A method and device for identifying and tracking sensitive data in industrial software code

Abstract

The application discloses a sensitive data identification and tracking method and device for industrial software code, and aims to solve the technical problem of low analysis efficiency caused by the fact that the existing research seriously depends on manual rules, and experts need to customize expensive and time-consuming rules every time. The method comprises the following steps: obtaining complete source code of an industrial software project, pre-processing based on a static analysis engine and a large language model, outputting a high-value candidate function set and a code attribute graph; based on pre-defined rules and prompt words, attributing roles to the high-value candidate function set using a large language model, and outputting a calibrated decision result set; selecting high-confidence functions and difficult samples to be arbitrated by experts; generating a gold standard knowledge base through expert arbitration of difficult samples, and optimizing a target large language model; and performing sensitive data tracking analysis by combining the code attribute graph and the high-confidence functions using the target model, and outputting an industrial software sensitive data tracking analysis report.

Description

Technical Field

[0001] This invention relates to the field of industrial software code analysis technology, and in particular to a method and apparatus for tracking sensitive data identifiers in industrial software code. Background Technology

[0002] Industrial software serves as the "nerve center" of the modern industrial system, and its security directly impacts the stable operation of critical infrastructure and national economic security. This type of software deeply integrates information technology (IT) and operational technology (OT), creating unique security challenges. On one hand, it needs to process real-time data from multiple sources, including sensors, actuators, and network protocols; on the other hand, it needs to output status and instructions through various channels such as logs, storage, networks, and human-machine interfaces. In this complex data interaction process, a large amount of sensitive data involving process parameters, equipment credentials, and control logic flows continuously.

[0003] Currently, many serious security incidents stem from improper handling of sensitive data in industrial software. For example, the Stuxnet virus caused permanent damage to physical equipment by tampering with sensor data and control commands related to centrifuge speed. Recent security reports have also consistently revealed that issues such as hard-coded credentials persist in mainstream distributed control systems (DCS), posing significant vulnerabilities for unauthorized remote access and malicious control. Therefore, establishing a mechanism in the early stages of the software development lifecycle (i.e., at the source code level) capable of automatically, accurately, and interpretably identifying and tracking the flow of sensitive data is of paramount strategic importance and urgent practical necessity for strengthening industrial software security from the source and meeting compliance requirements.

[0004] Existing research primarily employs traditional static analysis, which predefines a list of sensitive data sources and a list of sensitive data sinks, and then performs taint analysis on the program's code property graph (CPG) or a similar representation to trace the data path from the sources to the sinks. However, this approach heavily relies on manually defined rules, and its effectiveness depends entirely on the completeness and accuracy of the rule base. Each instance requires expensive and time-consuming rule customization by experts, resulting in low analysis efficiency. Summary of the Invention

[0005] This invention provides a method and apparatus for tracking sensitive data identifiers in industrial software code, which addresses the technical problem that existing research heavily relies on manual rules, and each time experts are required to customize rules at a costly and time-consuming pace, resulting in low analysis efficiency.

[0006] The first aspect of this invention provides a method for tracking sensitive data identifiers in industrial software code, comprising: The complete source code of the industrial software project is obtained, and the complete source code of the industrial software project is preprocessed based on the static analysis engine and the large language model to output a high-value candidate function set and code attribute graph. Based on predefined deterministic rules and predefined differentiated basic prompt words, the large language model is used to perform function role attribution on the high-value candidate function set, and output a set of calibrated judgment results. Based on the set of calibrated judgment results, a number of high-confidence functions and a number of difficult functions to be arbitrated by experts are selected from the set of high-value candidate functions. Expert arbitration is conducted on each of the problematic function samples to be arbitrated by experts to generate a gold standard knowledge base, and the gold standard knowledge base is used to optimize the large language model to determine the target large language model. The target large language model is used to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high confidence functions, and an industrial software sensitive data tracking and analysis report is output.

[0007] Optionally, the preprocessing of the complete source code of the industrial software project based on the static analysis engine and large language model to output a high-value candidate function set and code attribute graph includes: The static analysis engine is used to perform in-depth analysis of the complete source code of the industrial software project and generate a code attribute diagram. Based on the function call graph in the code attribute graph, the complete source code of the industrial software project is pre-screened in a structured manner, and the pre-screened function set is output. Based on the large language model, semantic hierarchical filtering is performed on the structured pre-screened function set to generate a high-value candidate function set.

[0008] Optionally, the step of performing structured pre-screening of the complete source code of the industrial software project based on the function call graph in the code attribute graph, and outputting a structured pre-screened function set, includes: The complete source code of the industrial software project is filtered by project structure to output multiple production environment codes. Based on the function call graph in the code attribute graph, code reachability filtering is performed on the functions in each production environment code, and a set of functions with call relationships is output. The functions in the set of functions with calling relationships are filtered by code complexity, and the set of functions with basic complexity is output. The functions in the set of functions with basic complexity are filtered by entity type, and the structured pre-filtered function set is output.

[0009] Optionally, the step of performing semantic hierarchical filtering on the structured pre-screened function set based on the large language model to generate a high-value candidate function set includes: Construct an OT domain knowledge base and extract multi-dimensional information about each function in the structured pre-screened function set; The multi-dimensional information of each function in the structured pre-screened function set is encoded into a function query vector; Using the OT domain knowledge base, similarity retrieval is performed on each function in the structured pre-screened function set based on the function query vector of each function, and the associated document fragments of each function in the structured pre-screened function set are output. The multi-dimensional information of each function and the associated document fragments in the structured pre-screened function set are integrated into a corresponding semantic profile. The large language model is used to perform high-throughput coarse screening of each function in the structured pre-screened function set based on the semantic profile of each function, and output a high-value candidate function set.

[0010] Optionally, the step of using the large language model to perform function role attribution on the high-value candidate function set based on predefined deterministic rules and predefined differentiated basic prompt words, and outputting a set of calibrated judgment results, includes: The predefined deterministic rules are used to scan the high-value candidate function set to determine the initial silver-label function set and the non-silver-label function set; Multiple silver-labeled functions and multiple non-silver-labeled functions to be analyzed are selected from the initial silver-labeled function set and the non-silver-labeled function set. The source code, associated document fragments, and silver label of each silver-labeled function to be analyzed, and the source code and associated document fragments of each non-silver-labeled function to be analyzed are concatenated to output the silver label context of each silver-labeled function to be analyzed and the non-silver label context of each non-silver-labeled function to be analyzed. The silver label context of each of the silver label functions to be analyzed and the predefined differential basic prompt words are respectively input into the large language model, and the function attribution results of each of the silver label functions to be analyzed are output. The non-silver label context of each of the non-silver label functions to be analyzed and the predefined differential basic prompt words are respectively input into the large language model, and the function attribution results of each of the non-silver label functions to be analyzed are output. The authenticity of the event-level evidence in the function attribution results of each of the silver-labeled functions to be analyzed and the event-level evidence in the function attribution results of each of the non-silver-labeled functions to be analyzed is verified. Supplementary silver-label evidence is added to any silver-labeled function to be analyzed and any non-silver-labeled function to be analyzed corresponding to a function in the high-frequency I / O function table, thereby generating complete evidence for each non-silver-labeled function to be analyzed and complete evidence for each silver-labeled function to be analyzed. Based on the complete evidence of each of the non-silver-labeled functions to be analyzed, the associated non-silver-labeled functions to be analyzed are calibrated by event backtracking, and the calibration results of each non-silver-labeled function to be analyzed are generated. Based on the complete evidence of each of the silver-labeled functions to be analyzed, the associated silver-labeled functions to be analyzed are calibrated by event backtracking, and the calibration results of each silver-labeled function to be analyzed are generated. Based on the calibration results of each non-silver-labeled function to be analyzed and the calibration results of each silver-labeled function to be analyzed, a set of calibration results is generated.

[0011] Optionally, the step of conducting expert arbitration on each of the problematic function samples to be arbitrated by experts, generating a gold standard knowledge base, and using the gold standard knowledge base to optimize the large language model and determine the target large language model includes: Each of the problematic function samples to be arbitrated by experts is arbitrated by experts, and gold mark entries corresponding to each of the problematic function samples to be arbitrated by experts are generated. The Gold Standard Knowledge Base is constructed based on the Gold Standard entries corresponding to the various difficult function samples awaiting expert arbitration. Determine whether the number of gold-label entries in the gold-label knowledge base has reached a preset threshold. If so, the target gold-label entries in the gold-label knowledge base are used to update the small sample database of the large language model, and error-driven profiles are constructed to optimize the prompt words of the large language model, and the optimized large language model is determined. The optimized large language model is validated to determine the target large language model.

[0012] Optionally, the step of using the target large language model to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high-confidence functions, and outputting an industrial software sensitive data tracking and analysis report, includes: Using the return value or output parameter of each of the high-confidence functions as taint sources, perform forward data flow analysis on the code property graph to generate multiple initial tracing paths; The target large language model is used to perform semantic verification on each of the initial tracking paths to generate a set of evidence chains for sensitive data streams. The sensitive data stream evidence chain set is aggregated into a structured evidence chain, and an industrial software sensitive data tracking and analysis report is output based on the structured evidence chain.

[0013] A second aspect of the present invention provides a sensitive data identification and tracking device for industrial software code, comprising: The acquisition module is used to acquire the complete source code of the industrial software project, and preprocess the complete source code of the industrial software project based on the static analysis engine and the large language model to output a high-value candidate function set and code attribute graph. The output module is used to perform function role attribution on the high-value candidate function set based on predefined deterministic rules and predefined differentiated basic prompt words, using the large language model, and output a set of calibrated judgment results. The selection module is used to select multiple high-confidence functions and multiple difficult function samples to be arbitrated by experts from the high-value candidate function set based on the set of calibrated judgment results. The determination module is used to perform expert arbitration on each of the difficult function samples to be arbitrated by experts, generate a gold standard knowledge base, and use the gold standard knowledge base to optimize the large language model to determine the target large language model. The analysis module is used to perform sensitive data identification and tracking analysis based on the target large language model, the code attribute graph, and multiple high confidence functions, and output an industrial software sensitive data tracking and analysis report.

[0014] A computer device provided in a third aspect of the present invention includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the sensitive data identification and tracking method for industrial software code as described in any of the preceding claims.

[0015] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed, it implements the steps of the sensitive data identification and tracking method for industrial software code as described in any of the preceding claims.

[0016] As can be seen from the above technical solutions, the present invention has the following advantages: The above-mentioned technical solution of the present invention provides a sensitive data identification and tracking method for industrial software code. It obtains the complete source code of an industrial software project, and preprocesses the complete source code based on a static analysis engine and a large language model, outputting a high-value candidate function set and a code attribute graph. Based on predefined deterministic rules and predefined differentiated basic prompts, the large language model is used to perform function role attribution on the high-value candidate function set, outputting a calibrated judgment result set. Based on the calibrated judgment result set, multiple high-confidence functions and multiple difficult function samples awaiting expert arbitration are selected from the high-value candidate function set. Expert arbitration is performed on each difficult function sample awaiting expert arbitration to generate a gold standard knowledge base, and the gold standard knowledge base is used to optimize the large language model to determine the target large language model. The target large language model is used to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high-confidence functions, outputting an industrial software sensitive data tracking and analysis report. Based on the above solution, the present invention utilizes the powerful code semantic understanding and generalization capabilities of the large language model to directly perform semantic-level attribution of the "roles" of functions. By using predefined rules and prompts, the large language model can automatically learn and adapt to coding paradigms and domain-specific APIs of different projects and languages. This allows the invention to be applied "out of the box" to new industrial software projects, thereby reducing manual intervention, greatly reducing the migration cost of analysis rules, and thus improving analysis efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 The flowchart illustrates the steps of a sensitive data identification and tracking method for industrial software code provided in Embodiment 1 of the present invention. Figure 2 This is a flowchart of the LLM function role attribution provided in Embodiment 1 of the present invention; Figure 3 The above is a flowchart of a sensitive data identification and tracking method for industrial software code provided in Embodiment 1 of the present invention. Figure 4 This is a structural block diagram of a sensitive data identification and tracking device for industrial software code provided in Embodiment 2 of the present invention. Detailed Implementation

[0019] This invention provides a method and apparatus for tracking sensitive data identifiers in industrial software code, which addresses the technical problem that existing research heavily relies on manual rules, and each time experts are required to customize rules at a costly and time-consuming pace, resulting in low analysis efficiency.

[0020] Terminology Explanation: 1. Industrial Software: Refers to computer program systems used in industrial fields for monitoring, control, analysis, design, or simulation. Its applications include, but are not limited to, industrial control (such as SCADA, DCS, PLC), smart manufacturing, robotics, autonomous driving, aerospace, and energy management. Typical technical characteristics include: real-time data interaction with physical devices or the environment; processing of multi-source heterogeneous inputs (such as sensor data, network packets, and configuration files); multi-channel outputs (such as control commands, logs, and network streams); and a layered and highly engineered system architecture.

[0021] 2. Sensitive Data: This refers to data involved in the operation or development of industrial software that, if leaked, could endanger production safety, trade secrets, user privacy, or national security. This includes, but is not limited to: production process data, supply chain data, product / usage data, equipment operation and configuration data, environmental data, and authentication and access credentials.

[0022] 3. LLM (Large Language Model): A deep learning model trained on large-scale text and code, possessing powerful natural language understanding, generation, reasoning, and program semantic understanding and inference capabilities, which can be used for code semantic modeling and role determination.

[0023] 4. LLM Agent: An automated system with LLM as its core cognitive engine, integrating task planning, tool invocation, memory, and adaptive optimization capabilities.

[0024] 5. Source / Sink: In the field of program analysis, the source is the entry point for sensitive data (e.g., reading data from sensors / networks / files / configuration, etc.). The sink is the potential exit point for sensitive data (e.g., logs / networks / storage / displays / control commands issued, etc.).

[0025] 6. CPG (Code Property Graph): Unifies the abstract syntax tree, control flow graph, and data flow graph into a single graph model for code representation, used for static analysis.

[0026] 7. Silver Label: This typically refers to labels generated automatically by a powerful model, a set of high-precision rules, or ensemble voting from multiple models. They are of high quality and considered "good enough" for training, but may contain a small amount of noise.

[0027] 8. Gold Label: This usually refers to data labeled by human experts and is considered "Ground Truth". It has the highest quality but is also the most expensive to obtain.

[0028] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0029] Please see Figure 1 , Figure 1 This is a flowchart illustrating the steps of a sensitive data identification and tracking method for industrial software code, as provided in Embodiment 1 of the present invention.

[0030] This invention provides a sensitive data identification and tracking method for industrial software code, comprising: Step 101: Obtain the complete source code of the industrial software project, and preprocess the complete source code of the industrial software project based on the static analysis engine and the large language model to output a high-value candidate function set and code attribute graph.

[0031] It should be noted that after obtaining the complete source code of the industrial software project, the static analysis engine first performs structured parsing of the source code, extracting basic information such as function definitions, parameter lists, call relationships, and code syntax structure to generate an initial set containing all functions. Then, a large language model is introduced, and combined with knowledge of the industrial software domain (such as common sensitive I / O operations and protocol interaction function characteristics), the functions in the initial set are semantically filtered to eliminate purely auxiliary functions and functions with no possibility of sensitive data interaction (such as log formatting and numerical calculation tool functions), resulting in a high-value candidate function set focusing on potential sensitive data processing. At the same time, during the parsing process, the static analysis engine integrates the extracted Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Data Flow Graph (DFG) into a single graph structure to generate a code attribute graph, providing a unified intermediate code representation for subsequent function role attribution and sensitive data flow tracing. Among them, static analysis engine refers to automated tools used for syntax parsing, structure extraction, and control flow / data flow analysis of source code; large language model refers to pre-trained language model with natural language understanding and code semantic analysis capabilities; high-value candidate function set refers to a set of functions that, after screening, may involve the generation, transmission, storage, or output of sensitive data; code attribute graph (CPG) refers to a graph model that integrates code syntax structure, execution flow, and data transfer relationships to support static code analysis.

[0032] Specifically, step 101 may include the following sub-steps: S11. Use a static analysis engine to perform in-depth analysis of the complete source code of the industrial software project and generate a code attribute diagram. It should be noted that, because industrial software codebases are typically large and use a variety of languages, direct text analysis is inefficient and error-prone. Therefore, this invention uses a Code Property Graph (CPG) as a unified intermediate representation.

[0033] Furthermore, regarding CPG construction: This invention utilizes a mature static analysis engine (the open-source Joern) to perform in-depth analysis of the complete input source code. This process automatically constructs a CPG covering the entire codebase. The advantage of CPG lies in its integration of the Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Data Flow Graph (DFG) within a single graph structure, enabling subsequent complex queries and analyses across syntax, control, and data dependencies, thus forming the cornerstone for accurate tracing.

[0034] S12. Based on the function call graph in the code attribute graph, perform structured pre-screening on the complete source code of the industrial software project and output the structured pre-screened function set. A function call graph is a graph model that depicts the calling and called relationships between functions, with functions as nodes and calling relationships as edges. The function call graph is primarily obtained by using a static analysis engine to perform phased parsing and relationship extraction on the complete source code of an industrial software project. The specific process is deeply integrated with the parsing of the code's syntax structure and execution logic: First, the static analysis engine scans the source code and generates an Abstract Syntax Tree (AST) according to the programming language's syntax rules. Then, it locates all function call expression nodes from the AST. Each node clearly records "who is calling (the calling function, i.e., the function containing the call expression)" and "who is being called (the called function, i.e., the target function specified in the expression)". Simultaneously, a Control Flow Graph (CFG) is used to supplement the execution context of the calls (such as whether calls in branches and loops are reachable, avoiding omissions of conditional call relationships). Finally, the extracted "caller-callee" relationships are transformed into a graph structure, with functions as nodes and calling relationships as edges, thus constructing a complete function call graph.

[0035] It should be noted that, to reduce the cost of subsequent complex analysis (especially the invocation of LLM (Large Language Model)), this invention designs an efficient candidate set filtering module before performing deep semantic analysis. This module aims to filter out as much code as possible that is unrelated to sensitive data I / O. This module includes a two-level filtering strategy (i.e., structured pre-screening and semantic hierarchical filtering). For structured pre-screening, a set of deterministic, low-cost static rules are applied at this stage to quickly eliminate code units that should not be the object of analysis. These rules are based on the code's meta-information and basic structure.

[0036] Furthermore, step S12 may include the following sub-steps: S121. Filter the complete source code of the industrial software project by project structure and output multiple production environment codes; S122. Based on the function call graph in the code attribute graph, perform code reachability filtering on the functions in each production environment code, and output a set of functions with call relationships; S123. Filter the functions in the set of functions with calling relationships by code complexity, and output the set of functions with basic complexity. S124. Filter the functions in the set of functions with basic complexity by entity type and output the structured pre-filtered set of functions.

[0037] It should be noted that when filtering the complete source code of industrial software projects based on project structure, all non-production code is excluded according to the naming conventions of files or directories (such as paths containing / test / , / examples / , / docs / , etc.), retaining only the code used in the actual production environment, and outputting multiple production environment codes. Based on this, code reachability filtering is performed on the functions in each production environment code according to the function call graph in the code attribute graph. By analyzing the call relationships between functions, "dead code" or isolated functions that have never been called are identified and excluded, resulting in a set of functions with call relationships. Next, code complexity filtering is performed on the functions in this set, excluding "stub functions" with excessively short function bodies, no function calls, or complex logic, as well as simple getter / setter methods, retaining functions with basic complexity, and outputting a set of functions with basic complexity. Finally, entity type filtering is performed on this set, excluding interfaces with only declarations and no concrete implementations, abstract methods, and global variables used only for constant initialization, ultimately resulting in a structured pre-filtered set of functions. Through a progressive filtering logic, the focus is gradually shifted to core functions with analytical value.

[0038] S13. Based on a large language model, semantic hierarchical filtering is performed on the structured pre-screened function set to generate a high-value candidate function set.

[0039] It's important to note that for semantic layered filtering, after structured pre-screening, domain knowledge from the project is further introduced to perform deeper semantic role prediction on the code, distinguishing between computationally intensive and I / O-intensive functions. The core idea behind this step is that the true intent of a function is not only reflected in its code itself, but also contained in related design documents, API manuals, and developer comments.

[0040] Furthermore, step S13 may include the following sub-steps: S131. Construct an OT domain knowledge base and extract multi-dimensional information of each function in the structured pre-screened function set; S132. Encode the multi-dimensional information of each function in the structured pre-screened function set into a function query vector; S133. Using the OT domain knowledge base, perform similarity retrieval on each function in the structured pre-screened function set based on the function query vector of each function, and output the associated document fragments of each function in the structured pre-screened function set. S134. Integrate the multi-dimensional information of each function and related document fragments in the structured pre-screened function set into a corresponding semantic profile; S135. Using a large language model, each function in the structured pre-screened function set is coarsely screened with high throughput based on its semantic profile, and a high-value candidate function set is output.

[0041] The OT domain knowledge base refers to a structured knowledge set that includes OT domain physical semantic documents and auxiliary contexts to support function semantic understanding.

[0042] Multi-dimensional information about a function includes its signature, function body, file path, directory structure, comments, and other information.

[0043] It should be noted that when building the OT (Operational Technology) domain knowledge base, the system will collect all supporting documents related to the project. The core of the collection includes "physical world documents" that define the physical semantics of the code (such as hardware datasheets, industrial protocol specifications such as Modbus, device description files such as URDF (Unified Robot Description Format), and safety standards such as IEC61508 (International Electrotechnical Commission 61508)). Requirements documents and design documents are also included as auxiliary context.

[0044] Based on this, multi-dimensional information of each function in the structured pre-screened function set is extracted. This information includes the function's code, function name, path, and project structure information such as comments. Then, using the same embedding model as when building the OT domain knowledge base, the multi-dimensional information of each function is encoded into a function query vector. Next, based on this query vector, a similarity search is performed in the vector database of the OT domain knowledge base, outputting the Top-K document fragments (e.g., K=3) that are most relevant to the function's semantics as associated document fragments. Finally, the multi-dimensional information of each function is integrated with its corresponding associated document fragments to form a structured context description containing code, comments, associated documents, and path, i.e., the semantic profile of the function.

[0045] Finally, the semantic profiles of a batch of functions are input into a large language model for high-throughput coarse-grained screening. The model quickly determines whether a function has a "high probability" of interacting with the physical world or external hardware based on comprehensive context, filtering out functions that are purely internal computations, data structure operations, or unrelated to sensitive I / O. The final output is a set of high-value candidate functions. Because the input profiles already contain hierarchical information for inference and relevant documentation, LLM can make more accurate judgments than simply analyzing code. Functions judged as purely internal computations, data structure operations, or unrelated to sensitive I / O are filtered out. This is a lightweight, high-throughput prediction process; its prompt is designed to focus on distinguishing the external interaction characteristics of functions, rather than performing fine-grained source / sink attribution.

[0046] In this embodiment, after these two levels of screening (structured analysis + semantic integration of domain knowledge), the scope of analysis is significantly and precisely narrowed down to a high-value "candidate function set." Each member in this set has undergone preliminary verification with multi-dimensional context, including code, documentation, and architectural information, which fully prepares it for the more refined and costly LLM agent role attribution (Source / Sink determination) in the next module, greatly improving the efficiency and accuracy of the entire analysis process.

[0047] Step 102: Based on predefined deterministic rules and predefined differentiated basic prompts, use a large language model to perform function role attribution on the high-value candidate function set and output a set of calibrated judgment results.

[0048] It should be noted that, as Figure 2 As shown, this step aims to accurately determine the role (Source, Sink, or Neutral) of each function in the high-value candidate function set. To overcome the poor transferability of traditional rule-based methods and to establish an objective and reliable source of "truth" for the agent's self-optimization process, this invention designs a two-layer closed-loop self-optimizing LLM agent that starts with "rule bootstrapping" and uses "human-machine collaboration" as the evolutionary engine.

[0049] Specifically, step 102 may include the following sub-steps: S21. Use predefined deterministic rules to scan the high-value candidate function set to determine the initial silver-label function set and non-silver-label function set; S22. Select multiple silver-labeled functions and multiple non-silver-labeled functions to be analyzed from the initial silver-labeled function set and the non-silver-labeled function set; S23. Concatenate the source code, associated document fragments and silver label of each silver label function to be analyzed, and the source code and associated document fragments of each non-silver label function to be analyzed, and output the silver label context of each silver label function to be analyzed and the non-silver label context of each non-silver label function to be analyzed. S24. Input the silver label context of each silver label function to be analyzed and the predefined differential basic prompt words into the large language model, and output the function attribution results of each silver label function to be analyzed. S25. Input the non-silver label context of each non-silver label function to be analyzed and the predefined differential basic prompt words into the large language model, and output the function attribution results of each non-silver label function to be analyzed. S26. Verify the authenticity of the event-level evidence in the function attribution results of each silver-labeled function to be analyzed and the event-level evidence in the function attribution results of each non-silver-labeled function to be analyzed. Add supplementary silver-label evidence to any silver-labeled function to be analyzed and non-silver-labeled function to be analyzed corresponding to any function in the high-frequency I / O function table, and generate complete evidence for each non-silver-labeled function to be analyzed and complete evidence for each silver-labeled function to be analyzed. S27. Based on the complete evidence of each non-silver-labeled function to be analyzed, perform event backtracking calibration on the associated non-silver-labeled functions to be analyzed, and generate the calibration judgment results of each non-silver-labeled function to be analyzed. S28. Based on the complete evidence of each silver-labeled function to be analyzed, perform event backtracking calibration on the associated silver-labeled functions to be analyzed, and generate the calibration judgment results of each silver-labeled function to be analyzed. S29. Based on the calibration results of each non-silver-labeled function to be analyzed and the calibration results of each silver-labeled function to be analyzed, generate a set of calibration results.

[0050] The predefined differential base prompt is a carefully designed base prompt that explicitly includes the OT-Source / Sink definition based on physical effects and guides the LLM to focus on "semantic polymorphic" functions whose behavior depends on parameters. Specifically, the LLM is instructed not only to output the function's role (Source / Sink / Neutral) but also to provide "event-level evidence," i.e., key API calls in the code that directly lead to its decision (such as Read File, sendto).

[0051] The high-frequency I / O function table refers to a preset list containing common sensitive input / output functions.

[0052] The silver medal supplemental evidence refers to evidence of high-frequency I / O function calls that were omitted from the LLM but exist in the code.

[0053] Complete evidence refers to the final collection of evidence formed after verification of authenticity and supplementation with silver-label evidence.

[0054] It should be noted that, to address the issue of the source of the "first driving force" for the self-optimizing system and to ensure that the learning process is always anchored to objective facts rather than the self-looping of the model, this invention employs a "heuristic-based bootstrapping" strategy for cold start. The system utilizes a set of predefined deterministic rules with high precision and low recall (e.g., "any code that directly calls the modbus_read_registers function is marked as Source"), predefined deterministic rules, to scan all candidate functions and automatically generate a small but highly confident initial seed set ("silver labels"), thus obtaining the initial silver label function set as the objective starting point for the agent's learning. The remaining functions without silver labels constitute the non-silver label function set.

[0055] Furthermore, multiple silver-labeled functions and multiple non-silver-labeled functions to be analyzed are selected from the initial silver-labeled function set and the non-silver-labeled function set. For the silver-labeled functions to be analyzed, their function source code, associated document fragments, and silver label are concatenated to form a silver-labeled context. For the non-silver-labeled functions to be analyzed, their function source code and associated document fragments are concatenated to form a non-silver-labeled context. Then, the two types of contexts are input into the large language model along with predefined differentiated basic prompts (including the physical impact definition of OT-Source / Sink and the attention guidance for "semantic polymorphism" functions). The model outputs function attribution results (including role determination and event-level evidence, such as key API calls). The function attribution results for silver-labeled functions require the output of role, event-level evidence, and a description of whether they are consistent with the silver label. The function attribution results for non-silver-labeled functions require the output of role and event-level evidence.

[0056] Furthermore, to prevent LLM from fabricating evidence, the system quickly verifies whether each "event-level evidence" extracted by LLM truly exists in the code through string or AST matching, and eliminates false evidence. This means verifying the authenticity of event-level evidence in both types of function attribution results (confirming the evidence's existence in the code through string or AST matching and eliminating false evidence). Simultaneously, to improve recall, the system checks if a function from a predefined "high-frequency I / O function list" exists in the code. If it exists but has not been extracted by LLM, the system adds it as "silver-labeled" evidence. This means checking if a function from the high-frequency I / O function table exists in the code; if it exists but has not been extracted by the model, a silver label is added to the corresponding function to form complete evidence for each function to be analyzed.

[0057] Furthermore, based on the final evidence set after filtering and injection, the initial role determination of the LLM is recalibrated. For example, if a function is initially judged as Neutral, but its evidence contains log.error, the system will force its role to be calibrated to Sink. Specifically, based on the complete evidence of each non-silver-labeled function to be analyzed (including verified event-level evidence and possible supplementary silver-labeled evidence), the associated non-silver-labeled functions to be analyzed are calibrated by event backtracking. That is, based on whether there are sensitive input operations (such as hardware data reading APIs), sensitive output operations (such as device control command sending functions), or no sensitive operations in the evidence, the initial role determination is corrected (for example, if the complete evidence contains a ReadPort call, it is calibrated to Source; if it contains WriteRegis, it is calibrated to Source). If ter is not found, it is calibrated as Sink; otherwise, it is Neutral. This generates the calibration results for each non-silver-labeled function to be analyzed. Similarly, based on the complete evidence for each silver-labeled function to be analyzed, event-backtracking calibration is performed on the associated silver-labeled functions. The role is further confirmed by combining the original silver label and supplementary evidence (e.g., if the original function log.error contains a high-frequency I / O function and there is no conflicting information in the evidence, it is calibrated as Sink). This generates the calibration results for each silver-labeled function to be analyzed. Finally, the calibration results for all non-silver-labeled functions and silver-labeled functions to be analyzed are summarized to form a set of calibration results containing the final role of each function, the complete evidence chain, and the calibration basis.

[0058] Among them, complete evidence refers to all evidence (including event-level evidence and silver-label supplementary evidence) that can support the role determination after authenticity verification and supplementation with silver label evidence; the post-calibration determination result refers to the final role (Source / Sink / Neutral) determined by a single function after backtracking calibration and the corresponding evidence and calibration description; the post-calibration determination result set refers to the summary set of the post-calibration determination results of all functions to be analyzed, which is used for subsequent screening of high-confidence functions and difficult samples.

[0059] It is worth noting that if all LLM extraction evidence for a function (both non-silver-labeled and silver-labeled functions to be analyzed) fails to be verified (no real event-level evidence), but the "silver-label supplementary evidence" scan reveals that its source code contains functions from the high-frequency I / O function table (such as log.error), then the "silver-label supplementary evidence" will constitute complete evidence on its own. In this case, the calibration logic is: directly determine the role based on this silver-label supplementary evidence (e.g., if log.error is included, calibrate to Sink), and record the calibration reason ("No real event-level evidence, determined based on supplementary high-frequency I / O call evidence"). If all LLM extraction evidence for a function fails to be verified, and no functions from the high-frequency I / O function table are found after scanning the source code (i.e., no valid evidence), then the calibration logic is: based on the state of "no sensitive I / O evidence," determine the role as Neutral, and record the calibration reason ("No real event-level evidence, and no high-frequency I / O supplementary evidence, determined to be a pure computation / non-sensitive function").

[0060] Step 103: Based on the set of results after calibration, select multiple high-confidence functions and multiple difficult function samples to be arbitrated by experts from the set of high-value candidate functions.

[0061] It should be noted that, based on the set of results after calibration (including the final role of each function, the complete chain of evidence, and the basis for calibration), a selection process is conducted from the set of high-value candidate functions: those functions with clear role determination (e.g., clearly classified as Source, Sink, or Neutral), whose complete chain of evidence contains genuine, valid, and conflict-free event-level evidence, and whose calibration process is unambiguous are selected as multiple high-confidence functions.

[0062] Meanwhile, based on the set of calibrated judgment results (including the final role of each function, complete evidence, and judgment basis), when selecting hard cases from the high-value candidate function set, identification is mainly carried out from three dimensions: First, functions whose calibrated judgment results conflict with the existing "seed set" or the "gold standard" previously labeled by experts are screened out, that is, their judgment results are inconsistent with the known correct results; second, functions whose model confidence is lower than a preset threshold in the calibrated judgment results are extracted, as the role determination of these functions lacks sufficient certainty; third, situations where the same function shows inconsistent calibrated judgment results in multiple inferences (such as using different temperature parameters) are identified, that is, the multiple judgment results are inconsistent. Through these three types of situations, multiple hard cases requiring expert intervention to clarify their roles are identified from the high-value candidate function set.

[0063] Step 104: Conduct expert arbitration on each difficult function sample to be arbitrated, generate the Gold Standard Knowledge Base, and use the Gold Standard Knowledge Base to optimize the large language model and determine the target large language model.

[0064] It should be noted that all the identified challenging function samples are submitted to an expert review queue. Human domain experts make the final, authoritative judgment on these samples. The experts' annotations are given the highest priority and stored in a continuously expanding "Gold Label KnowledgeBase".

[0065] Furthermore, once the "Gold Standard Knowledge Base" accumulates a certain number of new entries, an optimization phase is triggered. Intelligent feedback involves: intelligently sampling from the "Gold Standard Knowledge Base," updating and replacing the Few-shot sample library (a small-sample library for the large language model) in the Prompt, ensuring that the examples are always high-quality and diverse. Analysis of the erroneous samples corrected by experts automatically summarizes their common patterns, forming an "error-driven profile" which is added to the Prompt (a prompt word for the large language model) to guide the model in avoiding similar errors in subsequent analyses.

[0066] Specifically, step 104 may include the following sub-steps: S41. Perform expert arbitration on each sample of difficult functions to be arbitrated by experts, and generate the gold standard entries corresponding to each sample of difficult functions to be arbitrated by experts. S42. Based on the gold standard entries corresponding to the difficult function samples awaiting expert arbitration, construct the gold standard knowledge base; S43. Determine whether the number of gold-label entries in the gold-label knowledge base has reached the preset number threshold. S44. If so, the target gold standard entries in the gold standard knowledge base are used to update the small sample database of the large language model, and error-driven profile optimization prompts are constructed to determine the optimized large language model.

[0067] S45. Validate the optimized large language model and output the target large language model.

[0068] A small sample library refers to a set of samples that provides a small number of typical examples to assist large language models in understanding task logic.

[0069] Error-driven profiling refers to structured information that summarizes model error patterns and is used to guide models to avoid similar problems.

[0070] It should be noted that for each problematic function sample awaiting expert arbitration, an authoritative human domain expert makes a judgment, clarifying its final role (Source / Sink / Neutral) and supplementing detailed judgment criteria, generating a gold standard entry for each problematic sample (including function information, correct role, and expert arbitration logic). All gold standard entries are integrated into an ever-expanding gold standard knowledge base. Subsequently, it is determined whether the number of accumulated gold standard entries in the gold standard knowledge base has reached a preset threshold. If the threshold is reached, target gold standard entries (selecting high-quality and diverse samples) are intelligently sampled from the gold standard knowledge base to update the small sample library of the large language model, ensuring that the examples referenced by the model are always of high quality and comprehensive. At the same time, the erroneous samples in the gold standard entries that have been corrected by experts are analyzed, and their common error patterns (such as misjudgment logic under specific code structures) are summarized to form an error-driven profile and integrate it into the prompt words of the large language model to guide the model to avoid similar errors in subsequent analyses. Through the collaborative operation of updating the small sample library and optimizing the prompt words, the optimized large language model is finally determined.

[0071] Furthermore, for model validation, this invention periodically uses an independent, expert-reserved hold-out set to evaluate the performance of the optimized agent. If the performance meets the preset target, this version of the Prompt is solidified for large-scale analysis; otherwise, the process returns to normal, and iterative optimization continues through human-machine collaboration.

[0072] Step 105: Using the target large language model, perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high confidence functions, and output an industrial software sensitive data tracking and analysis report.

[0073] It should be noted that after obtaining a set of highly confident Source and Sink functions (multiple high-confidence functions), this step is responsible for tracing the complete data propagation path between them, especially those implicit data flows that are passed indirectly.

[0074] Specifically, step 105 may include the following sub-steps: S51. Using the return values ​​or output parameters of each high-confidence function as taint sources, perform forward data flow analysis on the code property graph to generate multiple initial tracing paths; S52. Use the target large language model to perform semantic verification on each initial tracking path and generate a set of evidence chains for sensitive data streams. S53. Aggregate the sensitive data flow evidence chain into a structured evidence chain, and output an industrial software sensitive data tracking and analysis report based on the structured evidence chain.

[0075] It should be noted that the return values ​​or output parameters of each high-confidence function (especially those functions identified as Sources) are used as taint sources (i.e., the initial source of sensitive data). Forward data flow analysis is performed on the Code Property Graph (CPG) to trace the flow path of this sensitive data. The focus is on identifying the key landing points of the data flow, including return value accumulation (such as being assigned to global variables or object member fields), parameter re-passing (such as being used as call parameters of other functions), and shared memory access across asynchronous boundaries (such as shared buffers written by interrupt service routines and read by low-priority tasks). This generates multiple initial tracing paths covering the data generation, transmission, and processing stages. This invention involves solving the initial tracing path based on CPG. The return value of a function identified as a Source or a specific output parameter is used as the taint source, and forward data flow analysis is performed on the CPG. The analyzer focuses on two key "landing points" of the tainted data flow: 1) Value Settling: Tainted data is assigned to a global variable or a member field of an object / struct. For example, this.state.altitude = read_sensor().

[0076] 2) Parameter re-passing: Tainted data is used as a call parameter for another function. For example, log_data(read_sensor()).

[0077] 3) Shared memory access across asynchronous boundaries: The analyzer specifically identifies global variables or shared buffers that are written by interrupt service routines (ISRs) or high-priority real-time tasks and read by other low-priority tasks. This is the first step in establishing connections between “spatiotemporally fragmented” data streams.

[0078] Furthermore, a target large language model is then used to perform semantic verification on each initial tracing path. The model determines whether the data transmission in the path is limited to local temporary variables (if so, it is marked as low risk and pruned). Simultaneously, it analyzes whether the path endpoints (such as object fields) possess "state preservation" or "global sharing" semantics from the perspective of naming and context (if so, they are marked as new tracing starting points to extend the path). After verification and filtering, a set of sensitive data flow evidence chains is formed, containing high-risk sensitive data transfer links and key nodes. Finally, these evidence chains are aggregated into structured evidence links according to data type and transfer stage (clearly presenting the complete path of sensitive data from source to destination, the functions involved, and key operations). Based on this link, risk points (such as transmission across insecure boundaries) are identified, and relevant function roles are labeled, ultimately outputting an industrial software sensitive data tracing and analysis report. Among these, LLM-assisted semantic verification and risk focusing: A path alone is insufficient; the risk of the path needs to be assessed. This invention introduces LLM to perform semantic verification on initial path fragments, filtering out harmless intermediate transmissions. 1) LLM is required to determine whether data passing in the path is limited to local temporary variables. If so, it is marked as low risk and pruned.

[0079] 2) The LLM is required to determine whether the "landing point" of a path (such as the object field this.state.altitude) has "state persistence" or "globally shared" semantics based on its naming and context. If so, it is marked as a new tracing starting point.

[0080] This is a recursive process designed to build a complete propagation chain. By placing all fields or function parameters marked as "new tracing starting points" into the analysis queue, the aforementioned "path solving" and "semantic verification" processes are repeated until the data flow enters a known sink or reaches a preset analysis depth. Throughout the process, the propagation relationship at each step (e.g., "return value from function A" -> "assigned to field X" -> "field X is read by function B"...) is meticulously recorded. Finally, all successfully closed paths (from Source to Sink) are integrated into a structured, evidence-based chain, generating a final analysis report for auditor review.

[0081] As a comparison of technical effects, existing technologies can be used as a reference. To solve the problem of sensitive data in industrial software, existing research mainly adopts traditional static analysis and machine learning techniques.

[0082] Taint Analysis based on predefined rules: This approach is currently the most mainstream method. It predefines a list of sensitive data sources (Sources) and a list of sensitive data sinks (Sinks), and then performs taint analysis on the program's code property graph (CPG) or similar representation to trace the data path from the Sources to the Sinks. For example, it analyzes the data flow graph to check whether log statements (Sinks) output private data from a specific API (Source).

[0083] Machine learning-based anomaly detection: This approach attempts to move away from reliance on explicit rules and identify anomalies by learning the normal behavior patterns of code. For example, it uses neural network models such as autoencoders to learn the time-series data characteristics of industrial control systems during normal operation, thereby detecting attacks such as data forgery. Alternatively, it vectorizes the lexical and syntactic features of the code and trains a classifier to determine whether a code snippet contains sensitive data operations.

[0084] Semantic mining based on Natural Language Processing (NLP): This approach focuses on natural language information in code, assuming that variable names, function names, comments, etc., contain rich semantic clues. By utilizing NLP techniques such as word embeddings and topic models, it can identify program entities related to sensitive concepts such as "password," "key," and "sensor reading," thereby locating potentially sensitive data. For example, this approach has been successfully applied in mobile applications and IoT-related applications to uncover privacy data breaches.

[0085] Based on the above, this approach heavily relies on manually defined rules and suffers from poor cross-scenario adaptability. The effectiveness of Solution 1 (rule-based static analysis) depends entirely on the completeness and accuracy of the rule base. In the industrial software ecosystem, APIs, function naming conventions, and communication protocols vary significantly across different vendors and product lines. A Source / Sink rule base defined for Project A is almost impossible to directly apply to Project B, necessitating expensive and time-consuming rule customization by experts each time. This "one-off" approach severely restricts the efficiency and scalability of automated analysis.

[0086] Implicit propagation coverage is insufficient. While Solution 1 can handle explicit data flows, traditional analysis tools often fail to trace implicit data transfers via global state or object fields (e.g., function A stores a sensitive value in g_context.value, and function B reads and sends that value later). Solutions 2 and 3 focus more on the characteristics of local code snippets and lack a global data flow tracing perspective, making it difficult to detect leakage paths that span multiple functions and are transmitted through intermediate storage media, resulting in a high risk of false negatives.

[0087] Poor interpretability. The judgment process of Solution Two (machine learning) is like a "black box," unable to provide a reasoning basis that humans can understand. While Solutions One and Three can locate the code, their explanations are limited to "matching a certain rule" or "containing a certain keyword," failing to explain how the data "evolves" and "passes" step by step in the complex call chain to ultimately reach the leakage point. This lack of interpretability prevents security auditors from effectively identifying and tracing alerts, greatly reducing the practicality and credibility of the analysis results.

[0088] To address the aforementioned problems, this invention provides a sensitive data identification and tracking method for industrial software code. This method combines static analysis of the Code Property Graph (CPG) with a large language model, employing a multi-module, progressive processing flow to achieve efficient discovery, accurate location, and interpretable tracing of sensitive data streams. Specifically, this invention aims to solve one or more of the following technical problems faced by existing technologies in handling complex industrial software code auditing: 1. Poor rule portability leads to high analysis costs: Existing rule-based or signature-based static analysis methods have rule bases (such as sensitive function lists) that are highly coupled with specific projects, programming languages, or development frameworks. Given the heterogeneous implementation methods and numerous proprietary protocols in the industrial software field, every time a new project is analyzed, a significant amount of manpower is required to rewrite, adapt, and verify the rules, resulting in high analysis costs and poor reusability.

[0089] 2. High false negative rate due to implicit data propagation: In industrial software, sensitive data is often implicitly propagated through global variables, object member (field) assignments, or "parameter re-passing" via multi-level function calls. Traditional data flow analysis methods struggle to fully track this type of indirect, cross-function boundary data flow, resulting in the omission of numerous potential data leakage paths and a high false negative rate.

[0090] 3. Lack of interpretability in analysis results leads to auditing difficulties: Whether it's traditional pattern matching or machine learning-based classification models, the output is often a simple "yes / no" label, lacking a clear and traceable chain of evidence to explain why a certain piece of code was deemed sensitive. This makes it difficult for security auditors to effectively review, confirm, and trace the results, reducing the practical application value of the analysis results.

[0091] To address the issue of poor rule transferability, this invention leverages the powerful code semantic generalization capabilities of LLM to achieve semantic-driven attribution of function / method "roles" (Source / Sink / Neutral), eliminating the hard-coded dependency on specific function names and thus achieving high portability across projects and languages.

[0092] To address the issue of insufficient coverage of implicit propagation, this invention proposes a context-sensitive tracking strategy of "return value sedimentation / parameter re-passing". Combining the path analysis of CPG and the semantic reasoning of LLM, it explicitly models and tracks the data flow passed through object fields and layer-by-layer parameters, significantly improving the ability to discover implicit propagation paths and reducing the false negative rate.

[0093] To address the issue of poor interpretability, this invention aims to output "evidence-based" sensitive data flow links. Each link includes a clear starting point, intermediate transmission steps (including key lines of code and variable names), and an ending point, along with LLM semantic attribution reasons, providing complete and credible decision support for manual auditing and review.

[0094] Specifically, please refer to Figure 3 It mainly includes five core stages: 1) Source code parsing and CPG construction: The input industrial software source code is transformed into a structured code attribute graph (CPG), providing a unified data foundation for all subsequent automated analyses.

[0095] 2) Efficient screening of candidate function sets: Through structured and semantic multi-layer filtering, a large number of irrelevant parts are removed from massive amounts of code, significantly narrowing the scope of analysis and locating high-value candidate function sets.

[0096] 3) Function role attribution based on LLM agent: Using an LLM agent with self-optimization capabilities, the role (Source / Sink / Neutral) of candidate functions is accurately determined.

[0097] 4) Context-sensitive data flow tracing: Between the located Source and Sink, CPG path analysis and LLM semantic understanding are combined to trace the complete propagation path of sensitive data, especially the implicit propagation path that is difficult to discover by traditional methods.

[0098] 5) Results aggregation and report generation: Integrate all traced data flow paths into an analysis report containing a complete chain of evidence that can be manually audited.

[0099] Compared with the prior art, the advantages of the present invention can be divided into three parts: 1) Higher generalization and lower migration cost: Compared to traditional static analysis methods that heavily rely on manually defined rules, this invention leverages the powerful code semantic understanding and generalization capabilities of LLM to directly attribute the "roles" of functions at the semantic level. Through built-in prompt adaptation and consistency evaluation mechanisms, the LLM agent can automatically learn and adapt to different project and language coding paradigms and domain-specific APIs. This allows the invention to be applied "out of the box" to new industrial software projects with little or no manual intervention, greatly reducing the migration cost of analysis rules and improving analysis efficiency.

[0100] 2) Enhanced implicit propagation detection capabilities and lower false negative rate: Traditional methods have limited ability to track data passed across functions, object fields, or global variables. The "context-sensitive tracing" method proposed in this invention explicitly models "return value caching" and "parameter re-passing" patterns, and leverages the semantic reasoning capabilities of LLM to identify risks in intermediate states and guide recursive tracing, thus enabling the unblocking of implicit propagation links that are considered interrupted by traditional methods. This significantly improves the breadth of coverage for complex data streams and effectively reduces the false negative rate caused by implicit propagation.

[0101] 3) Enhanced Interpretability and Auditability: Compared to the "black-box" judgments of machine learning models and the simple conclusions of traditional rule matching, this invention provides "evidence-based" analysis results. Each discovered potential leakage path is presented as a complete chain from start to finish, including all critical code in intermediate steps. More importantly, key nodes in the chain (such as the determination of Source / Sink) are accompanied by attribution reasons given by LLM based on code semantics. This white-box, evidence-rich output format greatly enhances the credibility of the results, enabling security auditors to efficiently verify, trace, and remediate them, significantly increasing the practical value of the analysis results.

[0102] In this embodiment of the invention, a method for sensitive data identification and tracking in industrial software code is provided. The method involves acquiring the complete source code of an industrial software project, preprocessing the source code using a static analysis engine and a large language model, and outputting a set of high-value candidate functions and a code attribute graph. Based on predefined deterministic rules and predefined differentiated basic prompts, the large language model is used to attribute the function roles of the high-value candidate functions, outputting a calibrated judgment result set. Based on the calibrated judgment result set, multiple high-confidence functions and multiple difficult function samples awaiting expert arbitration are selected from the high-value candidate function set. Expert arbitration is performed on each difficult function sample awaiting expert arbitration to generate a gold standard knowledge base, which is then used to optimize the large language model to determine the target large language model. The target large language model is then used to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high-confidence functions, outputting an industrial software sensitive data tracking and analysis report. Based on the above scheme, this invention utilizes the powerful code semantic understanding and generalization capabilities of the large language model to directly attribute the "roles" of functions at the semantic level. By using predefined rules and prompts, the large language model can automatically learn and adapt to coding paradigms and domain-specific APIs of different projects and languages. This allows the invention to be applied "out of the box" to new industrial software projects, thereby reducing manual intervention, greatly reducing the migration cost of analysis rules, and thus improving analysis efficiency.

[0103] Please see Figure 4 , Figure 4 This is a structural block diagram of a sensitive data identification and tracking device for industrial software code provided in Embodiment 2 of the present invention.

[0104] This invention provides a sensitive data identification and tracking device for industrial software code, comprising: The acquisition module 401 is used to acquire the complete source code of the industrial software project, and preprocess the complete source code of the industrial software project based on the static analysis engine and the large language model, and output a high-value candidate function set and code attribute graph. Output module 402 is used to perform function role attribution on a high-value candidate function set based on predefined deterministic rules and predefined differentiated basic prompt words, and output a set of calibrated judgment results. The selection module 403 is used to select multiple high-confidence functions and multiple difficult function samples to be arbitrated by experts from the high-value candidate function set based on the set of calibrated judgment results. The determination module 404 is used to conduct expert arbitration on each difficult function sample to be arbitrated by experts, generate the gold standard knowledge base, and use the gold standard knowledge base to optimize the large language model and determine the target large language model. Analysis module 405 is used to perform sensitive data identification and tracking analysis based on the target large language model, code attribute graph and multiple high confidence functions, and output an industrial software sensitive data tracking and analysis report.

[0105] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0106] This invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program; when the computer program is executed by the processor, the processor performs the steps of the sensitive data identification and tracking method for industrial software code as described in any of the above embodiments.

[0107] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the sensitive data identification and tracking method for industrial software code as described in any of the above embodiments.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying and tracking sensitive data in industrial software code, characterized in that, include: The complete source code of the industrial software project is obtained, and the complete source code of the industrial software project is preprocessed based on the static analysis engine and the large language model to output a high-value candidate function set and code attribute graph. Based on predefined deterministic rules and predefined differentiated basic prompt words, the large language model is used to perform function role attribution on the high-value candidate function set, and output a set of calibrated judgment results. Based on the set of calibrated judgment results, a number of high-confidence functions and a number of difficult functions to be arbitrated by experts are selected from the set of high-value candidate functions. Expert arbitration is conducted on each of the problematic function samples to be arbitrated by experts to generate a gold standard knowledge base, and the gold standard knowledge base is used to optimize the large language model to determine the target large language model. The target large language model is used to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high confidence functions, and an industrial software sensitive data tracking and analysis report is output.

2. The sensitive data identification and tracking method for industrial software code according to claim 1, characterized in that, The preprocessing of the complete source code of the industrial software project based on the static analysis engine and large language model outputs a high-value candidate function set and code attribute graph, including: The static analysis engine is used to perform in-depth analysis of the complete source code of the industrial software project and generate a code attribute diagram. Based on the function call graph in the code attribute graph, the complete source code of the industrial software project is pre-screened in a structured manner, and the pre-screened function set is output. Based on the large language model, semantic hierarchical filtering is performed on the structured pre-screened function set to generate a high-value candidate function set.

3. The sensitive data identification and tracking method for industrial software code according to claim 2, characterized in that, The method of performing structured pre-screening of the complete source code of the industrial software project based on the function call graph in the code attribute graph, and outputting a structured pre-screened function set, including: The complete source code of the industrial software project is filtered by project structure to output multiple production environment codes. Based on the function call graph in the code attribute graph, code reachability filtering is performed on the functions in each production environment code, and a set of functions with call relationships is output. The functions in the set of functions with calling relationships are filtered by code complexity, and the set of functions with basic complexity is output. The functions in the set of functions with basic complexity are filtered by entity type, and the structured pre-filtered function set is output.

4. The sensitive data identification and tracking method for industrial software code according to claim 2, characterized in that, The step of performing semantic hierarchical filtering on the structured pre-screened function set based on the large language model to generate a high-value candidate function set includes: Construct an OT domain knowledge base and extract multi-dimensional information about each function in the structured pre-screened function set; The multi-dimensional information of each function in the structured pre-screened function set is encoded into a function query vector; Using the OT domain knowledge base, similarity retrieval is performed on each function in the structured pre-screened function set based on the function query vector of each function, and the associated document fragments of each function in the structured pre-screened function set are output. The multi-dimensional information of each function and the associated document fragments in the structured pre-screened function set are integrated into a corresponding semantic profile. The large language model is used to perform high-throughput coarse screening of each function in the structured pre-screened function set based on the semantic profile of each function, and output a high-value candidate function set.

5. The sensitive data identification and tracking method for industrial software code according to claim 1, characterized in that, The method, based on predefined deterministic rules and predefined differentiated basic prompt words, uses the large language model to perform function role attribution on the high-value candidate function set, and outputs a set of calibrated judgment results, including: The predefined deterministic rules are used to scan the high-value candidate function set to determine the initial silver-label function set and the non-silver-label function set; Multiple silver-labeled functions and multiple non-silver-labeled functions to be analyzed are selected from the initial silver-labeled function set and the non-silver-labeled function set. The source code, associated document fragments, and silver label of each silver-labeled function to be analyzed, and the source code and associated document fragments of each non-silver-labeled function to be analyzed are concatenated to output the silver label context of each silver-labeled function to be analyzed and the non-silver label context of each non-silver-labeled function to be analyzed. The silver label context of each of the silver label functions to be analyzed and the predefined differential basic prompt words are respectively input into the large language model, and the function attribution results of each of the silver label functions to be analyzed are output. The non-silver label context of each of the non-silver label functions to be analyzed and the predefined differential basic prompt words are respectively input into the large language model, and the function attribution results of each of the non-silver label functions to be analyzed are output. The authenticity of the event-level evidence in the function attribution results of each of the silver-labeled functions to be analyzed and the event-level evidence in the function attribution results of each of the non-silver-labeled functions to be analyzed is verified. Supplementary silver-label evidence is added to any silver-labeled function to be analyzed and any non-silver-labeled function to be analyzed corresponding to a function in the high-frequency I / O function table, thereby generating complete evidence for each non-silver-labeled function to be analyzed and complete evidence for each silver-labeled function to be analyzed. Based on the complete evidence of each of the non-silver-labeled functions to be analyzed, the associated non-silver-labeled functions to be analyzed are calibrated by event backtracking, and the calibration results of each non-silver-labeled function to be analyzed are generated. Based on the complete evidence of each of the silver-labeled functions to be analyzed, the associated silver-labeled functions to be analyzed are calibrated by event backtracking, and the calibration results of each silver-labeled function to be analyzed are generated. Based on the calibration results of each non-silver-labeled function to be analyzed and the calibration results of each silver-labeled function to be analyzed, a set of calibration results is generated.

6. The sensitive data identification and tracking method for industrial software code according to claim 1, characterized in that, The process of conducting expert arbitration on each of the problematic function samples to be arbitrated, generating a gold standard knowledge base, and using the gold standard knowledge base to optimize the large language model and determine the target large language model includes: Each of the problematic function samples to be arbitrated by experts is arbitrated by experts, and gold mark entries corresponding to each of the problematic function samples to be arbitrated by experts are generated. The Gold Standard Knowledge Base is constructed based on the Gold Standard entries corresponding to the various difficult function samples awaiting expert arbitration. Determine whether the number of gold-label entries in the gold-label knowledge base has reached a preset threshold. If so, the target gold-label entries in the gold-label knowledge base are used to update the small sample database of the large language model, and error-driven profiles are constructed to optimize the prompt words of the large language model, and the optimized large language model is determined. The optimized large language model is validated to determine the target large language model.

7. The sensitive data identification and tracking method for industrial software code according to claim 1, characterized in that, The process employs the target large language model to perform sensitive data identification and tracking analysis based on the code attribute graph and multiple high-confidence functions, outputting an industrial software sensitive data tracking and analysis report, including: Using the return value or output parameter of each of the high-confidence functions as taint sources, perform forward data flow analysis on the code property graph to generate multiple initial tracing paths; The target large language model is used to perform semantic verification on each of the initial tracking paths to generate a set of evidence chains for sensitive data streams. The sensitive data stream evidence chain set is aggregated into a structured evidence chain, and an industrial software sensitive data tracking and analysis report is output based on the structured evidence chain.

8. A sensitive data identification and tracking device for industrial software code, characterized in that, include: The acquisition module is used to acquire the complete source code of the industrial software project, and preprocess the complete source code of the industrial software project based on the static analysis engine and the large language model to output a high-value candidate function set and code attribute graph. The output module is used to perform function role attribution on the high-value candidate function set based on predefined deterministic rules and predefined differentiated basic prompt words, using the large language model, and output a set of calibrated judgment results. The selection module is used to select multiple high-confidence functions and multiple difficult function samples to be arbitrated by experts from the high-value candidate function set based on the set of calibrated judgment results. The determination module is used to perform expert arbitration on each of the difficult function samples to be arbitrated by experts, generate a gold standard knowledge base, and use the gold standard knowledge base to optimize the large language model to determine the target large language model. The analysis module is used to perform sensitive data identification and tracking analysis based on the target large language model, the code attribute graph, and multiple high confidence functions, and output an industrial software sensitive data tracking and analysis report.

9. A computer device, characterized in that, The system includes a memory and a processor, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the sensitive data identification and tracking method for industrial software code as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the sensitive data identification and tracking method for industrial software code as described in any one of claims 1-7.

Images