Vulnerability Discovery Methods and Systems Based on Code Difference Analysis and Large Language Models
By combining code difference analysis with large language models, vulnerabilities in open-source protocol server software are automatically detected. This solves the problems of unknown security flaws and variant attack bypasses introduced during version iteration, realizes automated vulnerability detection and verification, and improves security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-03-06
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies struggle to automatically detect unknown security flaws and variant attack bypass issues introduced during version iterations of open-source protocol server software.
By combining code difference analysis with a large language model, the system automatically extracts function-level difference fragments, aggregates call contexts, and uses the large language model for intelligent filtering and analysis to construct malicious test messages and perform dynamic verification.
It enables automated detection and verification of vulnerabilities during the version iteration of open-source protocol server software, ensuring the actual exploitability of vulnerabilities and improving security.
Smart Images
Figure CN122133157A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of network security and software testing technology, specifically to a vulnerability discovery method and system based on code difference analysis and large language model. Background Technology
[0002] In the field of cybersecurity, the security of open-source protocol server software (such as Lighttpd, Tinyhttpd, Nginx, etc.) is crucial. As software versions iterate, developers fix old vulnerabilities or introduce new features, but this process often brings new security risks: newly added code may introduce unknown security flaws (such as buffer overflows and command injection), while fixes for old vulnerabilities may be incomplete, allowing for bypasses through variant attacks. How to automatically detect these vulnerabilities in modified, diffusing code is a critical issue in cybersecurity. Summary of the Invention
[0003] To address the shortcomings mentioned in the background section, the present invention aims to provide a vulnerability discovery method and system based on code difference analysis and large language model.
[0004] Firstly, the objective of this invention can be achieved through the following technical solution: a vulnerability discovery method based on code difference analysis and a large language model, the method comprising the following steps: The system receives source code from different versions of open-source protocol server software, parses the source code and extracts function-level code snippets, and obtains a code difference file; wherein, the different versions include new versions and old versions. Based on preset rules and calling relationships, the associated functions of function-level code snippets with content changes are determined, and the source code of the associated functions of function-level code snippets with content changes are aggregated with the function-level code snippets with content changes into a context code block; Input the code difference file and context code block into the pre-built large language model, and output the potential vulnerability types and triggering conditions; obtain the original network traffic sample based on the potential vulnerability types and triggering conditions; input the original network traffic sample and triggering conditions into the large language model, and output the message payload message that triggers the corresponding vulnerability type; Based on the runtime status of the open-source protocol server software after the input of the message payload message that triggers the corresponding vulnerability type, the vulnerability discovery results are output according to the runtime status.
[0005] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the extraction of function-level code fragments involves identifying the boundaries of C language functions based on abstract syntax trees (ASTs) or regular expression matching, extracting the function names, parameter lists, and complete function bodies of all functions, and constructing a function index table as function-level code fragments.
[0006] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of generating the code difference file is as follows: The content of functions with the same name is compared. For functions whose content has been changed, the diff algorithm is used to generate a code difference file patch, which clearly marks the deleted and added lines of code.
[0007] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of aggregating the source code of the associated function of the function-level code segment with content changes and the function-level code segment with content changes into a context code block, as follows: Based on a pre-built function call graph, for function-level code snippets with content changes, the system recursively searches for the caller and callee functions, and concatenates the source code of the associated functions with the source code of the function with content changes to obtain the context code block.
[0008] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of inputting the code diff file and context code block into a pre-established large language model, comprising: The code diff file and context code block are encapsulated into JSON-formatted hints and input into the large language model. If the large language model identifies a risk, it outputs a JSON object, including the potential vulnerability type, the affected variable name, and the parameter constraints required to trigger the vulnerability.
[0009] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the process of inputting the original network traffic sample and triggering conditions into a large language model and outputting a message payload packet that triggers the corresponding vulnerability type, as follows: From the raw network traffic samples in the pre-captured normal network traffic sample library, retrieve the raw packets that match the URL path of the current analysis function. Combined with the triggering conditions, instruct the large language model to mutate the raw packets to obtain specific network message packets, which serve as the message payload packets that trigger the corresponding vulnerability type.
[0010] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: the output of vulnerability discovery results based on the running status, including verification results of successful remote code execution vulnerability exploitation and verification results of successful denial-of-service vulnerability exploitation.
[0011] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: a verification process for the verification result of the successful remote code execution vulnerability exploitation, as follows: Filter and capture ICMP Echo Request packets from the IP address of the open-source protocol server software. If, after sending a malicious payload via TCP Socket, an expected ICMP packet is captured within a preset time window, the remote code execution vulnerability is considered successfully exploited. The verification process for a successful denial-of-service vulnerability verification result is as follows: The server process is checked by polling. If the process terminates unexpectedly, its exit status code is obtained. When the exit status code matches the preset status code value, the denial-of-service vulnerability is verified successfully.
[0012] Secondly, in order to achieve the above objectives, this invention discloses a vulnerability discovery system based on code difference analysis and a large language model, comprising: The code processing module is used to receive source code of open source protocol server software from different versions, parse the source code of open source protocol server software, extract function-level code snippets, and obtain code difference files; wherein, the different versions include new versions and old versions; The code aggregation module is used to determine the associated functions of function-level code snippets with content changes based on preset rules and calling relationships, and to aggregate the source code of the associated functions of function-level code snippets with content changes into context code blocks. The vulnerability output module is used to input the code difference file and context code block into a pre-established large language model and output the potential vulnerability types and triggering conditions; obtain the original network traffic sample based on the potential vulnerability types and triggering conditions; input the original network traffic sample and triggering conditions into the large language model and output the message payload message that triggers the corresponding vulnerability type. The vulnerability discovery module is used to detect the running status of the open-source protocol server software after triggering a vulnerability message payload message of the corresponding vulnerability type based on the input, and output the vulnerability discovery results based on the running status.
[0013] In another aspect of the present invention, in order to achieve the above-mentioned objective, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores the computer program capable of running on the processor, and when the processor loads and executes the computer program, it employs the vulnerability mining method based on code difference analysis and large language model as described above.
[0014] The beneficial effects of this invention are: This invention automatically extracts function-level difference fragments (Diff) and aggregates the call context. It leverages the deep semantic understanding capabilities of the Large Language Model (LLM) to intelligently filter and analyze changed functions, uses the large model to infer the triggering conditions of vulnerabilities, and constructs malicious test packets that meet specific path constraints based on original traffic samples. It introduces an automated dynamic verification mechanism, which sends the constructed malicious packets and combines network back-end verification with process status monitoring to reliably verify the true exploitability of vulnerabilities. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram of the workflow of the present invention; Figure 3 This is a schematic diagram of the system structure of the present invention. Detailed Implementation
[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] Example 1: like Figure 1 As shown, the vulnerability discovery method based on code difference analysis and large language model includes the following steps: S101: Receive source code of open source protocol server software of different versions, parse the source code of open source protocol server software and extract function-level code snippets, and obtain code difference files; wherein, the different versions include new versions and old versions; The process of extracting function-level code snippets: Function extraction. Based on obtaining the source code of different version protocol servers, unlike the traditional text line-based diff, this method uses Abstract Syntax Tree (AST) or regular expression matching to identify the boundaries of C language functions, extract the function name, parameter list, and complete function body of all functions, and construct a function index table.
[0018] Difference code generation. Content comparison is performed on functions with the same name. For functions with identified content changes, a diff algorithm is used to generate a difference patch, which clearly marks deleted lines of code (marked with "-") and newly added lines of code (marked with "+").
[0019] S102: Based on preset rules and calling relationships, determine the associated functions of function-level code segments with content changes, and aggregate the source code of the associated functions of function-level code segments with content changes with the function-level code segments with content changes into a context code block; The process of aggregating the source code of the associated function of a function-level code snippet with content changes into a context code block includes: Context Aggregation. To address the illusion caused by the lack of contextual code snippets in large language models, this method constructs a function call graph. For each modified function, the system recursively searches for its "caller" and "callee" functions, concatenates the source code of these related functions with the source code of the modified function, forming a "context code block" containing complete control flow logic, which serves as the basic input for subsequent analysis.
[0020] S103: Input the code difference file and context code block into the pre-established large language model, and output the potential vulnerability types and triggering conditions; obtain the original network traffic sample based on the potential vulnerability types and triggering conditions; input the original network traffic sample and triggering conditions into the large language model, and output the message payload message that triggers the corresponding vulnerability type; The process of inputting code diff files and context code blocks into a pre-built large language model includes: To eliminate irrelevant code and conserve computing resources, the function names of modified functions are first checked. If they contain predefined irrelevant keywords (such as "debug", "print", "usage", "help"), they are discarded; if they contain strongly relevant keywords (such as "http", "parse", "auth"), they are retained. Based on this, the configuration file of the target protocol server software is read, and the URL routing mapping is parsed. If the modified function name appears in the processing logic of the configuration file, it is directly marked as "high-risk". For functions whose relevance to message processing cannot be determined by rules, their code snippets are input into a large language model, which asks, "Is this code used to process network requests?". If the model returns "0" (no), the function is filtered and discarded; if it returns "1" (yes), it is retained and further analyzed.
[0021] The process of inputting raw network traffic samples and triggering conditions into a large language model and outputting the message payload packet that triggers the corresponding vulnerability type is as follows: Network-processing-related "context blocks" and "difference fragments" are encapsulated into JSON-formatted prompts and input into a large language model (LLM) for potential vulnerability analysis. The LLM analyzes whether code changes violate existing security constraints (such as removal of boundary checks or use of uninitialized variables). If the model identifies a risk, it returns a JSON object containing the vulnerability type (e.g., "Stack Buffer Overflow" or "Command Injection"), the names of affected variables, and the parameter constraints required to trigger the vulnerability.
[0022] Based on the identification of differential code snippets and triggering conditions containing potential vulnerabilities, the system retrieves raw packets (such as HTTP requests) matching the URL path of the current analysis function from a pre-captured database of normal network traffic samples. Then, combining the vulnerability constraints deduced in the previous stage, the system instructs the large language model to mutate the raw packets to obtain specific network message packets. For command injection vulnerabilities, the system will forcibly inject a "network callback verification" logic into the prompt, requiring the generated payload to attempt to execute a command that sends ICMP packets to the detection system (e.g., "; ping -c 3").<Detector_IP> This is done so that subsequent verification can be performed by monitoring network traffic. For Stack Overflow vulnerabilities, the main method involves mutating certain field values in the message and replacing them with excessively long values.
[0023] S104: The running status of the open-source protocol server software after triggering the vulnerability message payload of the corresponding vulnerability type based on the input, and outputs the vulnerability discovery results according to the running status.
[0024] Based on the running status, the vulnerability discovery results output include verification results of successful remote code execution vulnerability exploitation and verification results of successful denial-of-service vulnerability exploitation.
[0025] By interacting with the open-source protocol server software, the authenticity and validity of the network messages containing attack payloads generated by LLM are verified. Before the test begins, the server is ensured to be running, and a subprocess interface is encapsulated to take over the open-source protocol server software process. During the test, standard error output (stderr) is monitored in real time to capture stack information when the program crashes. After the test ends or the service crashes, cleanup and service restart are automatically performed to achieve unattended continuous fuzzing.
[0026] To address command injection attacks without echo response, this method employs a network echo verification mechanism based on the ICMP protocol. Before sending the payload, the system starts a traffic listener (Sniffer) on the host machine's network interface to specifically filter and capture ICMP Echo Request packets from the IP address of the open-source protocol server software. After the malicious payload is sent via TCP Socket, if the listener captures an expected ICMP packet within a preset time window (e.g., the open-source protocol server software successfully executed the Ping command to echo back to the detection system), the Remote Code Execution (RCE) vulnerability is considered successfully exploited, and a success log is recorded. This method effectively solves the problem that traditional methods relying solely on HTTP response status codes cannot detect RCE.
[0027] After sending a network message containing a specific payload, the system checks the liveness of the server process by polling. If the process terminates unexpectedly, the system obtains its exit code. If the exit code is -11 (corresponding to the Linux signal SIGSEGV), a segmentation fault caused by a buffer overflow is determined; if the exit code is -13 (corresponding to SIGPIPE), a pipe breakage exception is determined. All crash events, along with the payload ID that triggered them, are written to the vulnerability detection results file as conclusive evidence of a denial-of-service (DoS) vulnerability.
[0028] Example 2: To achieve the above objective, such as Figure 3 As shown, based on Embodiment 1, this invention discloses a vulnerability discovery system based on code difference analysis and a large language model, including: The code processing module 11 is used to receive source code of open source protocol server software of different versions, parse the source code of open source protocol server software, extract function-level code fragments, and obtain code difference files; wherein, the different versions include new versions and old versions; The code aggregation module 12 is used to determine the associated functions of function-level code segments with content changes based on preset rules and calling relationships, and to aggregate the source code of the associated functions of function-level code segments with content changes with the function-level code segments with content changes into a context code block. The vulnerability output module 13 is used to input the code difference file and context code block into the pre-established large language model, and output the potential vulnerability type and triggering conditions; obtain the original network traffic sample based on the potential vulnerability type and triggering conditions; input the original network traffic sample and triggering conditions into the large language model, and output the message payload message that triggers the corresponding vulnerability type. The vulnerability discovery module 14 is used to detect the running status of the open-source protocol server software after triggering the message payload message of the corresponding vulnerability type based on the input, and output the vulnerability discovery results according to the running status.
[0029] Based on the same inventive concept, this invention also provides a computer device, comprising: one or more processors, and a memory for storing one or more computer programs; the programs include program instructions, and the processor executes the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, used to implement one or more instructions, specifically for loading and executing one or more instructions stored in a computer storage medium to implement the above-described method.
[0030] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, performs the above-described method. This storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
[0031] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0032] The foregoing has shown and described the basic principles, main features, and advantages of this disclosure. Those skilled in the art should understand that this disclosure is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of this disclosure. Various changes and modifications can be made to this disclosure without departing from its spirit and scope, and all such changes and modifications fall within the scope of this disclosure as claimed.
Claims
1. A vulnerability discovery method based on code difference analysis and large language model, characterized in that, The method includes the following steps: The system receives source code from different versions of open-source protocol server software, parses the source code and extracts function-level code snippets, and obtains a code difference file; wherein, the different versions include new versions and old versions. Based on preset rules and function call relationships, the associated functions of function-level code snippets with content changes are determined, and the source code of the associated functions of function-level code snippets with content changes are aggregated with the function-level code snippets with content changes into a context code block; Input the code difference file and context code block into the pre-built large language model, and output the potential vulnerability types and triggering conditions; obtain the original network traffic sample based on the potential vulnerability types and triggering conditions; input the original network traffic sample and triggering conditions into the large language model, and output the message payload message that triggers the corresponding vulnerability type; Based on the runtime status of the open-source protocol server software after the input of the message payload message that triggers the corresponding vulnerability type, the vulnerability discovery results are output according to the runtime status.
2. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The extraction of function-level code snippets involves identifying the boundaries of C language functions based on Abstract Syntax Tree (AST) or regular expression matching, extracting the function name, parameter list, and complete function body of all functions, and constructing a function index table as function-level code snippets.
3. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The process of generating the code difference file is as follows: The content of functions with the same name is compared. For functions whose content has been changed, the diff algorithm is used to generate a code difference file patch, which clearly marks the deleted and added lines of code.
4. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The process of aggregating the source code of the associated function of the function-level code snippet with content changes into a context code block is as follows: Based on a pre-built function call graph, for function-level code snippets with content changes, the system recursively searches for the caller and callee functions, and concatenates the source code of the associated functions with the source code of the function with content changes to obtain the context code block.
5. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The process of inputting the code diff file and context code block into a pre-built large language model includes: The code diff file and context code block are encapsulated into JSON-formatted hints and input into the large language model. If the large language model identifies a risk, it outputs a JSON object, including the potential vulnerability type, the affected variable name, and the parameter constraints required to trigger the vulnerability.
6. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The process of inputting the original network traffic sample and triggering conditions into the large language model and outputting the message payload packet that triggers the corresponding vulnerability type is as follows: From the raw network traffic samples in the pre-captured normal network traffic sample library, retrieve the raw packets that match the URL path of the current analysis function. Combined with the triggering conditions, instruct the large language model to mutate the raw packets to obtain specific network message packets, which serve as the message payload packets that trigger the corresponding vulnerability type.
7. The vulnerability discovery method based on code difference analysis and large language model according to claim 1, characterized in that, The vulnerability discovery results output based on the running status include verification results of successful remote code execution vulnerability exploitation and verification results of successful denial-of-service vulnerability exploitation.
8. The vulnerability discovery method based on code difference analysis and large language model according to claim 7, characterized in that, The verification process for the successful remote code execution vulnerability exploit is as follows: Filter and capture ICMP Echo Request packets from the IP address of the open-source protocol server software. If, after sending a malicious payload via TCPSocket, an expected ICMP packet is captured within a preset time window, the remote code execution vulnerability is considered successfully exploited. The verification process for a successful denial-of-service vulnerability verification result is as follows: The server process is checked by polling. If the process terminates unexpectedly, its exit status code is obtained. When the exit status code matches the preset status code value, the denial-of-service vulnerability is verified successfully.
9. A vulnerability discovery system based on code difference analysis and large language modeling, employing the vulnerability discovery method based on code difference analysis and large language modeling as described in any one of claims 1 to 8, characterized in that, include: The code processing module is used to receive source code of open source protocol server software from different versions, parse the source code of open source protocol server software, extract function-level code snippets, and obtain code difference files; wherein, the different versions include new versions and old versions; The code aggregation module is used to determine the associated functions of function-level code snippets with content changes based on preset rules and calling relationships, and to aggregate the source code of the associated functions of function-level code snippets with content changes into context code blocks. The vulnerability output module is used to input the code difference file and context code block into a pre-established large language model and output the potential vulnerability types and triggering conditions; obtain the original network traffic sample based on the potential vulnerability types and triggering conditions; input the original network traffic sample and triggering conditions into the large language model and output the message payload message that triggers the corresponding vulnerability type. The vulnerability discovery module is used to detect the running status of the open-source protocol server software after triggering a vulnerability message payload message of the corresponding vulnerability type based on the input, and output the vulnerability discovery results based on the running status.
10. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs the vulnerability discovery method based on code difference analysis and large language model as described in any one of claims 1 to 8.