Intelligent target code vulnerability detection method and device based on cooperation of large and small models
By employing a collaborative architecture of large and small models and a RAG enhancement mechanism, the problems of low efficiency and low automation in existing vulnerability detection technologies are solved, enabling efficient and accurate vulnerability detection and remediation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING INST OF TECH
- Filing Date
- 2025-12-08
- Publication Date
- 2026-05-15
AI Technical Summary
Existing vulnerability detection technologies are inefficient and resource-intensive when dealing with high-value targets and complex scenarios. They also lack lightweight layered matching designs and have a low degree of automation in remediation and verification.
Employing a collaborative architecture of small and large models, the system constructs a target knowledge base and RAG enhancement mechanism through fast hash matching of the small model and deep analysis of the large model. This enables rapid screening of known vulnerabilities, generation of remediation suggestions, and automated verification.
It significantly improves vulnerability detection efficiency by 5 to 50 times, with a detection accuracy of no less than 64% and a first-time pass rate of no less than 20% for repair code, thus automating vulnerability repair verification.
Smart Images
Figure CN122046359A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a method and apparatus for intelligent detection of target code vulnerabilities through collaboration of large and small models, belonging to the field of computer software and artificial intelligence technology, and applied to the automated identification, repair and verification of software vulnerabilities. Background Technology
[0002] In application environments, the current state of software vulnerability detection and remediation technologies is as follows: As software systems gradually become critical social infrastructure, vulnerability detection technologies have evolved significantly from traditional manual auditing and rule matching towards intelligent solutions. Traditional technologies mainly include static analysis, dynamic fuzz testing, and binary symbolic execution, which have been applied in projects such as Chrome and OpenSSL. In recent years, artificial intelligence, especially deep learning technologies, has been widely introduced. Early research used models such as SVM and RNN to extract features from historical submissions, achieving preliminary automated identification. With the rise of pre-trained language models (PLM) and large model models (LLM), models such as CodeBERT, GraphCodeBERT, and CodeLlama have significantly improved their ability to understand code syntax, semantics, and context through pre-training on large-scale code corpora. Current research further combines value dependency graph (VDG) modeling of data flows, utilizes retrieval augmented generation (RAG) technology to introduce a high-value target knowledge base, and applies thought chain technology to optimize vulnerability analysis and remediation suggestion generation. For high-value targets such as OpenSSH and the Linux Kernel, existing technologies have constructed multi-language vulnerability datasets, significantly improving detection accuracy on specific benchmarks.
[0003] In application environments, existing vulnerability detection and remediation technologies suffer from the following shortcomings: Despite progress in intelligent detection, significant deficiencies remain when facing high-value targets and complex scenarios. Traditional static analysis often has a false positive rate exceeding 40% and struggles to capture deep logic vulnerabilities; dynamic testing is time-consuming and has low coverage when dealing with complex protocol stacks; binary analysis faces the path explosion problem. Early machine learning models are mostly limited to shallow features and cannot accurately locate line-level vulnerabilities. More critically, existing general-purpose large-scale model solutions face severe performance bottlenecks in practical applications: on the one hand, they lack rapid response mechanisms for known vulnerabilities, requiring costly full-scale inference for repeated occurrences of the same vulnerability, resulting in wasted computing power; on the other hand, deep detection of unknown vulnerabilities consumes huge resources, with long single inference times, making it difficult to meet real-time auditing needs. Furthermore, existing technologies mostly adopt a "full-scale model + retrieval" model, lacking a lightweight layered matching design, resulting in a general lack of a closed-loop automated verification step after generating remediation suggestions.
[0004] Therefore, improving the efficiency of source code vulnerability detection and automating the verification of source code vulnerability repair has become an urgent problem to be solved. Summary of the Invention
[0005] The purpose of this invention is to address the technical problem of improving the efficiency of source code vulnerability detection and automating the verification and repair of source code vulnerabilities. It proposes an intelligent detection method and device for target code vulnerabilities through a collaborative approach of small and large models. This invention utilizes a hierarchical collaborative architecture of rapid matching of small models and in-depth analysis of large models, and constructs a target knowledge base and RAG enhancement mechanism to achieve source code repair and verification.
[0006] The objective of this invention is achieved through the following technical solution:
[0007] This invention discloses an intelligent detection method for target code vulnerabilities using a combination of large and small models, comprising the following steps:
[0008] Step 1: Construct a target knowledge base by mapping all historical versions of the target program's static source code and vulnerability metadata using key-value pairs;
[0009] Step 1.1: Use all historical versions of static source code from OpenSSH, Apache HTTP Server, Nginx, MySQL, Open SSL, and VNC as the target source code files;
[0010] Step 1.2: Collect the CVE vulnerability information, patch code, vulnerability type, and PoC code corresponding to the target source code file as vulnerability metadata;
[0011] Step 1.3: Construct a mapping relationship between the target source code file and vulnerability metadata using key-value pairs;
[0012] Step 2: Construct and utilize a small model layer to perform hash value matching between the source code to be detected and the target source code of the target knowledge base;
[0013] Step 2.1: Use MD5 or SHA-256 methods to obtain the hash value of the source code to be detected, which supports a single code file or a compressed code package;
[0014] Step 2.2: Use O(1) constant time complexity to perform hash value matching between the source code to be detected and the target source code file of the target knowledge base;
[0015] Step 3: When the source code to be detected matches the hash value of the target source code, the cached vulnerability report in the target knowledge base is returned by calling the vulnerability metadata corresponding to the key-value pair of the target source code.
[0016] Step 4: When the hash value of the source code to be detected does not match that of the target source code, the RAG searcher, which integrates the CodeShell parameter-level vulnerability model (which has been fine-tuned with self-guided data augmentation parameters and frozen with self-attention layer parameters) and the SARD dataset, is invoked to generate a vulnerability report.
[0017] Step 4.1: Build and train a CodeShell parameter-level vulnerability model for parameter fine-tuning;
[0018] Step 4.1.1: Fine-tune the parameters of the CodeShell parameter-level vulnerability model using self-guided data augmentation;
[0019] Step 4.1.2: Freeze the self-attention layer parameters of the fine-tuned CodeShell parameter-level vulnerability model, unfreeze the cross-attention layer parameters, and optimize the model using the training set;
[0020] Step 4.2: Add the SARD dataset to the optimized CodeShell parameter-level vulnerability model and integrate the RAG searcher;
[0021] Step 4.3: Input the source code to be detected into the RAG search engine to obtain a vulnerability report containing the vulnerability type, vulnerability code location, CWE number, risk level, and cause description;
[0022] Step 5: The vulnerability hint words constructed from few-shot learning and mind chain are combined with the source code to be detected through deep semantic analysis using the optimized CodeShell parameter-level vulnerability model to generate repair code. The repair code is used to fix the vulnerability while calling the optimized CodeShell parameter-level vulnerability model for differential verification, thereby obtaining the repaired detection source code.
[0023] Step 5.1: Construct vulnerability hints using few-shot learning and mind chain techniques respectively;
[0024] Step 5.1.1: Use few-shot learning to construct prompt words for the target knowledge base;
[0025] Step 5.1.2: Construct cue words for a large language model using thought chains;
[0026] Step 5.1.3: Merge the prompts from the target knowledge base and the prompts from the large language model to form vulnerability prompts;
[0027] Step 5.2: Call the optimized CodeShell parameter-level vulnerability model to perform deep semantic analysis on the vulnerability hints and source code to be detected input into the model, and generate remediation code;
[0028] Step 5.3: Use the patching code to patch the vulnerabilities in the source code to be tested, and input the patched source code into the optimized CodeShell parameter-level vulnerability model for differential verification;
[0029] Step 5.4: Set the preset number of iterations, and execute steps 5.2 to 5.3 in a loop until the maximum number of iterations is reached or the model detection vulnerability is eliminated, and obtain the repaired detection source code;
[0030] Step 6: Output the vulnerability report, patch code, and patched detection source code in structured JSON and visual HTML format, and export the code file;
[0031] This invention discloses an intelligent target code vulnerability detection device that utilizes a combination of large and small models to implement the aforementioned method. The device comprises a target knowledge base module, a small model matching module, a large model deep analysis module, and a remediation verification module.
[0032] The target knowledge base module stores and dynamically updates a pre-built target knowledge base, containing a mapping relationship between the historical complete source code files of programs such as OpenSSH, Apache, Nginx, MySQL, and OpenSSL and their corresponding CVE vulnerability information, vulnerability types, fix codes, and PoC codes. This module also supports key-value storage and vectorized storage of similar vulnerability corpora for RAG retrieval. This will serve as input to the small model matching module.
[0033] The small model matching module is used to receive the source code file to be detected uploaded by the user, calculate the MD5 hash value of the file in real time, and perform O(1) level matching in the target knowledge base module; if a match is found, the cached complete vulnerability report is extracted from the knowledge base and used as input to the remediation verification module.
[0034] The large model deep analysis module uses the RAG search engine to perform deep semantic analysis and vulnerability detection on the source code, outputting vulnerability type, location, CWE number, risk level, and cause description, and automatically generates repair code based on mind chain prompts; this code will serve as input to the repair verification module.
[0035] The repair verification module is used to feed the repaired code generated by the large model back to the large model deep analysis module for differential verification until the model confirms that the original vulnerability has been completely eliminated or the code verification is successful, and to generate structured JSON and visual HTML output.
[0036] Compared with existing technologies, it has the following beneficial effects:
[0037] 1. This invention employs a layered detection architecture of lightweight small models and fine-tuned large models, significantly improving the overall efficiency of vulnerability detection. By constructing a high-value target knowledge base, the first stage utilizes lightweight hash matching technology to perform millisecond-level rapid screening of known source code, avoiding repetitive and costly large model inference on existing known vulnerabilities; only in the second stage is the fine-tuned large model called for in-depth analysis of unknown code. This hierarchical processing mechanism effectively solves the problems of high resource consumption and slow response of existing full-model inference, achieving a 5-50 times improvement in end-to-end detection efficiency.
[0038] 2. This invention introduces a Retrieval Enhancement Generation (RAG) mechanism and targeted fine-tuning technology, significantly improving the detection accuracy for high-value targets. For critical infrastructure software such as OpenSSH and Apache, this invention utilizes RAG technology to retrieve historical vulnerability corpora from a knowledge base to assist large-scale model reasoning, enabling it to more accurately understand complex code contexts and data flow dependencies. This overcomes the shortcomings of traditional static analysis, such as high false positive rates and insufficient domain knowledge in general-purpose large-scale models, ensuring an overall detection accuracy of no less than 64% in complex application scenarios.
[0039] 3. This invention constructs a closed loop of detection, remediation, and verification, solving the problem of low automation in vulnerability remediation verification. By guiding the model to generate targeted remediation suggestions through natural language hint chains, and combining this with an automated verification mechanism to instantly confirm the effectiveness of the generated code, this invention changes the traditional approach that can only discover vulnerabilities but cannot verify the remediation effect. This method reduces the cost of manual auditing and verification, achieves a first-time pass rate of at least 20% for remediated code, and effectively improves the automation level of source code vulnerability remediation verification. Attached Figure Description
[0040] Figure 1 This is a flowchart illustrating the present invention; Detailed Implementation
[0041] To better illustrate the purpose and advantages of this invention, the invention will be further described below with reference to the accompanying drawings and examples. It should be noted that the implementation of this invention is not limited to the following embodiments, and any modifications or alterations made to this invention will fall within the scope of protection of this invention.
[0042] Example
[0043] like Figure 1 As shown in the figure, the specific implementation steps of the intelligent detection method for target code vulnerabilities through big-small model collaboration in this embodiment are as follows:
[0044] Step 1: Construct a target knowledge base by mapping all historical versions of the target program's static source code and vulnerability metadata using key-value pairs;
[0045] Step 1.1: Use all historical versions of static source code from OpenSSH, Apache HTTP Server, Nginx, MySQL, Open SSL, and VNC as the target source code files;
[0046] Step 1.2: Collect the CVE vulnerability information, patch code, vulnerability type, and PoC code corresponding to the target source code file as vulnerability metadata;
[0047] Step 1.3: Construct a mapping relationship between the target source code file and vulnerability metadata using key-value pairs;
[0048] In this embodiment, the construction of the target knowledge base involves collecting and standardizing all historical versions of the source code for target programs such as OpenSSH, Apache HTTP Server, Nginx, MySQL, OpenSSL, and VNC, along with their corresponding CVE vulnerability information, patch code, vulnerability type, and PoC code. This forms a key-value mapping relationship between complete source files and vulnerability metadata, containing at least 73 target vulnerability instances. By collecting high-value vulnerability code, a source code file knowledge base containing various common attack classes is constructed.
[0049] Step 2: Construct and utilize a small model layer to perform hash value matching between the source code to be detected and the target source code of the target knowledge base;
[0050] Step 2.1: Use MD5 or SHA-256 methods to obtain the hash value of the source code to be detected, which supports a single code file or a compressed code package;
[0051] Step 2.2: Use O(1) constant time complexity to perform hash value matching between the source code to be detected and the target source code file of the target knowledge base;
[0052] In this embodiment, the system receives source code files uploaded by users, supporting single files or complete project compressed packages. The process of matching the source code to be detected with the target source code files in the target knowledge base using MD5 or SHA-256 hash values serves as a small model layer. This lightweight implementation of the small model includes hash calculation and key-value query logic, without involving any neural network inference. It can be deployed on edge devices or container environments, and can process tens of thousands of queries per second on a single-core CPU. During the rapid matching phase of the small model, the MD5 or SHA-256 hash value of the uploaded source code file is calculated, and an O(1) level key-value query is performed in the high-value target knowledge base.
[0053] Step 3: When the source code to be detected matches the hash value of the target source code, the cached vulnerability report in the target knowledge base is returned by calling the vulnerability metadata corresponding to the key-value pair of the target source code.
[0054] In this embodiment, if a vulnerability is detected, a cached complete vulnerability report is returned directly, including the CVE number, vulnerability location, risk level, historical fix code, and exploitability analysis. The entire process takes less than 50 milliseconds.
[0055] Step 4: When the hash value of the source code to be detected does not match that of the target source code, the RAG searcher, which integrates the CodeShell parameter-level vulnerability model (which has been fine-tuned with self-guided data augmentation parameters and frozen with self-attention layer parameters) and the SARD dataset, is invoked to generate a vulnerability report.
[0056] Step 4.1: Build and train a CodeShell parameter-level vulnerability model for parameter fine-tuning;
[0057] Step 4.1.1: Fine-tune the parameters of the CodeShell parameter-level vulnerability model using self-guided data augmentation;
[0058] Step 4.1.2: Freeze the self-attention layer parameters of the fine-tuned CodeShell parameter-level vulnerability model, unfreeze the cross-attention layer parameters, and optimize the model using the training set;
[0059] Step 4.2: Add the SARD dataset to the optimized CodeShell parameter-level vulnerability model and integrate the RAG searcher;
[0060] Step 4.3: Input the source code to be detected into the RAG search engine to obtain a vulnerability report containing the vulnerability type, vulnerability code location, CWE number, risk level, and cause description;
[0061] In this embodiment, if the knowledge base is not matched, the process automatically proceeds to the large-scale model deep analysis stage. The source code is input into the fine-tuned CodeShell large-scale model containing 7 billion parameters of vulnerabilities. The RAG mechanism is used to retrieve vectorized vulnerability corpora from the target knowledge base in real time, performing deep semantic analysis and outputting more than 10 vulnerability types such as buffer overflow, injection, and privilege escalation, along with the vulnerability code location, CWE number, risk level (CVSS v3), and detailed explanations of the causes and attack paths. For the large-scale model fine-tuning, a two-stage fine-tuning method is employed, optimizing the general vulnerability model based on domain data related to code vulnerabilities. In the first stage, general self-guided data augmentation techniques are used to comprehensively fine-tune the large pre-trained language model. In the second stage, the self-attention layer parameters of the model are frozen, and optimization is performed only on cross-attention layer parameters using domain-specific datasets. This not only ensures the optimization effect but also improves the efficiency of model training.
[0062] Step 5: The vulnerability hint words constructed from few-shot learning and mind chain are combined with the source code to be detected through deep semantic analysis using the optimized CodeShell parameter-level vulnerability model to generate repair code. The repair code is used to fix the vulnerability while calling the optimized CodeShell parameter-level vulnerability model for differential verification, thereby obtaining the repaired detection source code.
[0063] Step 5.1: Construct vulnerability hints using few-shot learning and mind chain techniques respectively;
[0064] Step 5.1.1: Use few-shot learning to construct prompt words for the target knowledge base;
[0065] Step 5.1.2: Construct cue words for a large language model using thought chains;
[0066] Step 5.1.3: Merge the prompts from the target knowledge base and the prompts from the large language model to form vulnerability prompts;
[0067] Step 5.2: Call the optimized CodeShell parameter-level vulnerability model to perform deep semantic analysis on the vulnerability hints and source code to be detected input into the model, and generate remediation code;
[0068] Step 5.3: Use the patching code to patch the vulnerabilities in the source code to be tested, and input the patched source code into the optimized CodeShell parameter-level vulnerability model for differential verification;
[0069] Step 5.4: Set the preset number of iterations, and execute steps 5.2 to 5.3 in a loop until the maximum number of iterations is reached or the model detection vulnerability is eliminated, and obtain the repaired detection source code;
[0070] In this embodiment, a large language model prompt construction method based on few-shot and chain-of-thought (COT) technologies is designed. Regarding few-shot construction, the large language model automatically generates few-shot prompt words. Regarding COT technology, the prompt model performs step-by-step model thinking, allowing the model to output a vulnerability analysis reasoning chain, facilitating the discovery of code vulnerabilities and improving the accuracy of vulnerability analysis. Finally, by embedding few-shot prompts into the knowledge base and implicitly embedding them into the prompt, a chain-of-thought (COT) prompt is constructed. A second call to the large model generates suggested remedial code. The remediated code is then input back into the large model for differential verification until the model confirms that the vulnerability has been completely eliminated or the maximum number of iterations has been reached.
[0071] Step 6: Output the vulnerability report, patch code, and patched detection source code in structured JSON and visual HTML format, and export the code file;
[0072] In this embodiment, regardless of whether the fast matching path or the in-depth analysis path is used for result summarization and report generation, the final output is a unified structured JSON report and a visual HTML report, and the code file can be exported with one click.
[0073] This invention discloses an intelligent target code vulnerability detection device that utilizes a combination of large and small models to implement the aforementioned method. The device comprises a target knowledge base module, a small model matching module, a large model deep analysis module, and a remediation verification module.
[0074] The target knowledge base module stores and dynamically updates a pre-built target knowledge base, containing a mapping relationship between the historical complete source code files of programs such as OpenSSH, Apache, Nginx, MySQL, and OpenSSL and their corresponding CVE vulnerability information, vulnerability types, fix codes, and PoC codes. This module also supports key-value storage and vectorized storage of similar vulnerability corpora for RAG retrieval. This will serve as input to the small model matching module.
[0075] The small model matching module is used to receive the source code file to be detected uploaded by the user, calculate the MD5 hash value of the file in real time, and perform O(1) level matching in the target knowledge base module; if a match is found, the cached complete vulnerability report is extracted from the knowledge base and used as input to the remediation verification module.
[0076] The large model deep analysis module uses the RAG search engine to perform deep semantic analysis and vulnerability detection on the source code, outputting vulnerability type, location, CWE number, risk level, and cause description, and automatically generates repair code based on mind chain prompts; this code will serve as input to the repair verification module.
[0077] The repair verification module is used to feed the repaired code generated by the large model back to the large model deep analysis module for differential verification until the model confirms that the original vulnerability has been completely eliminated or the code verification is successful, and to generate structured JSON and visual HTML output.
[0078] The above detailed description further illustrates the purpose, technical solution, and beneficial effects of the invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for intelligent detection of target code vulnerabilities through collaboration of large and small models, characterized in that: Includes the following steps, Step 1: Construct a target knowledge base by mapping all historical versions of the target program's static source code and vulnerability metadata using key-value pairs; Step 2: Construct and utilize a small model layer to perform hash value matching between the source code to be detected and the target source code of the target knowledge base; Step 3: When the source code to be detected matches the hash value of the target source code, the cached vulnerability report in the target knowledge base is returned by calling the vulnerability metadata corresponding to the key-value pair of the target source code. Step 4: When the hash value of the source code to be detected does not match that of the target source code, the RAG searcher, which integrates the CodeShell parameter-level vulnerability model (which has been fine-tuned with self-guided data augmentation parameters and frozen with self-attention layer parameters) and the SARD dataset, is invoked to generate a vulnerability report. Step 4.1: Build and train a CodeShell parameter-level vulnerability model for parameter fine-tuning; Step 4.1.1: Fine-tune the parameters of the CodeShell parameter-level vulnerability model using self-guided data augmentation; Step 4.1.2: Freeze the self-attention layer parameters of the fine-tuned CodeShell parameter-level vulnerability model, unfreeze the cross-attention layer parameters, and optimize the model using the training set; Step 4.2: Add the SARD dataset to the optimized CodeShell parameter-level vulnerability model and integrate the RAG searcher; Step 4.3: Input the source code to be detected into the RAG search engine to obtain a vulnerability report containing the vulnerability type, vulnerability code location, CWE number, risk level, and cause description; Step 5: The vulnerability hint words constructed by few-shot learning and mind chain are combined with the source code to be detected through deep semantic analysis using the optimized CodeShell parameter-level vulnerability model to generate repair code. The repair code is used to repair the vulnerability and at the same time, the optimized CodeShell parameter-level vulnerability model is called to perform differential verification, thereby obtaining the repaired detection source code. Step 6: Output the vulnerability report, fixes, and patched detection source code in structured JSON and visual HTML, and export the code files.
2. The intelligent detection method for target code vulnerabilities using a combination of large and small models as described in claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: Use all historical versions of static source code from OpenSSH, Apache HTTP Server, Nginx, MySQL, OpenSSL, and VNC as the target source code files; Step 1.2: Collect the CVE vulnerability information, patch code, vulnerability type, and PoC code corresponding to the target source code file as vulnerability metadata; Step 1.3: Construct a mapping relationship between the target source code file and the vulnerability metadata using key-value pairs.
3. The intelligent detection method for target code vulnerabilities using a combination of large and small models as described in claim 1, characterized in that: Step 2 is implemented as follows: Step 2.1: Use MD5 or SHA-256 methods to obtain the hash value of the source code to be detected, which supports a single code file or a compressed code package; Step 2.2: Use O(1) constant time complexity to perform hash value matching between the source code to be detected and the target source code file of the target knowledge base.
4. The intelligent detection method for target code vulnerabilities using a combination of large and small models as described in claim 1, characterized in that: Step 5 is implemented as follows: Step 5.1: Construct vulnerability hints using few-shot learning and mind chain techniques respectively; Step 5.2: Call the optimized CodeShell parameter-level vulnerability model to perform deep semantic analysis on the vulnerability hints and source code to be detected input into the model, and generate remediation code; Step 5.3: Use the patching code to patch the vulnerabilities in the source code to be tested, and input the patched source code into the optimized CodeShell parameter-level vulnerability model for differential verification; Step 5.4: Set the preset number of iterations, and execute steps 5.2 to 5.3 in a loop until the maximum number of iterations is reached or the model detection vulnerability is eliminated, and obtain the repaired detection source code.
5. The intelligent detection method for target code vulnerabilities using a combination of large and small models as described in claim 4, characterized in that: Step 5.1 is implemented as follows: Step 5.1.1: Use few-shot learning to construct prompt words for the target knowledge base; Step 5.1.2: Construct cue words for a large language model using thought chains; Step 5.1.3: Merge the hints from the target knowledge base and the hints from the large language model to form vulnerability hints.
6. A target code vulnerability intelligent detection device that implements the method described in claim 1, characterized in that: It includes a target knowledge base module, a small model matching module, a large model in-depth analysis module, and a repair and verification module; The target knowledge base module stores and dynamically updates a pre-built target knowledge base, containing a mapping relationship between the historical complete source code files of programs such as OpenSSH, Apache, Nginx, MySQL, and OpenSSL and their corresponding CVE vulnerability information, vulnerability types, fix codes, and PoC codes. This module also supports key-value storage and vectorized storage of similar vulnerability corpora for RAG retrieval. This will serve as input to the small model matching module. The small model matching module is used to receive the source code file to be detected uploaded by the user, calculate the MD5 hash value of the file in real time, and perform O(1) level matching in the target knowledge base module; if a match is found, the cached complete vulnerability report is extracted from the knowledge base. This will be used as input to the repair verification module; The large model deep analysis module uses the RAG search engine to perform deep semantic analysis and vulnerability detection on the source code, outputting vulnerability type, location, CWE number, risk level and cause description, and automatically generates repair code in combination with mind chain prompts; This will be used as input to the repair verification module; The repair verification module is used to feed the repaired code generated by the large model back to the large model deep analysis module for differential verification until the model confirms that the original vulnerability has been completely eliminated or the code verification is successful, and to generate structured JSON and visual HTML output.