Method and device for realizing static analysis safety research, judgment and positioning based on artificial intelligence, processor and computer readable storage medium thereof

Abstract

The invention relates to a method for realizing static analysis safety research, judgment and positioning based on artificial intelligence, which comprises the following steps of: calling a multi-source heterogeneous static analysis tool to obtain a multi-source heterogeneous analysis result; performing format conversion and standardization processing on output results of the multi-source heterogeneous static analysis tool; performing semantic analysis, false alarm suppression and thinking chain reasoning on the standardized structure data based on a locally deployed large language model; carrying out aggregation processing on the analysis result; and displaying or exporting the high-confidence result content. By the adoption of the method and device for achieving static analysis safety research, judgment and positioning based on artificial intelligence, the processor and the computer readable storage medium of the processor, the false alarm rate is obviously reduced, the accuracy rate of key high-risk problems is remarkably increased, the problem positioning speed is greatly increased, interpretability is enhanced, and safety audit and compliance recording are facilitated; the method is high in adaptability, supports privacy and compliance guarantee, carries out full-link localized reasoning, and can effectively avoid the risk of source code leakage.

Description

Technical Field

[0001] This invention relates to the field of software security, and more particularly to the field of artificial intelligence technology. Specifically, it relates to a method, apparatus, processor, and computer-readable storage medium for static analysis security assessment and location based on artificial intelligence. Background Technology

[0002] 1. Static analysis techniques In the field of software development, static analysis is a technique that automatically analyzes source code without running the program. It is primarily used to detect potential problems in the code, such as syntax errors, security vulnerabilities, inconsistent coding style, and performance issues. Static analysis is widely used in code quality assurance, security auditing, and code style checks.

[0003] Static analysis techniques include: Syntax Analysis, Semantic Analysis, Data Flow Analysis, Control Flow Analysis, Pattern Matching, and Type Checking.

[0004] Static analysis can be applied in various scenarios, including: code quality assurance (detecting style issues, duplicate code, excessive complexity, etc.), security vulnerability detection (such as buffer overflows, SQL injection, XSS, CSRF, etc.), code style checks (such as Google CodeStyle, PEP8, ESLint, etc.), as well as automated testing, code structure analysis, and refactoring support.

[0005] Traditional static security testing tool SAST can find potential defects in large-scale codebases, but it generally suffers from the following problems: First, the false alarm rate is high: the semantics of framework routing, template engine, ORM, deserialization, and security encapsulation cannot be effectively understood, resulting in a large number of "possible" or "suspected" alarms.

[0006] Second, it has poor operability: alarms lack a credible evidence chain of upstream and downstream data flows, requiring security personnel to conduct time-consuming manual backtracking and environmental reproduction experiments. Third, it is difficult to distinguish importance: different alarms have large differences in business exposure, availability, and reachability, and the rule weights of traditional tools are difficult to reflect the actual risks.

[0007] Fourth, the projects are heterogeneous: the PHP and Java ecosystem frameworks are complex (such as Laravel, Symfony, Spring, MyBatis, Struts, etc.), making SAST rule adaptation difficult and cross-language and cross-framework models unstable.

[0008] Fifth, insufficient data loop: experience with false positives and true positives is difficult to be transformed into structured knowledge, making it impossible to continuously reduce the false positive rate.

[0009] Existing improvement methods mostly rely on rule tuning, taint analysis enhancement, or simple statistical learning post-processing, which still struggle to handle complex semantics, framework conventions, and comprehensive judgments of cross-file or cross-layer data streams, and cannot quickly identify key exploitable issues in large-scale scan results.

[0010] While commercial static analysis tools generally possess strong semantic analysis capabilities, enabling them to identify complex vulnerabilities (such as SQL injection, XSS, and buffer overflows), and can more accurately identify vulnerabilities with a relatively low false positive rate through semantic and control flow analysis, false positives may still occur in certain complex scenarios, requiring manual verification.

[0011] 2. Large Language Model Large Language Models (LLMs) are natural language processing models based on deep learning techniques. They are trained on large-scale text data to learn the structure, semantics, and contextual relationships of language, enabling various natural language processing tasks such as text generation, question answering, translation, and summarization. The core idea is to pre-train the model on massive amounts of data to equip it with broad language understanding and generation capabilities, and then fine-tune it to adapt to specific tasks. The emergence of LLMs has greatly propelled the advancement of artificial intelligence in the field of natural language processing, and they are widely used in areas such as intelligent customer service, content creation, and data analysis.

[0012] Large language models offer certain advantages in vulnerability analysis and assessment, but they also have significant limitations. Their advantages primarily lie in: first, their powerful natural language understanding capabilities, enabling efficient parsing of vulnerability descriptions, technical reports, and security bulletins, thus improving information processing efficiency; second, their knowledge transfer capabilities, allowing them to acquire rich security domain knowledge through large-scale text training, aiding in the identification of potential vulnerability patterns; and third, their support for multilingual processing, adapting to diverse vulnerability information sources globally. However, their disadvantages are equally significant: first, a lack of in-depth understanding of the underlying system and code execution makes it difficult to accurately assess the actual impact and exploitability of vulnerabilities; second, training data may be biased or outdated, leading to insufficient ability to identify new types of vulnerabilities; and third, a lack of interpretability makes it difficult to provide clear analytical evidence, affecting the credibility of decisions. Therefore, large language models are primarily used as auxiliary tools in vulnerability analysis and should be used in conjunction with traditional security analysis methods. Summary of the Invention

[0013] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, apparatus, processor and computer-readable storage medium for static analysis security assessment and positioning based on artificial intelligence, which has the advantages of low false alarm rate, strong interpretability and wide applicability.

[0014] To achieve the above objectives, the present invention provides a method, apparatus, processor, and computer-readable storage medium for static analysis security assessment and location based on artificial intelligence, as follows: The main feature of this method for static analysis-based security assessment and location based on artificial intelligence is that the method includes the following steps: (1) Call the multi-source heterogeneous static analysis tool, execute the scanning task according to the preset analysis rules, and obtain the multi-source heterogeneous analysis results; (2) The output results of the multi-source heterogeneous static analysis tool are converted and standardized respectively to obtain standardized static analysis results; (3) Based on the locally deployed large language model, perform semantic analysis, false alarm suppression and thought chain reasoning on standardized structured data, and output analysis results and confidence scores; (4) Aggregate the analysis results to obtain the high-confidence results of the analyzed object; (5) Display or export the above high confidence results.

[0015] Preferably, step (3) specifically includes the following steps: (3.1) Constructing and managing false alarm datasets; (3.2) Perform chain reasoning and self-consistency check; (3.3) Generate a chain of evidence and perform lightweight reachability verification; (3.4) Classify and rank the problem risks to obtain a composite risk score.

[0016] Preferably, step (3.1) specifically includes: A false alarm sample library was built, covering typical false alarm scenarios; a swing case mining strategy was adopted to actively learn and manually annotate use cases with ambiguity or risk of misjudgment.

[0017] Preferably, step (3.2) specifically includes the following steps: (3.2.1) Apply the preset prompt template sequence to the large language model deployed locally, perform multi-stage reasoning on each alarm message, and obtain the judgment result; (3.2.2) Perform a self-consistency check on the judgment results and output the judgment results and confidence scores.

[0018] Preferably, step (3.3) specifically includes the following steps: (3.3.1) Based on the external input points, the calls to dangerous functions, and the data flow path, output a complete chain of evidence from the source to the destination; (3.3.2) Automatically generate the minimum exploitation conditions and the corresponding pseudo-simulation exploitation scripts, and verify them through lightweight dynamic verification methods.

[0019] Preferably, step (3.4) specifically includes the following steps: Based on different AI analysis strategies and project categories, the system intelligently filters target CWE types, ranks them by risk priority, differentiates priorities according to strategies, and performs a comprehensive ranking based on confidence scores.

[0020] Preferably, step (4) specifically includes the following steps: The order in which CWEs are processed is determined based on the assessment of priority strategies; Locate the problem point in the same line of code within the same CWE type target file; Based on the confidence strategies of different rule types and combined with confidence intervals, high-confidence results of the analyzed objects are output.

[0021] The system for static analysis, security assessment, and location based on artificial intelligence, which implements the above method, is characterized by the following: The heterogeneous tool invocation module is used to invoke multi-source heterogeneous static analysis tools to perform analysis tasks on the target and obtain output results; The multi-source result standardization module is connected to the heterogeneous tool calling module and is used to adapt the data results of different tools and convert them into a standardized format. The false alarm dataset module, connected to the multi-source result standardization module, is used to collect and accumulate typical cases, covering typical false alarm patterns of static analysis tools.

[0022] The thought chain reasoning and self-consistency check module is connected to the false alarm dataset module and is used to perform thought chain reasoning and self-consistency check. The evidence chain generation and lightweight reachability verification module is connected to the thought chain reasoning and self-consistency check module to intelligently generate pseudo PoCs and perform lightweight dynamic verification. The problem risk classification and ranking module is connected to the evidence chain generation and lightweight accessibility verification module. It is used to intelligently classify and rank the problem risks with vulnerabilities in the assessment results under the strategy specified by the user. The display and output module, connected to the problem risk classification and ranking module, is used to display the analysis status of multi-source heterogeneous tools, static analysis results, AI judgment results, and aggregated AI judgment results.

[0023] The device for static analysis, security assessment, and location based on artificial intelligence is characterized in that it includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the above-described method for static analysis security assessment and location based on artificial intelligence.

[0024] The processor for static analysis security assessment and location based on artificial intelligence is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for static analysis security assessment and location based on artificial intelligence are implemented.

[0025] The main feature of this computer-readable storage medium is that it stores a computer program that can be executed by a processor to implement the various steps of the above-described method for static analysis security assessment and location based on artificial intelligence.

[0026] The present invention employs an artificial intelligence-based method, apparatus, processor, and computer-readable storage medium for static analysis security assessment and location. This significantly reduces the false alarm rate, reducing manual review workload by 50-80% in enterprise-level projects and significantly improving the accuracy of critical high-risk issues. Problem location speed is greatly improved, automatically outputting evidence chains and pseudo-Proof-of-Concept (PoC), shortening the average time from analysis to action. Interpretability is enhanced, with auditable and traceable reasoning processes and justifications, facilitating security audits and compliance records. It boasts strong adaptability, supporting contextual understanding of mainstream PHP and Java frameworks and unified processing of results across tools. Privacy and compliance are guaranteed through end-to-end localized reasoning, effectively avoiding the risk of source code leakage. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the overall architecture of the system for static analysis, security assessment, and location based on artificial intelligence, according to the present invention.

[0028] Figure 2 This is a flowchart illustrating the standardization of result processing and semantic context generation for the method of static analysis security assessment and location based on artificial intelligence, as presented in this invention.

[0029] Figure 3 This is a flowchart illustrating the false alarm dataset construction process for the method of static analysis security assessment and location based on artificial intelligence, as described in this invention.

[0030] Figure 4 This is a flowchart of the thought chain reasoning and self-consistency check process for the method of static analysis security assessment and positioning based on artificial intelligence according to the present invention.

[0031] Figure 5 This is a flowchart illustrating the evidence chain generation and lightweight accessibility verification process of the method for static analysis security assessment and location based on artificial intelligence, as presented in this invention.

[0032] Figure 6 This is a schematic diagram of the risk scoring and ranking model of the method for static analysis security assessment and location based on artificial intelligence according to the present invention. Detailed Implementation

[0033] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0034] The present invention provides a method for static analysis security assessment and location based on artificial intelligence, comprising the following steps: (1) Call the multi-source heterogeneous static analysis tool, execute the scanning task according to the preset analysis rules, and obtain the multi-source heterogeneous analysis results; (2) The output results of the multi-source heterogeneous static analysis tool are converted and standardized respectively to obtain standardized static analysis results; (3) Based on the locally deployed large language model, perform semantic analysis, false alarm suppression and thought chain reasoning on standardized structured data, and output analysis results and confidence scores; (4) Aggregate the analysis results to obtain the high-confidence results of the analyzed object; (5) Display or export the above high confidence results.

[0035] In a preferred embodiment of the present invention, step (3) specifically includes the following steps: (3.1) Constructing and managing false alarm datasets; (3.2) Perform chain reasoning and self-consistency check; (3.3) Generate a chain of evidence and perform lightweight reachability verification; (3.4) Classify and rank the problem risks to obtain a composite risk score.

[0036] In a preferred embodiment of the present invention, step (3.1) specifically comprises: A false alarm sample library was built, covering typical false alarm scenarios; a swing case mining strategy was adopted to actively learn and manually annotate use cases with ambiguity or risk of misjudgment.

[0037] In a preferred embodiment of the present invention, step (3.2) specifically includes the following steps: (3.2.1) Apply the preset prompt template sequence to the large language model deployed locally, perform multi-stage reasoning on each alarm message, and obtain the judgment result; (3.2.2) Perform a self-consistency check on the judgment results and output the judgment results and confidence scores.

[0038] In a preferred embodiment of the present invention, step (3.3) specifically includes the following steps: (3.3.1) Based on the external input points, the calls to dangerous functions, and the data flow path, output a complete chain of evidence from the source to the destination; (3.3.2) Automatically generate the minimum exploitation conditions and the corresponding pseudo-simulation exploitation scripts, and verify them through lightweight dynamic verification methods.

[0039] In a preferred embodiment of the present invention, step (3.4) specifically includes the following steps: Based on different AI analysis strategies and project categories, the system intelligently filters target CWE types, ranks them by risk priority, differentiates priorities according to strategies, and performs a comprehensive ranking based on confidence scores.

[0040] In a preferred embodiment of the present invention, step (4) specifically includes the following steps: The order in which CWEs are processed is determined based on the assessment of priority strategies; Locate the problem point in the same line of code within the same CWE type target file; Based on the confidence strategies of different rule types and combined with confidence intervals, high-confidence results of the analyzed objects are output.

[0041] The present invention provides a system for static analysis security assessment and location based on artificial intelligence to implement the above method, wherein the system includes: The heterogeneous tool invocation module is used to invoke multi-source heterogeneous static analysis tools to perform analysis tasks on the target and obtain output results; The multi-source result standardization module is connected to the heterogeneous tool calling module and is used to adapt the data results of different tools and convert them into a standardized format. The false alarm dataset module, connected to the multi-source result standardization module, is used to collect and accumulate typical cases, covering typical false alarm patterns of static analysis tools.

[0042] The thought chain reasoning and self-consistency check module is connected to the false alarm dataset module and is used to perform thought chain reasoning and self-consistency check. The evidence chain generation and lightweight reachability verification module is connected to the thought chain reasoning and self-consistency check module to intelligently generate pseudo PoCs and perform lightweight dynamic verification. The problem risk classification and ranking module is connected to the evidence chain generation and lightweight accessibility verification module. It is used to intelligently classify and rank the problem risks with vulnerabilities in the assessment results under the strategy specified by the user. The display and output module, connected to the problem risk classification and ranking module, is used to display the analysis status of multi-source heterogeneous tools, static analysis results, AI judgment results, and aggregated AI judgment results.

[0043] The device for static analysis, security assessment, and location based on artificial intelligence according to the present invention, wherein the device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the above-described method for static analysis security assessment and location based on artificial intelligence.

[0044] The present invention discloses a processor for static analysis security assessment and location based on artificial intelligence, wherein the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for static analysis security assessment and location based on artificial intelligence are implemented.

[0045] The computer-readable storage medium of the present invention stores a computer program thereon, which can be executed by a processor to implement the various steps of the above-described method for static analysis security assessment and location based on artificial intelligence.

[0046] This invention relates to the fields of software security and artificial intelligence technology, specifically to a technical method and system for rapidly and accurately locating critical CWE security vulnerabilities in typical application projects such as PHP and Java by using a locally deployed Large Language Model (LLM) to perform semantic analysis, false positive suppression, evidence chain generation, and priority ranking on the scanning results of traditional Static Application Security Testing (SAST) tools.

[0047] This invention provides an intelligent processing method and system based on a localized large language model. It is used to uniformly extract, normalize, and perform secondary semantic enhancement analysis on the report results output by static application security testing tools (SAST) such as Fortify, CheckMarx, and IRify. This significantly reduces the false alarm rate, prioritizes the identification of high-risk CWE issues (such as CWE-79, CWE-89, CWE-502, CWE-78, CWE-20, CWE-22, etc.), and automatically generates traceable, reproducible, and testable evidence chains to reduce the workload and time cost of manual review by security personnel.

[0048] The static analysis results based on a large language model of the present invention include the following steps: S1. Analysis based on multi-source heterogeneous static analysis tools; including commercial and open-source tools; S2. Perform format conversion and standardization on the output results of the static analysis tool to obtain standardized static analysis results (including source code context, analysis results, and CWE classification number, etc.). S3. Based on semantic analysis, false alarm suppression, and thought chain reasoning, perform static analysis and intelligent judgment of large language models to obtain analysis results, confidence levels, etc. S4. Aggregate the analysis results from multiple tools to obtain high-confidence results for the analyzed object. S5. Display or export the above high-confidence results.

[0049] In step S3, the intelligent judgment of static analysis of the large language model includes the following process: Build a false alarm dataset; CoT (Co-Course Reasoning) and self-consistency checks; Evidence chain generation and lightweight reachability verification.

[0050] The identification of critical security issues follows this process: A composite risk score is derived by combining the basic severity of CWE, accessibility, framework exposure, asset importance, and strength of evidence for availability. Language-specific risk weighting factors are applied to PHP and Java respectively, such as PHP templates / deserialization chains and Java reflection / EL expressions / SpEL.

[0051] The aggregation process follows these steps: The first-level strategy, based on the assessment priority strategy, focuses on high-severity vulnerabilities and OWASP TOP 20 issue types, which determines the order of handling CWE (Critical Weapon Issues). The second-level strategy locates the problem points in the same line of code of the target file under the same CWE type, with the main purpose of deduplication and simplification of redundant content. The third-layer strategy combines the confidence strategies for different types of rules with confidence intervals to integrate and express the content output.

[0052] The intelligent analysis and critical security issue location system includes: The heterogeneous tool invocation module is used to invoke multi-source heterogeneous static analysis tools, drive them to perform analysis tasks on the target and obtain output results; The multi-source results standardization module is used to adapt data results from different tools and convert them into a standardized format; The false alarm dataset module is used to collect and accumulate typical cases from various sources, covering typical false alarm patterns of static analysis tools.

[0053] Thought Chain Reasoning (CoT) and Self-Consistency Checking Module The evidence chain generation and lightweight reachability verification module is used to intelligently generate pseudo PoCs and perform lightweight dynamic verification (sandbox environment / interpreter operation / taint simulation).

[0054] The Problem Risk Classification and Ranking Module is used to intelligently classify and rank the problem risks that have vulnerabilities in the assessment results, under the strategy specified by the user.

[0055] The display and output module is used to display the analysis status of multi-source heterogeneous tools, static analysis results, AI judgment results, and aggregated AI judgment results.

[0056] Figure 1 This is a schematic diagram of the overall system architecture. The main modules include a heterogeneous tool invocation module, result processing and standardization, semantic context construction, false alarm dataset construction, CoT (Coding of Reasoning) system, evidence chain generation and reachability verification, and problem risk and ranking.

[0057] Figure 2A flowchart for standardizing result processing and generating semantic context is provided. This includes receiving output from heterogeneous tools, performing format normalization, preprocessing and extracting data, and finally generating the relevant context (including problem description, code, CWE type, and other content elements) as required.

[0058] Figure 3 A flowchart was constructed for the false alarm dataset. There are three types of false alarm sources: the historical scan results library of the SAST tool (primary source), the AI ​​judgment results library (secondary source), and the results of multiple rounds of AI testing (secondary source). After expert analysis and verification, the false alarm cases were marked and aggregated into a four-tuple structure of "alarm record - code context - evidence chain - adjudication".

[0059] Figure 4 This is a flowchart for thought chain reasoning and self-consistency checking. Based on the prompt template, the judgment result is obtained by combining thought chain reasoning. At the same time, the judgment result can be sampled for self-consistency checking (otherwise the judgment result is self-contradictory and lacks credibility).

[0060] Figure 5 This document presents a flowchart for evidence chain generation and lightweight accessibility verification. Utilizing the model again, based on the SAST analysis results, tools are used to extract the associated code context, combined with a hint template (incorporating CWE type), to generate a Proof of Concept (POC) for lightweight accessibility verification, aiding in judgment / confirmation.

[0061] Figure 6 This is a flowchart of the risk scoring and ranking model. Based on different AI analysis strategies and project categories, it intelligently filters target CWE types to derive risk priority ranking. Priorities are further differentiated according to strategies such as front-end functions, back-end functions, and initialization functions. Specific popular vulnerabilities, risk weighting factors, and confidence scores are combined for a comprehensive ranking.

[0062] The overall architecture consists of a heterogeneous tool invocation module, a multi-source result standardization module, a semantic context construction module, a false alarm dataset construction module, a thought chain reasoning and self-consistency check module, an evidence chain generation and lightweight reachability verification module, a problem risk classification and ranking module, and a display and output module. Key steps: 1. Heterogeneous Tool Invocation. The system receives project source code and related metadata information via a web application and uploads them as a .zip compressed file. In the background, the system converts the input information into command-line statements, invoking static analysis tools such as Fortify, CheckMarx, and IRify to perform scanning tasks according to preset analysis rules. After all scanning tasks are completed, the system proceeds to the next step.

[0063] 2. Multi-Source Result Standardization. The "Multi-Source Result Standardization Module" of this invention supports unified format processing of heterogeneous output results from various static analysis tools. The system converts Fortify's FPR format files to SARIF format using a third-party tool, and then to a unified JSON format; CheckMarx's XML format results need to be processed into JSON format using a custom conversion function; IRify outputs in SARIF format by default and can be directly converted to JSON format. For other open-source tools, their output interfaces can be adapted and modified to be incorporated into the unified processing flow. The unified JSON format specification includes key fields such as file path, code line and column information, rule ID, detected CWE type, code snippet, tool confidence, taint source / sink (optional), and data flow path (optional), providing structured input for subsequent semantic processing and false alarm identification.

[0064] 3. False Alarm Dataset Construction and Management. The "False Alarm Dataset Construction and Management Module" of this invention constructs a "false alarm sample library" based on historical scan records and expert annotations, covering typical false alarm scenarios such as output encoding, parameterized querying, whitelist verification, framework-level CSRF protection, sandboxed execution, and secure encapsulation of secondary calls. The system organizes samples using a structured approach of "alarm record - code context - evidence chain - ruling," with each sample containing an explainable ruling reason. To improve the model's generalization ability, the system employs a "swing case mining" strategy, actively learning and manually annotating use cases with ambiguity or misjudgment risk, continuously expanding boundary samples, and improving the accuracy of false alarm identification.

[0065] 4. Chain of Reasoning (CoT) and Self-Consistency Check. This invention applies a pre-defined sequence of prompt templates within a locally deployed Large Language Model (LLM) to perform multi-stage reasoning on each alarm message. The reasoning process includes source-sink reachability determination, cleanup / encoding validity analysis, framework default protection mechanism evaluation, abnormal path identification, and vulnerability existence or false alarm determination under boundary conditions. The system can also verify the logical coherence and consistency during the reasoning process through a self-consistency check mechanism to improve the credibility of the judgment results.

[0066] 5. Evidence Chain Generation and Lightweight Reachability Verification. The "Evidence Chain Generation and Reachability Verification Module" of this invention outputs a complete evidence chain from source to destination based on external input points (such as HTTP parameters, deserialization entry points, and message queues) and the call / data flow path of dangerous functions (sinks). The system automatically generates minimal exploitation conditions and corresponding pseudo-Proof-of-Concept (PoC) scripts, and verifies them through lightweight dynamic verification methods (such as sandbox environment operation, interpreter simulation, and tainted data flow tracing) to ensure the authenticity of the exploitation path and provide reproducible verification evidence for security personnel.

[0067] 6. Problem Risk Classification and Ranking. In the "Problem Risk Classification and Ranking Module," this invention comprehensively considers the basic severity of the CWE (Critical Weapon Error), data flow path reachability, framework exposure, asset importance, and strength of usability evidence, deriving a composite risk score through weighted calculation. For different programming languages ​​(such as PHP and Java), the system introduces language-specific risk weighting factors (e.g., template injection risk and deserialization chain vulnerability in PHP, reflection mechanism and EL expression injection in Java) to improve the accuracy and practicality of risk assessment.

[0068] In addition, a low-latency, high-throughput local LLM is selected to ensure that relevant source code details are not leaked during the analysis process.

[0069] In a specific embodiment of the present invention, taking the Tale blog system project code as an example, the processing procedure for a Java-oriented project is as follows: 1. Project Upload Phase Users select a local project to be analyzed (usually source code or a collection of project files) on the system's front-end interface and upload it to the system. Upon receiving the upload request, the system back-end stores the file in the designated object storage and generates a unique project ID for that project. This ID serves as a unique index in subsequent scheduling, analysis, and result aggregation processes.

[0070] 2. Task distribution phase of the scheduling module Once the project ID is generated, the system enters the task scheduling module. The core function of the scheduling module is to automatically identify and allocate appropriate static analysis tools based on the project type (such as Java, PHP, etc.). The scheduling module encapsulates each analysis task into a standard task description object. Subsequently, the scheduling module pushes the task to the task execution queue, where the analysis executor asynchronously pulls the task and starts the corresponding tool for static analysis.

[0071] 3. Execution phase of multi-tool static analysis The analysis executor launches the corresponding static analysis tools according to the task configuration, performing syntax scanning, pattern matching, or rule detection on the project source code, and outputting raw analysis reports in their respective formats. The output formats of different tools vary (e.g., XML, FPR, etc.). After all tools have completed their analysis, the raw reports will be stored uniformly in a designated object store.

[0072] 4. Standardization of Analysis Result Format After all original reports are generated, the system enters the result standardization phase. A separate format conversion module iterates through all original report files, parses the tool-specific fields, and converts them into a standardized JSON structure. During the conversion process, file paths, line numbers, rule IDs, and vulnerability descriptions from the tools are standardized, and field preprocessing is performed, such as removing empty fields, standardizing encoding, and normalizing paths. The converted result files are formatted as follows: The format storage specifies the object storage, providing structured input for subsequent AI analysis and report generation.

[0073] 5. False Alarm Identification and Credibility Assessment Stage of Large Language Model After the JSON file is generated, the system will enter the secondary evaluation stage of the SAST results based on the Large Language Model (LLM). This module loads the analysis conclusions of each SAST from the JSON file via API and constructs standardized model input prompts. The model will output a structured response containing the judgment result and explanation based on the context and the knowledge base built from the false alarm data. Subsequently, the model output is merged back into the JSON file, and new fields are added to each result node, such as the LLM judgment result, confidence score, and brief explanation.

[0074] 6. Results Summary and Report Generation Stage After the model verification is completed, the system enters the report generation module. This module aggregates all the analysis results from the project, performing statistical analysis, false alarm filtering, and report template population. The final generated report can be in either JSON format (for API calls or system integration) or PDF format (for visual export and manual review).

[0075] After the report is generated, the system will update the project status to "Analysis Complete" and record information such as the report path, generation time, and execution log in the object storage for users to view or download on the front end.

[0076] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0077] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0078] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0079] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0080] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0081] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0082] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0083] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0084] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0085] The present invention employs an artificial intelligence-based method, apparatus, processor, and computer-readable storage medium for static analysis security assessment and location. This significantly reduces the false alarm rate, reducing manual review workload by 50-80% in enterprise-level projects and significantly improving the accuracy of critical high-risk issues. Problem location speed is greatly improved, automatically outputting evidence chains and pseudo-Proof-of-Concept (PoC), shortening the average time from analysis to action. Interpretability is enhanced, with auditable and traceable reasoning processes and justifications, facilitating security audits and compliance records. It boasts strong adaptability, supporting contextual understanding of mainstream PHP and Java frameworks and unified processing of results across tools. Privacy and compliance are guaranteed through end-to-end localized reasoning, effectively avoiding the risk of source code leakage.

[0086] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for static analysis-based security assessment and location based on artificial intelligence, characterized in that, The method includes the following steps: (1) Call the multi-source heterogeneous static analysis tool, execute the scanning task according to the preset analysis rules, and obtain the multi-source heterogeneous analysis results; (2) The output results of the multi-source heterogeneous static analysis tool are converted and standardized respectively to obtain standardized static analysis results; (3) Based on the locally deployed large language model, perform semantic analysis, false alarm suppression and thought chain reasoning on standardized structured data, and output analysis results and confidence scores; (4) Aggregate the analysis results to obtain the high-confidence results of the analyzed object; (5) Display or export the above high confidence results.

2. The method for static analysis security assessment and location based on artificial intelligence according to claim 1, characterized in that, Step (3) specifically includes the following steps: (3.1) Constructing and managing false alarm datasets; (3.2) Perform chain reasoning and self-consistency check; (3.3) Generate a chain of evidence and perform lightweight reachability verification; (3.4) Classify and rank the problem risks to obtain a composite risk score.

3. The method for static analysis security assessment and location based on artificial intelligence according to claim 2, characterized in that, The specific steps (3.1) are as follows: A false alarm sample library was built, covering typical false alarm scenarios; a swing case mining strategy was adopted to actively learn and manually annotate use cases with ambiguity or risk of misjudgment.

4. The method for static analysis security assessment and location based on artificial intelligence according to claim 2, characterized in that, Step (3.2) specifically includes the following steps: (3.2.1) Apply the preset prompt template sequence to the large language model deployed locally, perform multi-stage reasoning on each alarm message, and obtain the judgment result; (3.2.2) Perform a self-consistency check on the judgment results and output the judgment results and confidence scores.

5. The method for static analysis security assessment and location based on artificial intelligence according to claim 2, characterized in that, Step (3.3) specifically includes the following steps: (3.3.1) Based on the external input points, the calls to dangerous functions, and the data flow path, output a complete chain of evidence from the source to the destination; (3.3.2) Automatically generate the minimum exploitation conditions and the corresponding pseudo-simulation exploitation scripts, and verify them through lightweight dynamic verification methods.

6. The method for static analysis security assessment and location based on artificial intelligence according to claim 2, characterized in that, Step (3.4) specifically includes the following steps: Based on different AI analysis strategies and project categories, the system intelligently filters target CWE types, ranks them by risk priority, differentiates priorities according to strategies, and performs a comprehensive ranking based on confidence scores.

7. The method for static analysis security assessment and location based on artificial intelligence according to claim 1, characterized in that, Step (4) specifically includes the following steps: The order in which CWEs are processed is determined based on the assessment of priority strategies; Locate the problem point in the same line of code within the same CWE type target file; Based on the confidence strategies of different rule types and combined with confidence intervals, high-confidence results of the analyzed objects are output.

8. A system for static analysis, security assessment, and location based on artificial intelligence to implement the method of claim 1, characterized in that, The system includes: The heterogeneous tool invocation module is used to invoke multi-source heterogeneous static analysis tools to perform analysis tasks on the target and obtain output results; The multi-source result standardization module is connected to the heterogeneous tool calling module and is used to adapt the data results of different tools and convert them into a standardized format. The false alarm dataset module, connected to the multi-source result standardization module, is used to collect and accumulate typical cases, covering typical false alarm patterns of static analysis tools. The thought chain reasoning and self-consistency check module is connected to the false alarm dataset module and is used to perform thought chain reasoning and self-consistency check. The evidence chain generation and lightweight reachability verification module is connected to the thought chain reasoning and self-consistency check module to intelligently generate pseudo PoCs and perform lightweight dynamic verification. The problem risk classification and ranking module is connected to the evidence chain generation and lightweight accessibility verification module. It is used to intelligently classify and rank the problem risks with vulnerabilities in the assessment results under the strategy specified by the user. The display and output module, connected to the problem risk classification and ranking module, is used to display the analysis status of multi-source heterogeneous tools, static analysis results, AI judgment results, and aggregated AI judgment results.

9. A device for static analysis, security assessment, and location based on artificial intelligence, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for static analysis security assessment and location based on artificial intelligence as described in any one of claims 1 to 7.

10. A processor for static analysis, security assessment, and location based on artificial intelligence, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement each step of the method for static analysis security assessment and location based on artificial intelligence as described in any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method for static analysis security assessment and location based on artificial intelligence as described in any one of claims 1 to 7.

Images