A vulnerability type identification method based on information retrieval and CWE knowledge graph

Abstract

The application provides a vulnerability type identification method based on information retrieval and CWE knowledge graph, and belongs to the technical field of software engineering. The technical problems of low accuracy of traditional vulnerability type identification methods are solved. The technical scheme is as follows: the method comprises the following steps: (1) collecting the codes, descriptions and corresponding CWE types of authoritative vulnerability sources, and processing them as local instance libraries; (2) calculating the similarity of the codes and descriptions of the target vulnerability respectively, adopting a hybrid reordering strategy based on AST syntax and Token lexical analysis to optimize the code retrieval result, and obtaining the top-k most similar instance samples according to a weighted fusion strategy; (3) designing a chain thinking prompt template. The application can accurately predict the CWE type to which the software vulnerability belongs.

Description

Technical Field

[0001] This invention relates to the field of software engineering technology, and in particular to a vulnerability type identification method based on information retrieval and CWE knowledge graph. Background Technology

[0002] With the rapid evolution of information technology and the widespread deployment of software systems, software has become a critical infrastructure supporting the operation of modern society. However, the scale and complexity of software systems are increasing exponentially, leading to a sharp rise in the frequency of security vulnerabilities. Attackers often exploit these vulnerabilities to commit system intrusions, data theft, or service disruptions, causing significant economic losses and security risks. In the overall framework of software security protection, vulnerability type identification is a core component, aiming to automatically categorize vulnerabilities into corresponding general vulnerability enumeration categories. This process helps security personnel quickly locate high-risk vulnerabilities, develop precise mitigation plans, and optimize the allocation efficiency of vulnerability remediation resources.

[0003] Currently, vulnerability type identification faces a contradiction between the rapidly expanding data volume and low classification efficiency. Statistics show that in 2023 alone, the U.S. National Vulnerability Database included tens of thousands of new vulnerabilities, many of which have not yet been classified in a timely manner. The traditional method of relying on manual classification by security experts is not only time-consuming and labor-intensive, but also struggles to meet the demands of the ever-increasing number of vulnerabilities. To address this challenge, academia has proposed various automated classification methods based on machine learning and deep learning. Early research often utilized only a single source of information, such as vulnerability description text alone or feature modeling based solely on source code analysis. However, these single-modal methods have significant shortcomings: vulnerability descriptions often contain semantic ambiguity or vague expressions, making it difficult to accurately reflect the technical essence of the vulnerability; while relying solely on code analysis often fails to capture high-level semantic context. Incomplete information utilization prevents the model from fully understanding the causes of vulnerabilities, thus limiting the improvement of classification accuracy.

[0004] In recent years, large language models, represented by the GPT series, have made significant progress in code understanding and generation tasks, providing new possibilities for vulnerability analysis. However, directly applying large language models to vulnerability type identification still faces several significant challenges. First, the distribution of vulnerability types in real-world scenarios exhibits a significant long-tail characteristic, meaning that a few common categories contain a large number of samples, while most rare categories have extremely limited samples. Existing fine-tuning methods or fully supervised models are prone to significant performance degradation when facing the tail categories with scarce samples due to insufficient training data. Second, while general-purpose large language models possess extensive world knowledge, they lack structured understanding of the software security domain, leading them to often rely on surface features during reasoning, making it difficult to deeply understand the internal logic of vulnerabilities and easily producing inconsistent or unrealistic classification results. Therefore, how to effectively integrate bimodal information from source code and text descriptions, and leverage external domain knowledge to guide large models to mitigate the impact of long-tail distribution, thereby achieving accurate and interpretable vulnerability type identification, has become a pressing technical challenge. Solving these technical problems is the subject of this invention. Summary of the Invention

[0005] The purpose of this invention is to provide a vulnerability type identification method based on information retrieval and CWE knowledge graph, to overcome the technical problems of existing software vulnerability classification technologies, such as low type identification rate, insufficient utilization of domain knowledge, and unexplainable reasoning process. This method can accurately predict the CWE type to which a software vulnerability belongs.

[0006] The core idea of ​​this invention is to propose a vulnerability type identification method (VulTypeRAG) based on information retrieval and CWE knowledge graph. This method fully leverages the semantic understanding capabilities of a large language model and introduces a structured knowledge enhancement mechanism. This allows the model to utilize authoritative auxiliary information such as the hierarchical system of the Common Weakness Enumeration (CWE) and historical vulnerability instances during the reasoning process, thereby compensating for the knowledge blind spots of the large model in specific security domains. Through a bimodal retrieval enhancement generation module, the model dynamically selects historical samples from its local instance library that are most relevant to the code structure and text description of the input vulnerability, and extracts their associated CWE hierarchical paths to form a knowledge enhancement context. Subsequently, combined with a thought chain hint mechanism, the large language model is guided to perform progressive reasoning from coarse-grained to fine-grained, ultimately outputting the CWE type corresponding to the specific target vulnerability. The VulTypeRAG method proposed in this invention can efficiently and accurately complete the vulnerability type classification task by leveraging the reasoning capabilities of the large model and CWE graph knowledge.

[0007] This invention is achieved through the following measures: a vulnerability type identification method based on information retrieval and CWE knowledge graph, comprising the following steps: (1) Collect vulnerability records from the official vulnerability platform, filter out C / C++ related samples, extract key information such as the CWE number, source code and related description of each sample, and construct an initial dataset. Then clean and deduplicate the data, exclude samples that cannot generate a syntax tree and vulnerability types that have been marked as obsolete, and use the preferred labels of the samples for standardization.

[0008] (2) Based on the preprocessed basic dataset, the vulnerability types are first sorted according to the number of samples. Types with more than 200 samples are classified as the head category; types with 50 to 200 samples are classified as the middle category; and the remaining types with fewer than 50 samples are classified as the tail category. At the same time, categories with fewer than 20 samples are merged and uniformly classified into the "remaining" category. Then, the entire dataset is randomly divided into training set, validation set, and test set in a ratio of 80%:10%:10%. During the partitioning process, a stratified sampling strategy is adopted to ensure that the distribution ratio of each vulnerability type in each subset is consistent with that of the original dataset. The training set is used as an instance knowledge base, and according to the hierarchical standards defined in the CWE VIEW-1000 view, the corresponding CWE hierarchical knowledge graph is parsed and constructed to form a graph-structured knowledge base.

[0009] (3) For the vulnerability samples to be predicted, independent code similarity and description similarity indices are obtained by calculating their similarity to the code structure features and natural language description features of the samples in the instance knowledge base. In this process, a hybrid syntactic and lexical reordering strategy based on abstract syntax trees is introduced to optimize the code retrieval candidate set. Subsequently, a dual-modal weighted fusion method is used to combine the optimized code similarity and description similarity according to preset weights to generate a comprehensive similarity score. Based on this score, the top k most relevant vulnerability samples are selected from the instance knowledge base. At the same time, relying on the constructed CWE hierarchical knowledge graph, the CWE hierarchical paths corresponding to these samples and the structured information of all nodes on the paths are queried and extracted. These retrieved sample features and graph knowledge will be integrated to construct the prompt content in the subsequent thought chain reasoning. Specifically, the following steps are included: (3-1) For the vulnerability samples to be evaluated, the feature representations of their source code and description are extracted by pre-trained models: the source code is encoded using CodeBERT to generate the corresponding code vector; at the same time, the vulnerability description text is encoded using the CoSENT model to obtain the text vector representation.

[0010] (3-2) The similarity between the target vulnerability and samples in the knowledge base is calculated in both code and text modalities. In the text modal, cosine similarity is used directly to measure the relevance between description vectors. In the code modal, a hybrid syntactic and lexical reordering method is employed: first, a preliminary candidate set is selected based on vector cosine similarity; then, Tree-Sitter is used to parse the code and generate an abstract syntax tree sequence, and syntactic similarity is calculated based on normalized edit distance; simultaneously, the code is divided into lexical units, and lexical similarity is evaluated using the Jaccard coefficient; finally, the two types of similarity are weighted and fused with weights of 0.4 and 0.6 respectively to form the final similarity score for the code modal.

[0011] (3-3) The bimodal similarity is weighted and fused using adjustable parameters to obtain a comprehensive similarity score. The code similarity weight is set to 60%, and the text similarity weight is set to 40% to take into account the role of code structure and semantic information in order to generate the final comprehensive score.

[0012] (3-4) Based on the comprehensive similarity, the candidate samples in the knowledge base are sorted in descending order, and the top 3 samples with the highest scores are selected as the retrieval results. These highly relevant samples not only contain source code and descriptive information, but also are associated with hierarchical path knowledge extracted from the CWE knowledge graph, which together serve as the input for subsequent thought chain prompts, supporting the large language model to complete the vulnerability reasoning and analysis tasks.

[0013] (4) Based on the preset number of searches k, a thought chain prompt template is designed. The top-k retrieved vulnerability samples and their corresponding CWE-level path knowledge are embedded in the template, along with the source code and description information of the target vulnerability, to form a complete thought chain prompt input. This prompt template specifies the expert role setting in natural language, embeds a hierarchical vulnerability knowledge structure, and plans a reasoning logic including four steps. In this way, the large language model is guided to combine the semantic information of similar samples with the structural constraints of the CWE level, gradually refining the reasoning from the coarse-grained parent category to the fine-grained specific subclass, and finally completing the accurate prediction of the vulnerability type. Specifically, the following steps are included: (4-1) Clearly define the model's role and task in the prompt template, specifying that it is an expert in software vulnerability type classification and CWE analysis with professional knowledge background. At the beginning, guide the model to understand the task objective through natural language, prompting: "You are an expert in software vulnerability type classification and CWE analysis. Your task is to infer the CWE type of the target vulnerability step by step based on similar samples and CWE hierarchy knowledge." This ensures that the model focuses on using domain knowledge for type identification.

[0014] (4-2) Embed the knowledge enhancement part in the template, and provide the model with the top k similar vulnerability samples retrieved in step (3) and their corresponding structured CWE hierarchical path knowledge (including code snippets, descriptions, CWE-IDs, patch information, and hierarchical information such as parent categories, official definitions, extended descriptions, and common consequences). Arrange the retrieved knowledge using descending similarity sorting, so that the example most similar to the target vulnerability in semantics and structure is placed at the beginning of the template, establishing a strong semantic prior and guiding the model to perform step-by-step logical reasoning according to the structure of the template prompted by the thought chain. The template is clearly divided into four logical steps: (4-2-1) Provide the model with retrieved similar vulnerability samples and a complete CWE hierarchical path, which includes parent nodes, semantic inheritance links, and key attributes. By simultaneously presenting the content features of the samples and their position in the CWE classification system, the model gains a structured understanding of potential vulnerability types before inference, establishing a hierarchical and semantically coherent contextual foundation.

[0015] (4-2-2) requires the model to "perform fine-grained semantic mapping analysis on similar samples". At the code level, key patterns revealing weak behaviors are identified, and at the description level, linguistic cues of triggering conditions and potential consequences are extracted, thereby constructing a hierarchical semantic association of "program behavior - weakness type - potential consequences" and refining transferable feature patterns across different CWE types.

[0016] (4-2-3) requires the model to "use the CWE hierarchical chain for structured analysis". Examine the position of the sample in the hierarchical tree and the abstract semantic range of the parent category, and derive the necessary conditions for matching the CWE by combining the official definition and extended description, so as to clearly distinguish whether the sample has the specific features of the fine-grained subclass or only corresponds to the broad semantics of the higher-level parent class.

[0017] (4-2-4) Instruction model “Infer the CWE type of the target vulnerability”. The code and description of the target vulnerability are semantically aligned with the aforementioned samples in multiple dimensions, and the CWE hierarchical constraints are combined to determine whether the target satisfies the fine-grained subclass conditions or is closer to the parent class semantics. By jointly utilizing semantic similarity and hierarchical analysis, surface mismatches are eliminated, and the target vulnerability CWE-ID is finally output.

[0018] (4-3) By combining expert role setting, multimodal instance retrieval, CWE hierarchical knowledge graph embedding and progressive step-by-step reasoning logic, the prompt template achieves an organic unity from coarse-grained semantic perception to fine-grained type determination in structure, enabling the large language model to perform coherent and CWE-compliant vulnerability type identification based on understanding the vulnerability context and security classification system.

[0019] (5) The complete thought chain hint content generated in step (4) is used as the final input of the large language model, and a request is submitted by calling its API interface. After fully understanding the hint structure and the embedded hierarchical knowledge, the large language model strictly follows the progressive reasoning steps preset in the template, and performs step-by-step analysis and comprehensive judgment from coarse-grained categories to fine-grained types. Through this process, the model finally outputs a specific CWE-ID number as the type determination result of the target vulnerability.

[0020] Meanwhile, the present invention proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed, it implements the steps of the method described in the present invention.

[0021] Furthermore, the present invention proposes a computer-readable storage medium having a computer program stored thereon, the computer program being configured to implement the steps of the method described in the present invention when invoked by a processor.

[0022] Finally, the present invention proposes a computer program product, including a computer program / instructions, characterized in that the computer program / instructions, when executed by a processor, implement the steps of the method described in the present invention.

[0023] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention proposes a vulnerability type identification method based on information retrieval and CWE knowledge graph. It innovatively combines information retrieval technology, CWE hierarchical knowledge graph, and a thought chain hint mechanism to achieve cross-modal knowledge fusion from enhanced retrieval to structured reasoning. By introducing authoritative structured knowledge containing hierarchical relationships and a progressive logical reasoning chain, the knowledge-driven capability and reasoning interpretability of the vulnerability type identification task are improved.

[0024] 2. This invention comprehensively utilizes dual-modal information from source code and vulnerability descriptions to construct a fine-grained retrieval mechanism that integrates code syntactic structure and text semantic features. By matching the target vulnerability with the most similar samples in the knowledge base and their corresponding CWE hierarchical paths, the large model can effectively acquire hierarchical auxiliary knowledge, including parent class constraints, inheritance relationships, and key attributes, thereby enhancing the efficiency of knowledge transfer and the constraint strength of hierarchical logic during the reasoning process.

[0025] 3. This invention, through a meticulously designed thought chain prompt template, organically integrates the source code and description of the target vulnerability with similar vulnerability samples and their hierarchical knowledge, filtered through hybrid reordering, guiding the model to follow a progressive reasoning path from coarse-grained parent classes to fine-grained subclasses. This design significantly enhances the model's generalization performance and prediction accuracy in identifying vulnerability types across different frequency categories (head, middle, and tail). Attached Figure Description

[0026] Figure 1 This invention provides a system framework diagram for a vulnerability type identification method based on information retrieval and CWE knowledge graph. Detailed Implementation

[0027] To more clearly illustrate the purpose, technical details, and advantages of this invention, the following will provide a detailed description of the invention through accompanying drawings and specific embodiments. It should be noted that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0028] Example 1: See Figure 1 As shown, this embodiment provides a vulnerability type identification method based on information retrieval and CWE knowledge graph, including the following steps: (1) Collect vulnerability records from the official vulnerability platform, filter out C / C++ related samples, extract key information such as the CWE number, source code and related description of each sample, and construct an initial dataset. Then clean and deduplicate the data, exclude samples that cannot generate a syntax tree and vulnerability types that have been marked as obsolete, and use the preferred labels of the samples for standardization.

[0029] (2) Based on the preprocessed basic dataset, the vulnerability types are first sorted according to the number of samples. Types with more than 200 samples are classified as the head category; types with 50 to 200 samples are classified as the middle category; and the remaining types with fewer than 50 samples are classified as the tail category. At the same time, categories with fewer than 20 samples are merged and uniformly classified into the "remaining" category. Then, the entire dataset is randomly divided into training set, validation set, and test set in a ratio of 80%:10%:10%. During the partitioning process, a stratified sampling strategy is adopted to ensure that the distribution ratio of each vulnerability type in each subset is consistent with that of the original dataset. The training set is used as an instance knowledge base, and according to the hierarchical standards defined in the CWE VIEW-1000 view, the corresponding CWE hierarchical knowledge graph is parsed and constructed to form a graph-structured knowledge base.

[0030] (3) For the vulnerability samples to be predicted, independent code similarity and description similarity indices are obtained by calculating their similarity to the code structure features and natural language description features of the samples in the instance knowledge base. In this process, a hybrid syntactic and lexical reordering strategy based on abstract syntax trees is introduced to optimize the code retrieval candidate set. Subsequently, a dual-modal weighted fusion method is used to combine the optimized code similarity and description similarity according to preset weights to generate a comprehensive similarity score. Based on this score, the top k most relevant vulnerability samples are selected from the instance knowledge base. At the same time, relying on the constructed CWE hierarchical knowledge graph, the CWE hierarchical paths corresponding to these samples and the structured information of all nodes on the paths are queried and extracted. These retrieved sample features and graph knowledge will be integrated to construct the prompt content in the subsequent thought chain reasoning. Specific operations include: (3-1) For the vulnerability samples to be evaluated, the feature representations of their source code and description are extracted by pre-trained models: the source code is encoded using CodeBERT to generate the corresponding code vector; at the same time, the vulnerability description text is encoded using the CoSENT model to obtain the text vector representation.

[0031] (3-2) The similarity between the target vulnerability and samples in the knowledge base is calculated in both code and text modalities. In the text modal, cosine similarity is used directly to measure the relevance between description vectors. In the code modal, a hybrid syntactic and lexical reordering method is employed: first, a preliminary candidate set is selected based on vector cosine similarity; then, Tree-Sitter is used to parse the code and generate an abstract syntax tree sequence, and syntactic similarity is calculated based on normalized edit distance; simultaneously, the code is divided into lexical units, and lexical similarity is evaluated using the Jaccard coefficient; finally, the two types of similarity are weighted and fused with weights of 0.4 and 0.6 respectively to form the final similarity score for the code modal.

[0032] (3-3) The bimodal similarity is weighted and fused using adjustable parameters to obtain a comprehensive similarity score. The code similarity weight is set to 60%, and the text similarity weight is set to 40% to take into account the role of code structure and semantic information in order to generate the final comprehensive score.

[0033] (3-4) Based on the comprehensive similarity, the candidate samples in the knowledge base are sorted in descending order, and the top 3 samples with the highest scores are selected as the retrieval results. These highly relevant samples not only contain source code and descriptive information, but also are associated with hierarchical path knowledge extracted from the CWE knowledge graph, which together serve as the input for subsequent thought chain prompts, supporting the large language model to complete the vulnerability reasoning and analysis tasks.

[0034] (4) Based on the preset number of searches k, a thought chain prompt template is designed. The top-k retrieved vulnerability samples and their corresponding CWE-level path knowledge are embedded in the template, along with the source code and description information of the target vulnerability, to form a complete thought chain prompt input. This prompt template specifies the expert role setting in natural language, embeds a hierarchical vulnerability knowledge structure, and plans a reasoning logic including four steps. In this way, the large language model is guided to combine the semantic information of similar samples with the structural constraints of the CWE level, gradually refining the reasoning from the coarse-grained parent category to the fine-grained specific subclass, and finally completing the accurate prediction of the vulnerability type. Specific operations include: (4-1) Clearly define the model's role and task in the prompt template, specifying that it is an expert in software vulnerability type classification and CWE analysis with professional knowledge background. At the beginning, guide the model to understand the task objective through natural language, prompting: "You are an expert in software vulnerability type classification and CWE analysis. Your task is to infer the CWE type of the target vulnerability step by step based on similar samples and CWE hierarchy knowledge." This ensures that the model focuses on using domain knowledge for type identification.

[0035] (4-2) Embed the knowledge enhancement part in the template, and provide the model with the top k similar vulnerability samples retrieved in step (3) and their corresponding structured CWE hierarchical path knowledge (including code snippets, descriptions, CWE-IDs, patch information, and hierarchical information such as parent categories, official definitions, extended descriptions, and common consequences). Arrange the retrieved knowledge using descending similarity sorting, so that the example most similar to the target vulnerability in semantics and structure is placed at the beginning of the template, establishing a strong semantic prior and guiding the model to perform step-by-step logical reasoning according to the structure of the template prompted by the thought chain. The template is clearly divided into four logical steps: (4-2-1) Provide the model with retrieved similar vulnerability samples and a complete CWE hierarchical path, which includes parent nodes, semantic inheritance links, and key attributes. By simultaneously presenting the content features of the samples and their position in the CWE classification system, the model gains a structured understanding of potential vulnerability types before inference, establishing a hierarchical and semantically coherent contextual foundation.

[0036] (4-2-2) requires the model to "perform fine-grained semantic mapping analysis on similar samples". At the code level, key patterns revealing weak behaviors are identified, and at the description level, linguistic cues of triggering conditions and potential consequences are extracted, thereby constructing a hierarchical semantic association of "program behavior - weakness type - potential consequences" and refining transferable feature patterns across different CWE types.

[0037] (4-2-3) requires the model to "use the CWE hierarchical chain for structured analysis". Examine the position of the sample in the hierarchical tree and the abstract semantic range of the parent category, and derive the necessary conditions for matching the CWE by combining the official definition and extended description, so as to clearly distinguish whether the sample has the specific features of the fine-grained subclass or only corresponds to the broad semantics of the higher-level parent class.

[0038] (4-2-4) Instruction model “Infer the CWE type of the target vulnerability”. The code and description of the target vulnerability are semantically aligned with the aforementioned samples in multiple dimensions, and the CWE hierarchical constraints are combined to determine whether the target satisfies the fine-grained subclass conditions or is closer to the parent class semantics. By jointly utilizing semantic similarity and hierarchical analysis, surface mismatches are eliminated, and the target vulnerability CWE-ID is finally output.

[0039] (4-3) By combining expert role setting, multimodal instance retrieval, CWE hierarchical knowledge graph embedding and progressive step-by-step reasoning logic, the prompt template achieves an organic unity from coarse-grained semantic perception to fine-grained type determination in structure, enabling the large language model to perform coherent and CWE-compliant vulnerability type identification based on understanding the vulnerability context and security classification system.

[0040] (5) The complete thought chain hint content generated in step (4) is used as the final input of the large language model, and a request is submitted by calling its API interface. After fully understanding the hint structure and embedded hierarchical knowledge, the large language model strictly follows the progressive reasoning steps preset in the template, and performs step-by-step analysis and comprehensive judgment from coarse-grained categories to fine-grained types. Through this process, the model finally outputs a specific CWE-ID number as the type determination result of the target vulnerability. The experimental results are shown in Table 1: Table 1. Comparison of the performance metrics between the present invention and the baseline method.

[0041] Experimental results demonstrate that the vulnerability type identification method proposed in this invention, based on information retrieval and CWE knowledge graph, significantly outperforms all baseline methods in three key evaluation metrics: accuracy, F1 score, and Matthews correlation coefficient (MCC). Specifically, the method achieves 78.91% accuracy, 79.09% F1 score, and a high MCC of 77.67%. Compared to the second-best performing baseline method, the proposed VulTypeRAG method shows a relative improvement of approximately 30.7% in accuracy, approximately 54.3% in F1 score, and approximately 31.8% in MCC. This result fully demonstrates the significant advantages of this invention in software vulnerability type identification tasks.

[0042] Example 2: This example proposes an electronic system, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method steps of the present invention.

[0043] Example 3: This example proposes a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the method described in this invention, which will not be repeated here.

[0044] Example 4: This example proposes a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, they implement the steps of the method described in this invention, which will not be repeated here.

[0045] It should be noted that the processing flow of embodiments 2-4 corresponds to the specific steps of the method provided in embodiment 1 of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the method provided in embodiment 1 of the present invention.

[0046] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0047] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A vulnerability type identification method based on information retrieval and CWE knowledge graph, characterized in that, The process includes the following steps: S1. Construct a standardized initial dataset from the original vulnerability data and divide it into training set, validation set and test set. Based on the training set and CWE standard, construct an instance knowledge base and hierarchical knowledge graph. S2. For the target vulnerability, calculate its similarity to the knowledge base samples in terms of code and text description. After weighted fusion and reordering, retrieve the K most similar samples and associate them with their corresponding CWE level knowledge. S3. Design structured prompt templates, embedding retrieved similar samples, CWE-level knowledge, target vulnerability information, and clear reasoning steps to guide the large model to perform step-by-step reasoning; S4. Input the constructed thought chain prompts into the large language model, and let it analyze according to the predetermined steps, and finally output the predicted CWE-ID.

2. The vulnerability type identification method based on information retrieval and CWE knowledge graph as described in claim 1, characterized in that, Step S1 includes the following steps: S11. Collect vulnerability records from the official vulnerability platform, filter out C / C++ related samples, and extract key information such as the CWE number, source code and related description of each sample to build the initial dataset. S12. Clean and deduplicate the initial dataset, exclude samples that cannot generate a syntax tree and vulnerabilities that have been marked as obsolete, and uniformly use the preferred CWE tags of the samples for normalization. S13. First, sort the vulnerability types according to the number of samples. Types with more than 200 samples are classified as the head category, types with 50 to 200 samples are classified as the middle category, and the remaining types with less than 50 samples are classified as the tail category. Categories with less than 20 samples are merged and uniformly classified into the "remaining" category. The entire dataset is randomly divided into training set, validation set and test set according to the ratio of 80%:10%:10% using a stratified sampling strategy to ensure that the distribution ratio of each vulnerability type in each subset is consistent with the original dataset. S14. Using the training set as an instance knowledge base, and based on the hierarchical standards defined in the CWE VIEW-1000 view, parse and construct the corresponding CWE hierarchical knowledge graph to form a graph-structured knowledge base.

3. The vulnerability type identification method based on information retrieval and CWE knowledge graph as described in claim 1, characterized in that, S2 includes the following steps: S21. For the vulnerability samples to be predicted and the samples in the instance knowledge base, CodeBERT is used to encode the source code to generate code vectors, and the CoSENT model is used to encode the vulnerability description text to obtain text vector representations. S22. In the text modality, the correlation between the target vulnerability and the knowledge base sample description vector is directly measured by cosine similarity. In the code modality, a hybrid syntactic and lexical reordering method is adopted. First, a preliminary candidate set is selected based on vector cosine similarity. Tree-Sitter is used to parse the code to generate an abstract syntax tree sequence and calculate syntactic similarity based on normalized edit distance. The code is divided into lexical units and lexical similarity is evaluated by Jaccard coefficient. Finally, the syntactic similarity and lexical similarity are weighted and fused to form the final similarity score of the code modality. S23. The dual-modal similarity is weighted and fused using preset adjustable parameters to obtain a comprehensive similarity, where the code similarity weight is set to 60% and the text similarity weight is set to 40%; the candidate samples in the knowledge base are sorted in descending order according to the comprehensive similarity, and the top k samples with the highest scores are selected as the retrieval results. S24. Based on the constructed CWE hierarchical knowledge graph, query and extract the complete CWE hierarchical path and the structured information of all nodes on the path corresponding to the first k retrieved samples.

4. According to claim 1, a vulnerability type identification method based on information retrieval and CWE knowledge graph is characterized in that, Step S3 includes the following steps: S31. Clearly define the model's role and task in the prompt template, specifying that it is an expert in software vulnerability type classification and CWE analysis with professional knowledge background, and guide the model to understand the task objective at the beginning through natural language, prompting: "You are an expert in software vulnerability type classification and CWE analysis. Your task is to infer the CWE type of the target vulnerability step by step based on similar samples and CWE hierarchy knowledge," to ensure that the model focuses on using domain knowledge for type identification; S32. The retrieved Top-k similar vulnerability samples and their corresponding structured CWE hierarchical path knowledge are sorted in descending order of similarity and embedded into the prompt template to provide the source code and description information of the target vulnerability, so as to establish strong semantic prior and constitute a complete prompt input. S33. Plan a reasoning chain containing four logical steps in the template.

5. A vulnerability type identification method based on information retrieval and CWE knowledge graph as described in claim 4, characterized in that, In step S33, the four logical steps are as follows: S331. Provide the model with similar vulnerability samples retrieved and a complete CWE hierarchical path, the path covering parent nodes, semantic inheritance links and key attributes. By simultaneously presenting the content features of the samples and their position in the CWE classification system, the model can obtain a structured understanding of potential vulnerability types before inference, and establish a hierarchical and semantically coherent contextual basis. S332 requires the model to "conduct fine-grained semantic mapping analysis on similar samples", identify and reveal key patterns of weak behaviors at the code level, extract linguistic clues of triggering conditions and potential consequences at the description level, thereby constructing a hierarchical semantic association of "program behavior - weakness type - potential consequences" and extracting transferable feature patterns across different CWE types. S333. The model is required to "use the CWE hierarchical chain for structured analysis", examine the position of the sample in the hierarchical tree and the abstract semantic range of the parent category, and deduce the necessary conditions for matching the CWE by combining the official definition and extended description, so as to clearly distinguish whether the sample has the specific features of fine-grained subclasses or only corresponds to the broad semantics of higher-level parent classes. S334, the instruction model "infers the CWE type of the target vulnerability", performs multi-dimensional semantic alignment between the code and description of the target vulnerability and the aforementioned samples, and combines CWE hierarchical constraints to determine whether the target satisfies fine-grained subclass conditions or is closer to the parent class semantics. By jointly utilizing semantic similarity and hierarchical analysis, it eliminates surface mismatches and finally outputs the target vulnerability CWE-ID.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is executed, it implements the steps of the method as described in any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is configured to implement the steps of the method according to any one of claims 1 to 5 when invoked by a processor.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 5.

Images