserve the original code line text.

[0110] Explicit topology: Clearly define the dependencies between nodes to ensure connectivity for data tracing.

[0111] 3.1.2 Reasoning and Structured Output: The agent analyzes whether data enters a dangerous function during its flow. The conclusion is returned in JSON format, explicitly recording the ID of the suspected Sink node, its corresponding CWE category, and the reason for the judgment. If no Sink node is found, an empty JSON is output. This process compensates for the limitations of static tools in identifying custom risk functions through expert semantics.

[0112] Step 3.2, vulnerability exploitability verification.

[0113] This step will integrate the complete data flow diagram, data flow source points, and sensitive operation points to conduct the final verification of the vulnerability.

[0114] Specifically, a second agent (Vul-Verifier) ​​is configured to act as a security expert, performing a final audit of the entire propagation chain from the "data flow source" to the "sensitive operation point." During inference, the agent comprehensively analyzes the contextual semantics of the entire data flow path, focusing on checking whether there are key factors on the path that could prevent the vulnerability from being triggered, such as whether it has undergone effective data sanitization functions or been subject to strict conditional constraints. Finally, the agent outputs a structured JSON report, clearly determining whether the path constitutes a real exploitable vulnerability.

[0115] The second agent is responsible for the final review of the candidate data flow graphs. Its core task is to eliminate false positive cases with security protection through global context review and verify the exploitability of vulnerabilities.

[0116] (1) Full-link semantic decision-making: This step inherits all path information from the previous stage and backtracks backward from the identified candidate sensitive operation points. The agent focuses on analyzing whether there is data purification logic such as regular expression validation, HTML escaping or forced type conversion on the path, and whether the environmental constraints allow the vulnerability to be triggered.

[0117] (2) Interpretability Decision Output: To ensure the credibility of the conclusion, the agent adopts the "explain first, then decide" mode, and the generated JSON report includes: Explanation: This section details the reasoning process for the full-path protection logic.

[0118] is_vulnerable: The final boolean conclusion confirming the vulnerability.

[0119] sink_is_false_positive: explicitly marks whether the sensitive operation point is real and valid.

[0120] In this embodiment, a computer device is provided, such as... Figure 3 As shown, it includes a memory 301, a processor 302, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned software vulnerability mining methods based on static analysis and size model collaboration.

[0121] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0122] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the above-described software vulnerability discovery methods based on static analysis and size model collaboration.

[0123] Specifically, computer-readable storage media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media do not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] Based on the same inventive concept, this invention also provides a software vulnerability mining apparatus based on static analysis and size model collaboration, as described in the following embodiments. Since the principle of the software vulnerability mining apparatus based on static analysis and size model collaboration is similar to that of the software vulnerability mining method based on static analysis and size model collaboration, the implementation of the software vulnerability mining apparatus based on static analysis and size model collaboration can refer to the implementation of the software vulnerability mining method based on static analysis and size model collaboration, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0125] Figure 4 This is a structural block diagram of a software vulnerability mining device based on static analysis and size model collaboration according to an embodiment of the present invention, such as... Figure 4 As shown, it includes: a confidence node construction module 401, a data flow reconstruction module 402, and a vulnerability verification module 403. The structure is described below.

[0126] A confidence node module 401 is constructed to identify and classify the attack surface, generate a set of line comment nodes, perform a first-level filtering on the set of line comment nodes based on rules, generate a set of comment nodes after one-level filtering, and perform a second-level filtering on the set of comment nodes after one-level filtering based on a Siamese neural network to generate a set of high-confidence attack surfaces. The data flow reconstruction module 402 is used to take the high-confidence nodes in the high-confidence attack surface set as the tracing starting point, perform data flow analysis, generate a basic data flow graph, obtain a frontier node set through static analysis based on the basic data flow graph, expand the frontier node set through a large language model and path expansion algorithm, and generate a completed data flow graph. The vulnerability verification module 403 is used for a multi-agent-based vulnerability verification method to detect vulnerabilities based on the completed data flow graph and obtain the results of software vulnerability discovery.

[0127] In one embodiment, constructing a confidence node module includes: The static scanning unit is used to perform static scanning on the target software project, identify all potential input points based on a preset attack surface classification system, and generate corresponding code line comment nodes for each potential input point. A unit for generating a set of comment nodes is used to encapsulate the identifier of a variable or function and the complete text line information of the encapsulated variable or function in the source code in the code line comment node, thereby generating a set of code line comment nodes; A heuristic rule set unit is set up to define a heuristic rule set, wherein the heuristic rule set includes one or more rules among the following: removing literal constants and variables that are statically inferred to be of a safe basic type; removing variable definition nodes located within exception handling structures; and removing nodes that contain only built-in function calls that have no system impact. A primary filtering unit is used to perform a first-level risk filtering on the code line comment node set based on the heuristic rule set, eliminating low-risk nodes and generating a post-filtered comment node set.

[0128] In one embodiment, constructing the confidence node module further includes: A feature vector generation unit is used to vectorize the identifier content and complete source code of each node in the set of annotated nodes after the first filtering, and generate a composite semantic feature vector corresponding to each node. A Siamese network building unit, used to construct a Siamese neural network based on two subnetworks sharing weights; The average semantic distance calculation unit is used to input the composite semantic feature vector into the trained Siamese neural network, perform inference on the nodes in the set of annotated nodes after one filtering, and calculate the average semantic distance between the output vector of each node and a preset vulnerability data source reference set. A high-confidence attack surface unit is obtained, which is used to identify nodes whose average semantic distance is less than a preset judgment threshold as high-risk nodes, and to generate the high-confidence attack surface set by combining all high-risk nodes.

[0129] In one embodiment, the Siamese network construction unit is further configured to construct two weight-shared sub-networks, each of which uses a multi-layer bidirectional long short-term memory network as the core feature extractor. The Siamese neural network is used to extract bidirectional long-distance dependent semantic features from the code sequence and output a high-dimensional dense vector. Based on vulnerability samples labeled as real attack surfaces and non-vulnerability security noise samples, training data consisting of positive sample pairs and negative sample pairs is constructed, and the Siamese neural network is trained based on the training data. The Siamese neural network is optimized using a contrastive loss function, such that the Euclidean distance between positive sample pairs in the feature space is reduced, and the distance between negative sample pairs is increased to a preset marginal threshold.

[0130] In one embodiment, the data stream reconstruction module includes: The leading edge node unit is used to identify all nodes with zero out-degree and non-sensitive operations from the basic data flow graph, forming a leading edge node set; An implicit successor node generation unit is used to generate an implicit successor node set. For each front node in the front node set, static analysis is performed to extract the code context information of the front node, which is then input into a large language model for semantic reasoning and prediction to generate an implicit successor node set. The preliminary expansion unit is used to merge the set of implicit successor nodes into the basic data flow graph and establish directed edges from the leading edge node to the corresponding successor node to obtain the preliminary expanded data flow graph. The further expansion unit is used to re-execute static analysis based on the initially expanded data flow graph to explore the propagation path of the newly added nodes, and iteratively execute the expansion until the termination condition is met, thereby generating the completed data flow graph.

[0131] In one embodiment, the implicit successor node set generation unit is further configured to perform the following steps for each front node in the front node set to obtain an implicit successor node, until all front nodes are processed to generate an implicit successor node set: determining whether the current front node has been expanded and whether the number of nodes in the current propagation path has reached a preset threshold; if it has not been expanded and has not reached the preset threshold, extracting the code line comment node information corresponding to the current front node and the contextual semantics of the code segment where the current front node is located, and constructing structured prompt information through the code line comment node information and the contextual semantics; inputting the prompt information into a large language model, and obtaining the possible flow of data from multiple perspectives through the large language model, and predicting one or more implicit successor nodes based on the possible flow of data; and removing duplicate nodes from the predicted implicit successor nodes.

[0132] In one embodiment, the vulnerability verification module includes: Configure a first intelligent agent unit to configure the first intelligent agent as a sensitive operation analyzer and input the completed data flow graph into the first intelligent agent; A first structured report unit is generated, which is used to scan the end nodes of all paths in the completed data flow graph in the first agent, analyze whether the end nodes constitute sensitive operations through a general defect enumeration knowledge base, and output a first structured report, wherein the first structured report includes the identifier of the sensitive operation node and the defect type corresponding to the sensitive operation node. Configure a second intelligent agent unit to configure the second intelligent agent as a vulnerability verifier, and input the completed data flow graph and the first structured report into the second intelligent agent; A second structured report unit is generated for the second agent to backtrack from the sensitive operation node to the data flow source point for each of the sensitive operation nodes identified in the first structured report, analyze the contextual semantics of the complete propagation path, check whether there is data purification processing or condition constraints on the complete propagation path, and output a second structured report. For each analyzed complete propagation path, the second structured report includes the vulnerability exploitability determination result and the determination reason. A vulnerability analysis result generation unit is used to obtain the discovery results of the software vulnerability based on the second structured report.

[0133] The embodiments of the present invention achieve the following technical effects: In an evaluation involving 75 real-world Python projects, the software vulnerability discovery method of this invention achieved a detection rate of 81.33%, significantly improving performance compared to mainstream static analysis tool CodeQL (56.00%) and similar dataflow method IRIS (30.67%). This effectively solves the problem of high false negative rates in complex software and greatly improves vulnerability detection coverage. By using large-model semantic reasoning to complete broken paths, it solves the problem of data flow interruption caused by implicit calls and dynamic typing in dynamic languages. Ablation experiments show that removing this mechanism causes the detection rate to plummet to 49.33%, demonstrating its crucial role in discovering deep vulnerabilities and overcoming the bottleneck of data flow interruption. The introduction of a semantically enhanced attack surface filtering mechanism reduces the number of original candidate attack surfaces by approximately 45% (from 25,252 to 13,905). This not only significantly reduces analysis overhead but also eliminates a large number of low-risk entry points at the source, improving detection accuracy and reducing computational costs and false positives. Finally, a large model is used to generate a natural language report containing vulnerability causes and CWE classifications. In the CVE-2024-22203 detection example, the generated explanation was highly consistent with the official description, significantly lowering the threshold for manual auditing and remediation and enhancing interpretability.

[0134] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0135] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A software vulnerability discovery method based on static analysis and size model collaboration, characterized in that, include: The attack surface is identified and classified, a set of line comment nodes is generated, the set of line comment nodes is filtered firstly based on rules, a set of comment nodes after one filtering is generated, and the set of comment nodes after one filtering is filtered secondly based on Siamese neural network to generate a set of high-confidence attack surfaces. Using the high-confidence nodes in the high-confidence attack surface set as the starting point for tracing, data flow analysis is performed to generate a basic data flow graph. Based on the basic data flow graph, a set of leading nodes is obtained through static analysis. The set of leading nodes is then expanded using a large language model and path expansion algorithm to generate a complete data flow graph. The multi-agent-based vulnerability verification method detects vulnerabilities based on the completed data flow graph to obtain the results of software vulnerability discovery.

2. The software vulnerability mining method based on static analysis and size model collaboration as described in claim 1, characterized in that, Identify and classify attack surfaces, generate a set of line-of-speech comment nodes, and perform a first-level filtering on the set of line-of-speech comment nodes based on rules to generate a set of comment nodes after the first filtering, including: Static scanning is performed on the target software project, and all potential input points are identified based on a preset attack surface classification system. A corresponding code line comment node is generated for each potential input point. The code line comment node encapsulates the identifier of the variable or function and the complete text line information of the encapsulated variable or function in the source code, generating a set of code line comment nodes; Define a heuristic rule set, wherein the heuristic rule set includes one or more of the following rules: remove literal constants and variables that are statically inferred to be of a safe basic type; remove variable definition nodes located within exception handling structures; and remove nodes that contain only built-in function calls that have no system impact. Based on the heuristic rule set, the code line comment node set is subjected to a first-level risk filtering to remove low-risk nodes, generating a post-filtered comment node set.

3. The software vulnerability mining method based on static analysis and size model collaboration as described in claim 1, characterized in that, A second level of filtering is performed on the annotated node set after the first filtering based on a Siamese neural network to generate a high-confidence attack surface set, including: The identifier content and complete source code of each node in the set of annotated nodes after the first filtering are vectorized to generate a composite semantic feature vector corresponding to each node. Construct a Siamese neural network based on two subnetworks sharing weights; The composite semantic feature vector is input into the trained Siamese neural network to infer the nodes in the set of annotated nodes after one filtering, and the average semantic distance between the output vector of each node and a preset vulnerability data source reference set is calculated. Nodes whose average semantic distance is less than a preset threshold are identified as high-risk nodes. All high-risk nodes are combined to generate the high-confidence attack surface set.

4. The software vulnerability mining method based on static analysis and size model collaboration as described in claim 3, characterized in that, Constructing a Siamese neural network based on two subnetworks sharing weights includes: Two weight-sharing sub-networks are constructed, each of which uses a multi-layer bidirectional long short-term memory network as the core feature extractor. The Siamese neural network is used to extract bidirectional long-distance dependent semantic features from the code sequence and output a high-dimensional dense vector. Based on vulnerability samples and non-vulnerability security noise samples labeled as real attack surfaces, training data consisting of positive sample pairs and negative sample pairs is constructed, and the Siamese neural network is trained based on the training data. The Siamese neural network is optimized using a contrastive loss function, which reduces the Euclidean distance between positive sample pairs in the feature space and increases the distance between negative sample pairs beyond a preset marginal threshold.

5. The software vulnerability mining method based on static analysis and size model collaboration as described in claim 1, characterized in that, Based on the aforementioned basic data flow graph, a set of leading nodes is obtained through static analysis. This set of leading nodes is then expanded using a large language model and path expansion algorithm to generate a complete data flow graph, including: Identify all nodes with zero out-degree and non-sensitive operations from the basic data flow graph to form a frontier node set; For each front node in the set of front nodes, static analysis is performed to extract the code context information of the front node, which is then input into a large language model for semantic reasoning and prediction to generate an implicit successor node set. The implicit successor node set is merged into the basic data flow graph, and directed edges are established from the leading edge node to the corresponding successor node to obtain the preliminary expanded data flow graph. Based on the initially expanded data flow graph, static analysis is re-executed to uncover the propagation path of the newly added nodes, and the expansion is iteratively executed until the termination condition is met, generating the completed data flow graph.

6. The software vulnerability mining method based on static analysis and size model collaboration as described in claim 5, characterized in that, For each front node in the aforementioned front node set, static analysis is performed to extract the code context information of the front node, which is then input into a large language model for semantic reasoning and prediction, generating an implicit successor node set, including: For each front node in the set of front nodes, perform the following steps to obtain an implicit successor node, until all front nodes have been processed, generating a set of implicit successor nodes: Determine whether the current leading edge node has been expanded, and determine whether the number of nodes in the current propagation path has reached a preset threshold; If it is not expanded and the preset threshold is not reached, extract the code line comment node information corresponding to the current leading edge node and the context semantics of the code segment where the current leading edge node is located, and construct structured prompt information through the code line comment node information and the context semantics; The prompt information is input into a large language model, and the possible flow of data is obtained from multiple perspectives through the large language model. Based on the possible flow of data, one or more implicit successor nodes are predicted. Duplicate nodes are removed from the predicted implicit successor nodes.

7. The software vulnerability discovery method based on static analysis and size model collaboration as described in any one of claims 1 to 6, characterized in that, The multi-agent-based vulnerability verification method detects vulnerabilities based on the completed data flow graph to obtain software vulnerability discovery results, including: Configure the first agent as a sensitive operation analyzer and input the completed data flow graph into the first agent; In the first intelligent agent, the end nodes of all paths in the completed data flow graph are scanned, and the end nodes are analyzed to determine whether they constitute sensitive operations through a general defect enumeration knowledge base. A first structured report is then output, wherein the first structured report includes the identifier of the sensitive operation node and the defect type corresponding to the sensitive operation node. Configure a second agent as a vulnerability verifier and input the completed data flow graph and the first structured report into the second agent; In the second intelligent agent, for each of the sensitive operation nodes identified in the first structured report, the agent traces back from the sensitive operation node to the data flow source point, analyzes the contextual semantics of the complete propagation path, checks whether there is data purification processing or condition constraints on the complete propagation path, and outputs a second structured report. For each of the analyzed complete propagation paths, the second structured report includes the determination result and reason for the vulnerability exploitability. Based on the second structured report, the results of the software vulnerability discovery are obtained.

8. A software vulnerability discovery device based on static analysis and size model collaboration, characterized in that, include: A confidence node module is constructed to identify and classify the attack surface, generate a set of line comment nodes, perform a first-level filtering on the set of line comment nodes based on rules, generate a set of comment nodes after one-level filtering, and perform a second-level filtering on the set of comment nodes after one-level filtering based on a Siamese neural network to generate a set of high-confidence attack surfaces. The data flow reconstruction module is used to take the high-confidence nodes in the high-confidence attack surface set as the tracing starting point, perform data flow analysis, generate a basic data flow graph, obtain a frontier node set through static analysis based on the basic data flow graph, and expand the frontier node set through a large language model and path expansion algorithm to generate a complete data flow graph. The vulnerability verification module is used for a multi-agent-based vulnerability verification method to detect vulnerabilities based on the completed data flow graph and obtain the results of software vulnerability discovery.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the software vulnerability mining method based on static analysis and size model collaboration as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the software vulnerability discovery method based on static analysis and size model collaboration as described in any one of claims 1 to 7.

Images