A Generative AI-Based Method for Intelligent Discovery and Risk Assessment of Software Security Vulnerabilities

Abstract

This invention relates to the fields of software security and artificial intelligence, specifically a generative AI-based intelligent vulnerability discovery and risk assessment method for software security. The method includes: generating abnormal behavior patterns by collecting multi-source data from the target software, inputting this data into a pre-trained generative AI model for multi-level correlation reasoning, and automatically outputting a set of vulnerability descriptions containing location, path, and impact. Historical verification of the vulnerability descriptions enhances their accuracy, and a risk posture assessment is performed. The attack entry point exposure, exploitation path feasibility, and system impact scope of each vulnerability are quantitatively calculated to form a structured risk quantification matrix. Based on this matrix, risk level mapping is completed, and remediation suggestions and priority sequences are automatically generated. Finally, a risk assessment report is integrated and output. This method automates and intelligently discovers vulnerabilities and significantly improves the accuracy and operability of risk analysis through multi-dimensional quantitative assessment.

Description

Technical Field

[0001] This invention relates to the fields of software security and artificial intelligence technology, and in particular to a generative AI-based method for intelligent discovery and risk assessment of software security vulnerabilities. Background Technology

[0002] Current software security vulnerability discovery primarily relies on static code analysis, dynamic fuzzing, and signature- or rule-based detection techniques. These methods typically require predefined vulnerability patterns or depend on extensive human expert experience to construct test cases and rule bases. While effective at detecting known vulnerability variants, their ability to discover potentially deep-seated vulnerabilities lacking obvious characteristics, introduced by complex logical interactions, emerging programming paradigms, or third-party libraries, is limited. They struggle to automatically correlate clues and generate complete vulnerability context descriptions from massive amounts of code and multi-source runtime data.

[0003] In the software risk assessment phase, existing methods generally employ standard frameworks such as general vulnerability scoring systems to score and classify identified vulnerabilities. These methods typically provide a single comprehensive risk score. While their assessment dimensions include exploitability and impact, they struggle to deeply integrate the specific architecture, business processes, and operational environment context of the target software. Their assessment results are rather macroscopic, failing to clearly quantify the specific attack entry points of the vulnerability, the actual feasibility of multi-step exploitation paths, and the precise scope of impact on various system components after the vulnerability is triggered. This results in potentially imprecise remediation priority recommendations, making it difficult to support refined security resource allocation and mitigation decisions. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a generative AI-based method for intelligent discovery and risk assessment of software security vulnerabilities.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a generative AI-based method for intelligent discovery and risk assessment of software security vulnerabilities, comprising: Collect the target software's source code documents, binary components, and runtime log documents to generate a set of abnormal behavior patterns; The set of abnormal behavior patterns is input into a pre-trained generative AI vulnerability assessment model. Through the multi-layered correlation reasoning structure inside the model, a set of candidate vulnerability descriptions containing the location of potential vulnerabilities, triggering paths, and impact contexts is generated. Perform cross-version historical verification on the candidate vulnerability description set, match similar historical vulnerability patterns from the historical vulnerability knowledge base, and generate a verified enhanced vulnerability description set. Based on the enhanced vulnerability description set, a risk situation assessment is performed to calculate the attack entry exposure, exploitation path feasibility, and system impact range corresponding to each potential vulnerability location, forming a structured risk quantification matrix; Based on the structured risk quantification matrix, risk level mapping is performed to map each potential vulnerability to a preset risk level classification framework, generating risk level labeling results; Combining the risk level labeling results and the enhanced vulnerability description set, a remediation strategy is generated, producing a corresponding set of remediation suggestions and a remediation priority sequence for each risk level. The set of repair suggestions, the repair priority sequence, and the structured risk quantification matrix are integrated to generate the final risk assessment report.

[0006] As a further aspect of the present invention, the set of abnormal behavior patterns includes: A multidimensional vulnerability mining dataset is constructed based on a collection of source code documents, a collection of binary components, and a collection of runtime log documents. Perform heterogeneous data processing on the multidimensional vulnerability mining dataset to extract the source code semantic slice set, binary component interface profile set, and runtime interaction behavior time sequence trajectory set; A preset feature semantic alignment engine is invoked to perform semantic consistency comparison on the source code semantic slice set and binary component interface profile set to identify potential semantic breaks and mapping offset sets. Construct a code-behavior association network, and perform dynamic association analysis on the features in the semantic fault and mapping offset set and the features in the runtime interaction behavior time-series trajectory set to generate an abnormal behavior pattern set containing associated paths.

[0007] As a further aspect of the present invention, the step of performing a heterogeneous data processing procedure on the multidimensional vulnerability mining dataset to extract the source code semantic slice set, the binary component interface profile set, and the runtime interaction behavior time-series trajectory set includes: Perform syntax parsing and abstract syntax tree construction on the aforementioned collection of source code documents to obtain an abstract syntax tree; Based on a pre-defined security-sensitive code pattern rule base, the abstract syntax tree is scanned for pattern matching to identify security-related code structure nodes. Centered on the security-related code structure nodes, and combining data dependencies and control dependencies, forward and backward slicing is performed to generate the source code semantic slice set; Disassembly and symbolic preprocessing are performed on the binary component set to identify function boundaries, system call points, and external interfaces; Extract the input / output parameter features, calling convention features, and stack usage features of each identified function boundary, system call point, and external interface, and combine them to form the binary component interface profile set; Event extraction and timing alignment are performed on the runtime log document set to separate different software execution threads. For each thread, a set of runtime interaction behavior timing trajectories containing system call sequences, memory access sequences, and exception signal sequences is constructed.

[0008] As a further aspect of the present invention, the step of invoking a preset feature semantic alignment engine to perform semantic consistency comparison on the source code semantic slice set and the binary component interface profile set, and identifying potential semantic breaks and mapping offset sets, includes: In the feature semantic alignment engine, a source code semantic feature space and a binary interface feature space are established; Each slice in the source code semantic slice set is mapped to the source code semantic feature space to generate a source code semantic feature vector; Each profile in the binary component interface profile set is mapped to the binary interface feature space to generate a binary interface feature vector. Calculate the cross-spatial semantic distance between the source code semantic feature vector and the binary interface feature vector; When the cross-spatial semantic distance exceeds a preset semantic consistency threshold, a semantic gap is determined to exist, and the corresponding source code semantic slice and binary component interface profile are recorded to form the semantic gap and mapping offset set.

[0009] As a further aspect of the present invention, the construction of the code-behavior association network involves dynamically associating features in the semantic fault and mapping offset set with features in the runtime interaction behavior temporal trajectory set to generate an abnormal behavior pattern set containing associated paths, including: Each feature in the semantic fault and mapping offset set is used as a source node of the network, and each behavioral feature in the runtime interaction behavior time-series trajectory set is used as a target node of the network. In the code-behavior association network, directed edges are established between the source node and the target node according to preset association rules. The association rules include time association, data flow association, and logical association. A path exploration algorithm is executed on the code-behavior association network to find all paths that can reach one or more target nodes, starting from each source node. Paths that meet the abnormal behavior judgment conditions are selected, including access out of bounds, privilege escalation, and unauthorized operation. The selected paths and the node features they pass through are combined to form the abnormal behavior pattern set containing related paths.

[0010] As a further aspect of the present invention, the step of inputting the set of abnormal behavior patterns into a pre-trained generative AI vulnerability assessment model, and generating a set of candidate vulnerability descriptions containing potential vulnerability locations, triggering paths, and impact contexts through a multi-layered associative reasoning structure within the model, includes: In the input layer of the pre-trained generative AI vulnerability assessment model, the abnormal behavior pattern set is serialized and encoded to generate a pattern feature sequence. The pattern feature sequence is input into the multi-layered associative reasoning structure of the pre-trained generative AI vulnerability assessment model. At each layer, the model performs self-attention calculation and cross-layer information transmission on the feature sequence, gradually focusing on high-risk abnormal behavior patterns. At the output layer of the pre-trained generative AI vulnerability assessment model, the focused features are decoded based on the learned vulnerability pattern knowledge to generate a set of candidate vulnerability descriptions in natural language. Each description contains at least one potential vulnerability location, a complete path from input to vulnerability triggering, and the context of the impact of the vulnerability on system functions or data after it is triggered.

[0011] As a further aspect of the present invention, the step of performing cross-version historical verification on the candidate vulnerability description set, matching similar historical vulnerability patterns from the historical vulnerability knowledge base, and generating a verified enhanced vulnerability description set includes: Key information is extracted from each natural language description in the candidate vulnerability description set to obtain a standardized vulnerability feature tuple, which includes vulnerability type, involved components, triggering conditions, and scope of impact. Using the standardized vulnerability feature tuples as query conditions, a multi-dimensional similarity search is performed in the historical vulnerability knowledge base. The multi-dimensional similarity search includes text-based semantic similarity search, code feature-based similarity search, and behavior pattern-based similarity search. The search results are sorted by similarity, and historical vulnerability patterns with similarity exceeding the verification threshold are selected as similar historical vulnerabilities. By fusing the repair records of similar historical vulnerabilities, the exploitation of code features, and the actual impact information with the candidate vulnerability descriptions, a more complete and accurate set of enhanced vulnerability descriptions is generated.

[0012] As a further aspect of the present invention, the step of performing a risk situation assessment based on the enhanced vulnerability description set, calculating the attack entry point exposure, exploitation path feasibility, and system impact range corresponding to each potential vulnerability location, and forming a structured risk quantification matrix includes: Based on the enhanced vulnerability description set, the network service, user interface or local function where each potential vulnerability is located is analyzed. Combined with the deployment environment and access control configuration of the component, the attack entry exposure is quantitatively calculated. The attack entry exposure reflects the possibility that the vulnerability can be accessed by external or internal attackers. Based on the triggering paths and conditions described in the enhanced vulnerability description set, and combined with the actual operating environment and resource constraints of the target software, the complexity and resource requirements of the steps required for an attacker to successfully exploit the vulnerability are assessed, and the feasibility of the exploitation path is quantitatively calculated. Based on the impact context described in the enhanced vulnerability description set, and combined with the system architecture and data flow diagram of the target software, the data scope, functional modules and dependent services affected after the vulnerability is exploited are analyzed, and the system impact scope is quantitatively calculated. The quantitative values ​​of each potential vulnerability across three dimensions—attack entry point exposure, exploitation path feasibility, and system impact scope—are organized according to vulnerability identifiers to form the structured risk quantification matrix.

[0013] As a further aspect of the present invention, the step of performing risk level mapping based on the structured risk quantification matrix, mapping each potential vulnerability to a preset risk level classification framework, and generating risk level labeling results includes: Obtain a preset risk level classification framework, which defines the numerical range combination of different risk levels in three dimensions: attack entry point exposure, exploitation path feasibility, and system impact scope. For each potential vulnerability in the structured risk quantification matrix, extract the quantified values ​​of its corresponding attack entry exposure, exploitation path feasibility, and system impact scope. The three dimensions of each potential vulnerability are quantified and matched with the numerical ranges defined in the risk level classification framework to find the combination of numerical ranges that fully match or are closest to the target. The risk level corresponding to the combination of the found numerical ranges is used as the risk level of the potential vulnerability. After mapping all potential vulnerabilities, a risk level labeling result containing each vulnerability identifier and its corresponding risk level is generated.

[0014] As a further aspect of the present invention, the step of combining the risk level labeling results and the enhanced vulnerability description set to generate a remediation strategy, generating a corresponding remediation suggestion set and remediation priority sequence for each risk level, includes: Based on the risk level labeling results, the vulnerabilities in the enhanced vulnerability description set are grouped according to their risk level; Vulnerabilities are grouped according to each risk level, and common remediation patterns and suggestions are retrieved from a pre-defined remediation strategy knowledge base; For each specific vulnerability, the general remediation pattern and suggestions are adapted and specified by combining its code context, binary interface and the enhanced vulnerability description, to generate specific remediation suggestions for the vulnerability. Within the same risk level group, vulnerabilities are ranked according to the feasibility of their exploitation paths and the quantitative values ​​of their system impact. Vulnerabilities with higher feasibility and greater impact are ranked higher, forming the remediation priority sequence. The specific remediation recommendations and remediation priority sequences for all vulnerabilities within each risk level group are summarized to form a tiered set of remediation recommendations and remediation priority sequences.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: A pre-trained generative AI vulnerability assessment model and its internal multi-layered associative reasoning structure are employed to handle anomalous behavior patterns. Through the attention mechanism and sequence generation capabilities of its deep neural network, this model can automatically learn the complex mapping relationships between code patterns, runtime behavior, and vulnerability semantics. It can connect discrete anomalies into complete attack chains and directly generate natural language descriptions containing specific code locations, triggering conditions, and potential impacts. This enables the vulnerability discovery process to automatically infer novel or complex logical vulnerabilities from multi-source heterogeneous data that are difficult to cover by traditional rule-based methods, reducing the workload of manual analysis and improving the richness and understandability of vulnerability descriptions.

[0016] Risk assessment is conducted by defining quantitative indicators across three dimensions: attack entry point exposure, exploit path feasibility, and system impact scope, forming a structured risk quantification matrix. This approach transforms abstract vulnerability characteristics into concrete, calculable engineering parameters. Attack entry point exposure assesses the reachability of the vulnerable interface; exploit path feasibility analyzes the complexity of the steps required for successful exploitation and the probability of fulfilling the conditions; and system impact scope defines the affected components and services. This matrix-based output breaks the limitations of a single risk score, presenting a comprehensive risk landscape from multiple independent and critical perspectives. Security teams can use this matrix to clearly identify critical vulnerabilities exposed to the external network with simple exploitation, or internal vulnerabilities with a large impact but demanding exploitation conditions, thereby developing remediation strategies and resource allocation plans tailored to the specific circumstances. Attached Figure Description

[0017] Figure 1This is a flowchart of the generative AI-based intelligent software security vulnerability mining and risk assessment method described in this invention. Figure 2 A flowchart for generating a set of abnormal behavior patterns; Figure 3 This is a flowchart for feature semantic alignment and semantic tomography recognition. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0020] See Figure 1 The system collects source code documents, binary component sets, and runtime log documents of the target software. Based on this multi-source data, it generates a set of abnormal behavior patterns. This set of abnormal behavior patterns is then input into a pre-trained generative AI vulnerability assessment model. The model processes the data through its internal multi-layered associative reasoning structure, outputting a set of candidate vulnerability descriptions containing the location of potential vulnerabilities, trigger paths, and impact contexts. Cross-version historical verification is then performed on the candidate vulnerability descriptions. By matching similar historical vulnerability patterns from a historical vulnerability knowledge base, the candidate descriptions are verified and enriched, generating a more complete set of enhanced vulnerability descriptions. Based on this enhanced set, a risk situation assessment is performed, quantifying the attack entry exposure, exploitation path feasibility, and system impact scope of each potential vulnerability, forming a structured risk quantification matrix. Risk level mapping is then performed based on this matrix, assigning a risk level to each potential vulnerability according to a pre-defined risk level classification framework, generating risk level labeling results. Finally, combining the risk level labeling results and the enhanced vulnerability description set, a set of remediation suggestions and a remediation priority sequence are generated for vulnerabilities of different risk levels. All information is integrated into the final risk assessment report.

[0021] See Figure 2In one embodiment of the present invention, the target software is an application that provides network services, comprising a collection of source code documents written in a high-level programming language, a collection of binary components generated after compilation, and a collection of runtime log documents generated when the software runs in a test environment. A multi-dimensional vulnerability mining dataset is constructed based on the source code document collection, the binary component collection, and the runtime log document collection. The dataset is organized as a structured data table containing path indexes and content references.

[0022] In practice, a heterogeneous data processing flow is executed on the multi-dimensional vulnerability mining dataset to extract a set of semantic slices from the source code, a set of binary component interface profiles, and a set of runtime interaction behavior time-series trajectories. The processing flow performs syntax parsing and abstract syntax tree construction on the source code document set to obtain an abstract syntax tree representing the program's syntactic structure. Based on a pre-defined security-sensitive code pattern rule base, pattern matching is performed on the abstract syntax tree. This rule base includes rules for memory copy operations, format string functions, and user input receiving points. The pattern matching scan identifies security-related code structure nodes, such as a code node that calls the `memcpy` function. Centered on these security-related code structure nodes, forward and backward slicing is performed based on data dependencies and control dependencies. Forward slices trace the data flow originating from the node, while backward slices trace the data sources affecting the node's value, generating a set of semantic slices from the source code. An example slice is "the data dependency chain from the user input buffer to the length parameter of the `memcpy` function."

[0023] In its implementation, the heterogeneous data processing workflow simultaneously performs disassembly and symbolic execution preprocessing on the binary component set. Disassembly converts machine instructions into assembly instruction streams, while symbolic execution preprocessing identifies function boundaries, system call points, and external interfaces, including imported functions from dynamic link libraries. Input / output parameter features, calling convention features, and stack usage features are extracted for each identified function boundary, system call point, and external interface. Input / output parameter features describe the number and type of parameters, calling convention features describe register usage, and stack usage features describe the size of local variable space. These features combine to form a set of binary component interface profiles. The heterogeneous data processing workflow also performs event extraction and timing alignment on the runtime log document set. Event extraction identifies system call events, memory access events, and exception signal events from the raw log text. Timing alignment, based on high-precision timestamps, merges events into different software execution threads, constructing a runtime interaction behavior timing trajectory set for each thread, containing system call sequences, memory access sequences, and exception signal sequences.

[0024] A pre-defined feature semantic alignment engine is invoked to perform semantic consistency comparison on the set of source code semantic slices and the set of binary component interface profiles, identifying potential semantic gaps and mapping offsets. In practice, the feature semantic alignment engine internally establishes a source code semantic feature space and a binary interface feature space, both with the same dimension for mapping. Each slice in the source code semantic slice set is mapped to the source code semantic feature space. The mapping process is based on the slice's code vocabulary, control flow structure, and data flow features, generating a source code semantic feature vector. Each profile in the binary component interface profile set is mapped to the binary interface feature space. The mapping process is based on the profile's instruction sequence, register usage pattern, and stack pattern, generating a binary interface feature vector. The cross-space semantic distance between the source code semantic feature vector and the binary interface feature vector is calculated using the Euclidean distance formula. in: Indicates cross-space semantic distance, The semantic feature vector of the source code is represented in the th case. Dimension value, The binary interface feature vector is represented at the th Dimension value, This represents the total dimension of the feature space. When the cross-space semantic distance exceeds a preset semantic consistency threshold, a semantic gap is determined to exist. The corresponding source code semantic slices and binary component interface profiles are recorded to form a semantic gap and mapping offset set. An example of a record is "a buffer operation with boundary checks in the source code corresponds to a fast copy instruction without boundary checks in the binary".

[0025] A code-behavior association network is constructed, which dynamically correlates features in the semantic fragmentation and mapping offset set with features in the runtime interaction behavior time-series trajectory set to generate a set of abnormal behavior patterns containing associated paths. In some embodiments, the code-behavior association network uses each feature in the semantic fragmentation and mapping offset set as a source node and each behavior feature in the runtime interaction behavior time-series trajectory set as a target node. In the code-behavior association network, directed edges are established between source nodes and target nodes according to preset association rules. The association rules include temporal association, data flow association, and logical association. Temporal association requires that the events represented by the nodes occur at similar times, data flow association requires that there is direct or indirect data transmission between the nodes, and logical association requires that the nodes belong to the same business operation sequence.

[0026] A path exploration algorithm is executed on the code-behavior association network. This algorithm employs depth-first search, starting from each source node to find all paths leading to one or more target nodes. Paths that meet the criteria for abnormal behavior are selected. These criteria include out-of-bounds access, privilege escalation, and unauthorized operations. Out-of-bounds access checks if the memory address exceeds the allocated range; privilege escalation checks if the operation context has been expanded unconventionally; and unauthorized operation checks if the operator lacks the necessary credentials. The selected paths and the characteristics of the nodes they traverse are combined to form a set of abnormal behavior patterns containing associated paths. An example of an abnormal behavior pattern is a "complete association path from source code semantic gaps (missing length checks) to binary interface offsets (dangerous calls) to runtime behavior (writing excessively long data)."

[0027] See Figure 3 In one embodiment of the present invention, an example scenario is a buffer operation module of a network server software. A source code semantic feature space and a binary interface feature space are established in a preset feature semantic alignment engine. The dimensions of the source code semantic feature space include variable type, control flow depth, and data dependency chain length. The dimensions of the binary interface feature space include instruction opcode, register usage mode, and stack offset. The two feature spaces are set to have the same number of dimensions to achieve vector alignment. In a specific implementation, a slice from the source code semantic slice set is mapped to the source code semantic feature space. The mapping process analyzes the variable type "character pointer," control flow depth "3," and data dependency chain length "2" contained in the source code semantic slice to generate a source code semantic feature vector S=(1,3,2). In a specific implementation, a corresponding profile from the binary component interface profile set is mapped to the binary interface feature space. The mapping process analyzes the opcode of the binary instruction sequence, the number of general-purpose registers used, and the base address offset of the stack frame to generate a binary interface feature vector B=(5,1,8). In practice, the cross-space semantic distance between the source code semantic feature vector and the binary interface feature vector is calculated using the Manhattan distance formula: in: Indicates cross-space semantic distance, The semantic feature vector of the source code is represented in the th case. The value of dimension, The binary interface feature vector is represented at the th The value of dimension, This represents the total dimension of the feature space. Based on this formula, the cross-space semantic distance is calculated. When the cross-space semantic distance calculation result exceeds the preset semantic consistency threshold "5", it is determined that there is a semantic gap between the source code semantic slice "string copy with length check" and the binary component interface profile "block copy instruction without length check". The semantic gap and mapping offset set formed between the source code semantic slice and the binary component interface profile are recorded.

[0028] A code-behavior association network is constructed. This network uses features from a semantic fragmentation and mapping offset set as a source node and behavioral features from a runtime interaction behavior time-series trajectory set as a target node. In the code-behavior association network, directed edges are established between the source and target nodes according to preset association rules. These rules include temporal association (requiring the difference between the instruction execution timestamp represented by the source node and the memory write timestamp represented by the target node to be less than a set threshold), data flow association (requiring the output register of the source node's instruction to be the address source of the target node's memory write operation), and logical association (requiring the source and target nodes to belong to the same client request processing thread). In some embodiments, the process of establishing directed edges checks whether at least one association rule is satisfied between the source and target nodes; only if the rule is satisfied will a connection be created in the code-behavior association network.

[0029] A pathfinding algorithm is executed on the code-behavior network. Starting from the source node "Binary Interface Profile: Block Copy Instruction with No Length Check," the algorithm performs a depth-first search along directed edges in the network to find all paths that can reach the target node "Runtime Interaction Behavior Timing Trajectory: Writing to Memory Address Exceeding Allocation Boundaries." During the search, the algorithm records intermediate nodes, such as the node "Runtime Interaction Behavior Timing Trajectory: Receiving Oversized Network Data Packets." Paths that meet the abnormal behavior criteria are filtered out. The abnormal behavior criteria include: access out-of-bounds checks to ensure the memory address represented by the target node in the path actually exceeds the boundary of the buffer allocated on the heap; privilege escalation checks to ensure the path contains an unauthenticated switch from a low-privilege user context to a high-privilege kernel context; and unauthorized operation checks to ensure the write operation occurs in a memory region associated with an unverified session identifier.

[0030] In one embodiment of the present invention, the example scenario is a user authentication module of a network service. The generated abnormal behavior pattern set includes multiple patterns such as "authentication logic bypass", "session token forgery" and "buffer overflow". Each abnormal behavior pattern is represented as a graph structure or feature vector list with node and edge attributes. In the input layer of the pre-trained generative AI vulnerability assessment model, the abnormal behavior pattern set is serialized and encoded to generate a pattern feature sequence. The serialization and encoding process converts the graph structure or feature vector list of each abnormal behavior pattern into a fixed-dimensional numerical vector through the embedding layer, and concatenates the numerical vectors of all patterns into a long pattern feature sequence in a predefined order.

[0031] In practical implementation, the pattern feature sequence is input into the multi-layered associative reasoning structure of the pre-trained generative AI vulnerability assessment model. The multi-layered associative reasoning structure consists of multiple stacked Transformer decoder layers. In each layer, the model performs self-attention calculation and cross-layer information transfer on the input pattern feature sequence. Self-attention calculation enables the feature at each position in the sequence to interact with the features at all other positions, thereby capturing the potential correlation between different abnormal behavior patterns. For example, the model may calculate the attention weight between the "buffer overflow" pattern feature and the "authentication logic bypass" pattern feature. Cross-layer information transfer combines the local features learned at the lower layers into a higher-level global feature representation through feedforward neural networks and residual connections. Through multi-layer processing, the model gradually focuses on high-risk abnormal behavior patterns. For example, after three layers of calculation, the attention weight assigned to the "buffer overflow" pattern increases from the initial 0.15 to 0.72, while the attention weight assigned to a low-risk "log format error" pattern decreases from 0.20 to 0.03.

[0032] In some embodiments, during the self-attention calculation process, the model generates a query vector, a key vector, and a value vector for each feature vector in the sequence. By calculating the dot product of the query vector and all key vectors and applying the softmax function, a set of attention weights is obtained, which are used to weight and sum the value vector. Optionally, the formula for calculating the attention weights can be expressed as: in: This represents the attention weight of the features at position u to the features at position v. This represents the query vector corresponding to the feature at position u. This represents the key vector corresponding to the feature at position v. The dimension of the key vector. This represents the total length of the pattern feature sequence. This calculation allows the model to dynamically measure the correlation between features of different anomalous behavior patterns.

[0033] In the output layer of the pre-trained generative AI vulnerability assessment model, the high-level feature representation after being focused by a multi-layered associative reasoning structure is decoded based on the vulnerability pattern knowledge learned by the model during the training phase. The decoding process is an autoregressive text generation process. The model uses the tokens generated by the previous layer as input to predict the next token and generate a set of candidate vulnerability descriptions in natural language. Each description contains at least one potential vulnerability location, a complete path from the input to the vulnerability trigger, and the context of the impact of the vulnerability on system functions or data after it is triggered.

[0034] In one embodiment of the present invention, the candidate vulnerability description set includes a natural language description: "The heap buffer in the parse_packet() function on line 203 of the / src / network / protocol.c file is at risk of overflow. When processing a protocol packet with type code 0xA1, an attacker can construct an excessively long data field to trigger the overflow, overwriting the adjacent function pointer, which may lead to arbitrary code execution." Key information is extracted from this natural language description in the candidate vulnerability description set. The extraction process utilizes named entity recognition and dependency parsing techniques to identify and standardize key entities and relationships from the description text, obtaining standardized vulnerability feature tuples. These vulnerability feature tuples include the vulnerability type "buffer overflow," the involved component "parse_packet function in protocol.c," the triggering condition "receiving a network packet with type code 0xA1 and an excessively long data field," and the scope of impact "may overwrite the function pointer, leading to arbitrary code execution."

[0035] Using standardized vulnerability feature tuples as query criteria, a multi-dimensional similarity search is performed in the historical vulnerability knowledge base. This base stores publicly disclosed vulnerability records containing information such as CVE numbers, descriptions, affected versions, and patches. The multi-dimensional similarity search includes text-based semantic similarity search, code feature-based similarity search, and behavior pattern-based similarity search. Text-based semantic similarity search compares the semantic vectors of the vulnerability description text; code feature-based similarity search compares the control flow graph similarity between the function under test and historical vulnerability functions; and behavior pattern-based similarity search compares the step sequence of the trigger path under test and the exploit path of historical vulnerabilities. The search results are then sorted by similarity. Similarity calculation is a weighted fusion of results from multiple search methods. Historical vulnerability patterns with similarity exceeding a verification threshold are selected as similar historical vulnerabilities. For example, a match is found for CVE-2021-1234, described as "a heap buffer overflow vulnerability exists when a certain open-source protocol stack parses a specific type of data packet."

[0036] This approach fuses information from similar historical vulnerability remediation records, exploit code features, and actual impact information with candidate vulnerability descriptions. The remediation records indicate that boundary checks were added in historical versions to fix the vulnerability. The exploit code features show common padding patterns in the data field of samples that historically exploited this vulnerability. The actual impact information records real-world cases where this vulnerability led to remote code execution. This fusion of information generates a more complete and accurate set of enhanced vulnerability descriptions. One example of an enhanced vulnerability description is: "The heap buffer in the parse_packet() function on line 203 of the / src / network / protocol.c file is at risk of overflow (similar to the CVE-2021-1234 pattern). When processing protocol packets with type code 0xA1, an attacker can construct an excessively long data field to trigger an overflow, overwriting the adjacent callback_handler function pointer. Historical exploit code shows that attackers often pad this field with shellcode. This vulnerability can lead to remote arbitrary code execution, and similar vulnerabilities have been used historically to implant backdoors." Table 1: Matching Table of Candidate Vulnerabilities and Historical Vulnerabilities Based on the enhanced vulnerability description set, a risk posture assessment is performed, analyzing the network service, user interface, or local function where each potential vulnerability resides. Combining the component's deployment environment and access control configuration, the attack entry point exposure is quantified. Attack entry point exposure reflects the likelihood that the vulnerability can be accessed by external or internal attackers. In specific implementation, for the `parse_packet` function in the above enhanced vulnerability description, the network service it resides in listens on TCP port 8080 and is open to the public network. The access control configuration is only a simple IP whitelist. The attack entry point exposure value E can be calculated using a formula that integrates network exposure, authentication strength, and service reachability. Its formal expression is: in: The score represents the degree of exposure of the attack entry point. Indicates network exposure value. Indicates the access control strength value. Indicates the service reachability value. , , The preset weighting coefficients satisfy... .

[0037] Based on the triggering paths and conditions described in the enhanced vulnerability description set, and considering the actual operating environment and resource constraints of the target software, the complexity and resource requirements of the steps required for an attacker to successfully exploit the vulnerability are assessed, and the feasibility of the exploitation path is quantified. In some embodiments, for the aforementioned buffer overflow vulnerability, the triggering path requires the attacker to construct and send a network packet with a specific type of code and an excessively long data field. The target software runs on an operating system with non-executable memory protection, which increases the complexity of the exploitation. The feasibility value F of the exploitation path is quantified based on the number of steps required, the required special knowledge, and the success rate. A high feasibility value means that the steps are simple, the required knowledge is common, and there is a historical success rate of exploitation.

[0038] In one embodiment of the present invention, a preset risk level classification framework is obtained. The risk level classification framework is defined in tabular form, which clarifies the numerical ranges corresponding to the four risk levels of critical, high-risk, medium-risk, and low-risk in three dimensions: attack entry point exposure, exploitation path feasibility, and system impact range. For example, the critical level requires an attack entry point exposure quantification value greater than 0.8, an exploitation path feasibility quantification value greater than 0.7, and a system impact range quantification value greater than 0.8. The high-risk level requires an attack entry point exposure quantification value between 0.6 and 0.8, an exploitation path feasibility quantification value between 0.5 and 0.7, or a system impact range quantification value between 0.6 and 0.8.

[0039] The process iterates through each potential vulnerability in the structured risk quantification matrix, extracting quantified values ​​for attack entry exposure, exploit path feasibility, and system impact scope for each vulnerability. The structured risk quantification matrix stores entries such as "Vulnerability ID: protocol.c:203, Attack Entry Exposure: 0.85, Exploitation Path Feasibility: 0.75, System Impact Scope: 0.90". The three-dimensional quantified values ​​of each potential vulnerability are matched against the numerical ranges defined in the risk level classification framework. The matching process checks whether each quantified value falls within the range defined for the corresponding risk level. The combination of numerical ranges that perfectly matches or is closest to the target risk level is found. For vulnerabilities that do not perfectly match any risk level range, the Euclidean distance between their three quantified values ​​and the center point of each risk level's defined range is calculated, and the risk level with the smallest distance is taken as the closest risk level. The risk level corresponding to the found numerical range combination is used as the risk level of the potential vulnerability. After mapping all potential vulnerabilities, a risk level labeling result containing each vulnerability ID and its corresponding risk level is generated. The risk level labeling result is a list containing entries such as "Vulnerability ID: protocol.c:203, Risk Level: Critical".

[0040] Combining the risk level labeling results and the enhanced vulnerability description set, a remediation strategy is generated. Based on the risk level labeling results, vulnerabilities in the enhanced vulnerability description set are grouped according to their risk level. All vulnerabilities marked as "critical" are grouped into one group, and all vulnerabilities marked as "high risk" are grouped into another. For each risk level vulnerability group, common remediation patterns and suggestions are retrieved from a pre-defined remediation strategy knowledge base. This knowledge base is a database storing common remediation code snippets, configuration modification suggestions, and design principles for different vulnerability types. For buffer overflow vulnerabilities in the "critical" group, the retrieved common remediation patterns might include "adding strict input boundary checks" and "replacing dangerous functions with safe memory copy functions."

[0041] Within the same risk level group, vulnerabilities are ranked based on the feasibility of their exploit path and the quantitative value of their system impact. Vulnerabilities with higher feasibility and greater impact are ranked higher. The ranking process calculates a ranking priority score P for each vulnerability, using the following formula: in: Indicates the sorting priority score. This represents a quantitative value indicating the feasibility of exploiting the vulnerability. This indicates a quantitative value representing the system impact scope of the vulnerability. This is a preset adjustment weighting coefficient used to balance the relative importance of feasibility (F) and impact scope (I) in the ranking. The weighting coefficient φ is usually set to 0.6 to give more weight to the feasibility of the utilization path. This formula ensures that the quantified values ​​of both dimensions contribute to the final ranking result. After calculation, vulnerabilities within the same risk level group are arranged in descending order of ranking priority score P, forming a remediation priority sequence.

[0042] The system compiles specific remediation recommendations and priority sequences for all vulnerabilities within each risk level group, forming a tiered set of remediation recommendations and a priority sequence. The remediation recommendation set is a structured document or database table organized by risk level. Under each level, it lists the identifier, detailed description, and corresponding specific remediation recommendations for all vulnerabilities. The priority sequence is an ordered list that clearly indicates which vulnerabilities should be addressed first within the same risk level. In some embodiments, the remediation recommendation set and priority sequence are integrated with a structured risk quantification matrix into the final risk assessment report. Optionally, the priority sequence can be further visualized, such as using a Gantt chart or priority matrix, to assist the security team in developing a remediation plan.

[0043] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A generative AI-based method for intelligent discovery and risk assessment of software security vulnerabilities, characterized in that, The method includes: Collect the target software's source code documents, binary components, and runtime log documents to generate a set of abnormal behavior patterns; The set of abnormal behavior patterns is input into a pre-trained generative AI vulnerability assessment model. Through the multi-layered correlation reasoning structure inside the model, a set of candidate vulnerability descriptions containing the location of potential vulnerabilities, triggering paths, and impact contexts is generated. Perform cross-version historical verification on the candidate vulnerability description set, match similar historical vulnerability patterns from the historical vulnerability knowledge base, and generate a verified enhanced vulnerability description set. Based on the enhanced vulnerability description set, a risk situation assessment is performed to calculate the attack entry exposure, exploitation path feasibility, and system impact range corresponding to each potential vulnerability location, forming a structured risk quantification matrix; Based on the structured risk quantification matrix, risk level mapping is performed to map each potential vulnerability to a preset risk level classification framework, generating risk level labeling results; Combining the risk level labeling results and the enhanced vulnerability description set, a remediation strategy is generated, producing a corresponding set of remediation suggestions and a remediation priority sequence for each risk level. The set of repair suggestions, the repair priority sequence, and the structured risk quantification matrix are integrated to generate the final risk assessment report.

2. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, The set of generated abnormal behavior patterns includes: A multidimensional vulnerability mining dataset is constructed based on a collection of source code documents, a collection of binary components, and a collection of runtime log documents. Perform heterogeneous data processing on the multidimensional vulnerability mining dataset to extract the source code semantic slice set, binary component interface profile set, and runtime interaction behavior time sequence trajectory set; A preset feature semantic alignment engine is invoked to perform semantic consistency comparison on the source code semantic slice set and binary component interface profile set to identify potential semantic breaks and mapping offset sets. Construct a code-behavior association network, and perform dynamic association analysis on the features in the semantic fault and mapping offset set and the features in the runtime interaction behavior time-series trajectory set to generate an abnormal behavior pattern set containing associated paths.

3. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 2, characterized in that, The process of performing heterogeneous data processing on the multidimensional vulnerability mining dataset to extract the source code semantic slice set, binary component interface profile set, and runtime interaction behavior time-series trajectory set includes: Perform syntax parsing and abstract syntax tree construction on the aforementioned collection of source code documents to obtain an abstract syntax tree; Based on a pre-defined security-sensitive code pattern rule base, the abstract syntax tree is scanned for pattern matching to identify security-related code structure nodes. Centered on the security-related code structure nodes, and combining data dependencies and control dependencies, forward and backward slicing is performed to generate the source code semantic slice set; Disassembly and symbolic preprocessing are performed on the binary component set to identify function boundaries, system call points, and external interfaces; Extract the input / output parameter features, calling convention features, and stack usage features of each identified function boundary, system call point, and external interface, and combine them to form the binary component interface profile set; Event extraction and timing alignment are performed on the runtime log document set to separate different software execution threads. For each thread, a set of runtime interaction behavior timing trajectories containing system call sequences, memory access sequences, and exception signal sequences is constructed.

4. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 2, characterized in that, The process involves invoking a preset feature semantic alignment engine to perform a semantic consistency comparison on the source code semantic slice set and the binary component interface profile set, identifying potential semantic gaps and mapping offset sets, including: In the feature semantic alignment engine, a source code semantic feature space and a binary interface feature space are established; Each slice in the source code semantic slice set is mapped to the source code semantic feature space to generate a source code semantic feature vector; Each profile in the binary component interface profile set is mapped to the binary interface feature space to generate a binary interface feature vector. Calculate the cross-spatial semantic distance between the source code semantic feature vector and the binary interface feature vector; When the cross-spatial semantic distance exceeds a preset semantic consistency threshold, a semantic gap is determined to exist, and the corresponding source code semantic slice and binary component interface profile are recorded to form the semantic gap and mapping offset set.

5. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 2, characterized in that, The constructed code-behavior association network dynamically correlates features in the semantic fragmentation and mapping offset set with features in the runtime interaction behavior temporal trajectory set to generate a set of abnormal behavior patterns containing associated paths, including: Each feature in the semantic fault and mapping offset set is used as a source node of the network, and each behavioral feature in the runtime interaction behavior time-series trajectory set is used as a target node of the network. In the code-behavior association network, directed edges are established between the source node and the target node according to preset association rules. The association rules include time association, data flow association, and logical association. A path exploration algorithm is executed on the code-behavior association network to find all paths that can reach one or more target nodes, starting from each source node. Paths that meet the abnormal behavior judgment conditions are selected, including access out of bounds, privilege escalation, and unauthorized operation. The selected paths and the node features they pass through are combined to form the abnormal behavior pattern set containing related paths.

6. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, The process involves inputting the set of abnormal behavior patterns into a pre-trained generative AI vulnerability assessment model. Through the model's multi-layered associative reasoning structure, a set of candidate vulnerability descriptions is generated, including the location of potential vulnerabilities, trigger paths, and impact contexts. In the input layer of the pre-trained generative AI vulnerability assessment model, the abnormal behavior pattern set is serialized and encoded to generate a pattern feature sequence. The pattern feature sequence is input into the multi-layered associative reasoning structure of the pre-trained generative AI vulnerability assessment model. At each layer, the model performs self-attention calculation and cross-layer information transmission on the feature sequence, gradually focusing on high-risk abnormal behavior patterns. At the output layer of the pre-trained generative AI vulnerability assessment model, the focused features are decoded based on the learned vulnerability pattern knowledge to generate a set of candidate vulnerability descriptions in natural language. Each description contains at least one potential vulnerability location, a complete path from input to vulnerability triggering, and the context of the impact of the vulnerability on system functions or data after it is triggered.

7. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, The step of performing cross-version historical verification on the candidate vulnerability description set, matching similar historical vulnerability patterns from the historical vulnerability knowledge base, and generating a verified enhanced vulnerability description set includes: Key information is extracted from each natural language description in the candidate vulnerability description set to obtain a standardized vulnerability feature tuple, which includes vulnerability type, involved components, triggering conditions, and scope of impact. Using the standardized vulnerability feature tuples as query conditions, a multi-dimensional similarity search is performed in the historical vulnerability knowledge base. The multi-dimensional similarity search includes text-based semantic similarity search, code feature-based similarity search, and behavior pattern-based similarity search. The search results are sorted by similarity, and historical vulnerability patterns with similarity exceeding the verification threshold are selected as similar historical vulnerabilities. By fusing the repair records of similar historical vulnerabilities, the exploitation of code features, and the actual impact information with the candidate vulnerability descriptions, a more complete and accurate set of enhanced vulnerability descriptions is generated.

8. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, Based on the enhanced vulnerability description set, a risk situation assessment is performed, calculating the attack entry point exposure, exploitation path feasibility, and system impact range corresponding to each potential vulnerability location, forming a structured risk quantification matrix, including: Based on the enhanced vulnerability description set, the network service, user interface or local function where each potential vulnerability is located is analyzed. Combined with the deployment environment and access control configuration of the component, the attack entry exposure is quantitatively calculated. The attack entry exposure reflects the possibility that the vulnerability can be accessed by external or internal attackers. Based on the triggering paths and conditions described in the enhanced vulnerability description set, and combined with the actual operating environment and resource constraints of the target software, the complexity and resource requirements of the steps required for an attacker to successfully exploit the vulnerability are assessed, and the feasibility of the exploitation path is quantitatively calculated. Based on the impact context described in the enhanced vulnerability description set, and combined with the system architecture and data flow diagram of the target software, the data scope, functional modules and dependent services affected after the vulnerability is exploited are analyzed, and the system impact scope is quantitatively calculated. The quantitative values ​​of each potential vulnerability across three dimensions—attack entry point exposure, exploitation path feasibility, and system impact scope—are organized according to vulnerability identifiers to form the structured risk quantification matrix.

9. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, The step involves performing risk level mapping based on the structured risk quantification matrix, mapping each potential vulnerability to a preset risk level classification framework, and generating risk level labeling results, including: Obtain a preset risk level classification framework, which defines the numerical range combination of different risk levels in three dimensions: attack entry point exposure, exploitation path feasibility, and system impact scope. For each potential vulnerability in the structured risk quantification matrix, extract the quantified values ​​of its corresponding attack entry exposure, exploitation path feasibility, and system impact scope. The three dimensions of each potential vulnerability are quantified and matched with the numerical ranges defined in the risk level classification framework to find the combination of numerical ranges that fully match or are closest to the target. The risk level corresponding to the combination of the found numerical ranges is used as the risk level of the potential vulnerability. After mapping all potential vulnerabilities, a risk level labeling result containing each vulnerability identifier and its corresponding risk level is generated.

10. The method for intelligent discovery and risk assessment of software security vulnerabilities using generative AI according to claim 1, characterized in that, The process combines the risk level labeling results and the enhanced vulnerability description set to generate a remediation strategy, producing a corresponding set of remediation suggestions and a remediation priority sequence for each risk level, including: Based on the risk level labeling results, the vulnerabilities in the enhanced vulnerability description set are grouped according to their risk level; Vulnerabilities are grouped according to each risk level, and common remediation patterns and suggestions are retrieved from a pre-defined remediation strategy knowledge base; For each specific vulnerability, the general remediation pattern and suggestions are adapted and specified by combining its code context, binary interface and the enhanced vulnerability description, to generate specific remediation suggestions for the vulnerability. Within the same risk level group, vulnerabilities are ranked according to the feasibility of their exploitation paths and the quantitative values ​​of their system impact. Vulnerabilities with higher feasibility and greater impact are ranked higher, forming the remediation priority sequence. The specific remediation recommendations and remediation priority sequences for all vulnerabilities within each risk level group are summarized to form a tiered set of remediation recommendations and remediation priority sequences.

Images