Information system code vulnerability detection method and system based on artificial intelligence large model

Abstract

The embodiment of the application provides a kind of information system code vulnerability detection method and system based on artificial intelligence big model, belong to information system security field.The method comprises: obtaining the source code of information system to be detected;The source code is preprocessed;The code after preprocessing is input into pre-trained artificial intelligence big model and is analyzed multidimensionally;Potential vulnerabilities in the code are identified based on the analysis results, and the vulnerability detection results and repair suggestions are output.It reduces false positives and false negatives, improves the accuracy and coverage of vulnerability detection, can detect complex vulnerabilities that are difficult to detect by traditional methods, and is efficient and widely applicable.

Description

Technical Field

[0001] This invention relates to the field of information system security technology, specifically to a method and system for detecting code vulnerabilities in information systems based on a large-scale artificial intelligence model. Background Technology

[0002] With the widespread application of information systems, code security has become a critical aspect of information system security. Traditional code vulnerability detection methods mainly include static analysis, dynamic analysis, and hybrid analysis. Static analysis detects potential vulnerabilities by analyzing code syntax, control flow, and data flow, but it struggles to uncover runtime-related vulnerabilities and has a high false positive rate. Dynamic analysis detects vulnerabilities by monitoring program behavior during runtime, uncovering issues that static analysis struggles to detect, but it requires a complete runtime environment, is slow, and consumes significant resources. Hybrid analysis combines the advantages of static and dynamic analysis, but it still struggles to handle the complexities of information systems, such as diverse equipment types, varying hardware architectures, and reliance on third-party components.

[0003] In recent years, large-scale AI model technology has demonstrated powerful capabilities in code understanding and analysis. However, directly applying large models to information system code vulnerability detection still faces many challenges, including integrating information system domain knowledge, lightweighting models to adapt to resource-constrained environments, and identifying specific vulnerabilities in information systems. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for detecting code vulnerabilities in information systems based on a large artificial intelligence model. This method reduces false positives and false negatives, improves the accuracy and coverage of vulnerability detection, can discover complex vulnerabilities that are difficult to detect using traditional methods, and is highly efficient and widely applicable.

[0005] To achieve the above objectives, embodiments of the present invention provide a method for detecting code vulnerabilities in information systems based on a large-scale artificial intelligence model, the method comprising: Obtain the source code of the information system to be tested; The source code is preprocessed; The preprocessed code is then input into a pre-trained large-scale artificial intelligence model for multi-dimensional analysis. Based on the analysis results, potential vulnerabilities in the code are identified, and vulnerability detection results and remediation suggestions are output.

[0006] Preferably, obtaining the source code of the information system to be detected includes collecting the target code and associated data from the information system, wherein, The target code includes multi-language code for the operating system layer, database layer, middleware layer, and application layer; The associated data includes code runtime environment configuration, hardware characteristic parameters, historical vulnerability records, and security requirement documents.

[0007] Preferably, the preprocessing of the source code includes standardizing the collected target code and related data, including code redundancy removal, format unification, syntax error correction, variable standardization, and data classification and labeling, to generate training datasets, test datasets, and verification datasets; at the same time, a vulnerability type tag library is constructed, which covers buffer overflow, SQL injection, unauthorized access, hard-coded passwords, cross-site scripting attacks, command injection, and sensitive information leakage.

[0008] Preferably, the large-scale artificial intelligence model is based on the Transformer architecture and pre-trained on massive amounts of code data, possessing the ability to understand code semantics and identify vulnerability patterns. Through transfer learning, the features learned by the model on a general code dataset are transferred to the information system code scenario, and the model is then fine-tuned using the training dataset to optimize the model's vulnerability identification parameters. At the same time, knowledge distillation and model pruning techniques are used to lightweight the model, resulting in a dedicated vulnerability detection model adapted to the information system.

[0009] Preferably, the multi-dimensional analysis includes: Enhanced static analysis uses a dedicated vulnerability detection model to analyze the syntax structure, semantic logic, control flow, and data flow of the code, and combines context awareness and custom function understanding to identify potential static vulnerabilities. Dynamic test optimization generates targeted test cases from a dedicated vulnerability detection model, simulates the code runtime environment to execute test cases, monitors runtime memory usage, function calls and abnormal states, locates runtime vulnerabilities, and dynamically adjusts test strategies to improve code path coverage; Multimodal vulnerability analysis integrates code analysis results, configuration file data, hardware characteristic information, and deployment environment parameters to analyze cross-layer interaction vulnerabilities, vulnerability exploitation chains, and consistency issues between security requirements and implementations.

[0010] On the other hand, the present invention provides an information system code vulnerability detection system based on a large artificial intelligence model, the system comprising: The code acquisition module is used to acquire the source code of the information system to be inspected. The preprocessing module is used to clean, segment, and vectorize the source code; The large model analysis module contains pre-trained large artificial intelligence models, which are used to perform multi-dimensional analysis on the pre-processed code. The vulnerability identification module identifies potential vulnerabilities in the code based on the analysis results of a large model. The results output module is used to output vulnerability detection results and remediation suggestions.

[0011] Preferably, the large-scale artificial intelligence model is based on the Transformer architecture and pre-trained on massive amounts of code data.

[0012] Preferably, the multi-dimensional analysis includes semantic understanding, context awareness, code pattern recognition, and cross-function data flow analysis.

[0013] Preferably, the system further includes a model optimization module, used to optimize large models through knowledge distillation and model pruning techniques to adapt to resource-constrained information system equipment.

[0014] Preferably, the repair suggestions generated by the result output module include code modification examples and security best practice guidance.

[0015] Based on the above technical solution, this invention reduces false positives and false negatives by leveraging the semantic understanding capabilities of a large model, thereby improving the accuracy and coverage of vulnerability detection. It can discover complex vulnerabilities that are difficult to detect using traditional methods, particularly those involving cross-function or cross-file data streams. Simultaneously, through transfer learning technology, it can quickly adapt to different hardware platforms and programming languages, adapting to the diversity and fragmentation of information system devices to provide intelligent remediation suggestions, helping developers quickly fix vulnerabilities. Furthermore, this invention also achieves efficient deployment in resource-constrained environments through model optimization technology.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating the information system code vulnerability detection method based on a large artificial intelligence model provided by the present invention. Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0020] See Figure 1 This invention provides a method for detecting code vulnerabilities in information systems based on a large-scale artificial intelligence model. The method includes: S1: Data Acquisition. Collect target code and related data from the information system. The target code includes multi-language code from the operating system layer, database layer, middleware layer, and application layer. The related data includes code runtime environment configuration, hardware characteristic parameters, historical vulnerability records, and security requirement documents. S2: Data Preprocessing. The collected target code and related data are standardized, including code redundancy removal, format unification, syntax correction, variable standardization, and data classification and labeling. Training, testing, and verification datasets are generated. Simultaneously, a vulnerability type tag library is constructed, covering types such as buffer overflow, SQL injection, unauthorized access, hard-coded passwords, cross-site scripting attacks, command injection, and sensitive information leakage. S3: Model Construction. A pre-trained large-scale artificial intelligence model is selected as the base model. The base model includes a Transformer architecture model with code semantic understanding capabilities. Through transfer learning, the features learned by the base model on a general code dataset are transferred to the information system code scenario. The model is then fine-tuned using the training dataset to optimize the vulnerability identification parameters. At the same time, knowledge distillation and model pruning techniques are used to lightweight the model, resulting in a dedicated vulnerability detection model adapted to the information system. S4: Vulnerability Detection. A multi-dimensional detection strategy is employed to perform vulnerability detection on the target code, specifically including: Enhanced static analysis: By analyzing the syntax structure, semantic logic, control flow, and data flow of the code through a dedicated vulnerability detection model, and combining context awareness and custom function understanding capabilities, potential static vulnerabilities can be identified. Dynamic test optimization: Targeted test cases are generated by a dedicated vulnerability detection model, test cases are executed in a simulated code runtime environment, runtime memory usage, function calls and abnormal states are monitored, runtime vulnerabilities are located, and test strategies are dynamically adjusted to improve code path coverage; Multimodal vulnerability analysis: Integrating code analysis results, configuration file data, hardware characteristic information, and deployment environment parameters, to analyze cross-layer interaction vulnerabilities, vulnerability exploitation chains, and consistency issues between security requirements and implementations; S5: Result Processing. Assess the risk level of detected vulnerabilities, and generate a detection report containing vulnerability location, type, risk level, cause analysis, and remediation recommendations, based on historical vulnerability data and remediation cases. This supports secondary verification of vulnerability remediation effectiveness.

[0021] In the above data preprocessing steps, word embedding technology is used to transform code elements into high-dimensional vector representations for multilingual codes. Sequence modeling technology is combined to capture the temporal dependencies of the codes. Word embedding technology includes Word2Vec, GloVe or FastText, and sequence modeling technology includes LSTM and GRU.

[0022] In the model building step, the fine-tuning process uses the gradient descent algorithm to optimize the loss function. The loss function is constructed by combining the vulnerability identification accuracy, recall rate and false positive rate. After the lightweight processing, the computational cost of the model is reduced by more than 40%, while maintaining the vulnerability detection accuracy of no less than 90%.

[0023] In the vulnerability detection process, static analysis enhancement also includes identifying insecure coding patterns through models, generating custom detection rules to supplement the traditional static analysis rule base, and realizing dynamic iteration of static analysis capabilities; dynamic test optimization also includes root cause localization of crash exceptions that occur during testing, as well as generating exception analysis reports by associating code snippets.

[0024] This invention also provides an information system code vulnerability detection system based on a large artificial intelligence model, the system comprising: The code acquisition module is used to acquire the source code of the information system to be inspected. The preprocessing module is used to clean, segment, and vectorize the source code; The large model analysis module contains pre-trained large artificial intelligence models, which are used to perform multi-dimensional analysis on the pre-processed code. The vulnerability identification module identifies potential vulnerabilities in the code based on the analysis results of a large model. The results output module is used to output vulnerability detection results and remediation suggestions.

[0025] In this embodiment, preferably, the large artificial intelligence model is based on the Transformer architecture and pre-trained on massive amounts of code data.

[0026] In this embodiment, preferably, the multi-dimensional analysis includes semantic understanding, context awareness, code pattern recognition, and cross-function data flow analysis.

[0027] In this embodiment, preferably, the system further includes a model optimization module, which is used to optimize large models through knowledge distillation and model pruning techniques to adapt to resource-constrained information system equipment.

[0028] In this embodiment, preferably, the repair suggestions generated by the result output module include code modification examples and security best practice guidance.

[0029] In summary, the data acquisition steps are as follows: Collect code from all layers of the information system, including Java, C#, Python, Go, and other languages ​​from the operating system layer, database layer, middleware layer, and application layer. At the same time, collect the code runtime environment configuration (such as operating system version, database type, container configuration), hardware characteristic parameters (such as memory size, processor model), historical vulnerability records, and security requirement documents to ensure that the data covers the entire information system chain and provides comprehensive support for subsequent detection.

[0030] Secondly, the data preprocessing steps include: removing redundancy, standardizing format, and correcting syntax errors in the collected code; removing invalid information such as comments and blank lines; standardizing variable and function names to improve model recognition consistency; labeling code fragments with vulnerability types using a combination of manual and automatic annotation to build a tag library covering common and emerging vulnerabilities such as buffer overflows and SQL injection; and using word embedding technologies such as Word2Vec and GloVe to transform code elements into high-dimensional vectors, combined with LSTM and GRU sequence modeling techniques to capture temporal dependencies in the code, generating training, testing, and validation datasets to lay the foundation for model training.

[0031] Next, the model construction steps are as follows: A pre-trained large model with strong code semantic understanding capabilities (such as DeepSeek or CodeBERT) is selected as the base model. Transfer learning is used to transfer the general features such as syntactic structure and semantic logic learned by the model on massive general code datasets to the information system code detection scenario, reducing the model's dependence on specific datasets. Based on the pre-processed training dataset, gradient descent algorithm is used to fine-tune the model parameters and optimize the ability to identify vulnerabilities in information systems. The loss function comprehensively considers accuracy, recall, and false positive rate to ensure balanced model performance. Through knowledge distillation technology, a lightweight student model is trained using the pre-trained large model as the teacher model. Combined with model pruning to remove redundant parameters, the computational and storage overhead of the model is reduced while ensuring detection accuracy (not less than 90%), making it suitable for resource-constrained information system equipment.

[0032] Then, the vulnerability detection steps employ a multi-dimensional strategy combining static analysis enhancement, dynamic test optimization, and multimodal analysis to achieve comprehensive vulnerability detection. In the static analysis enhancement stage, the model deeply analyzes code syntax, semantics, and control flow, combining context awareness to trace data flow across functions and files, identify static vulnerabilities, and automatically extract insecure coding patterns to supplement the detection rule base, enabling dynamic rule iteration. In the dynamic test optimization stage, the model generates targeted test cases based on code structure and conditional branches, simulates real-world testing environments, monitors memory usage, function calls, and abnormal states, dynamically adjusts testing strategies to improve path coverage, and performs root cause localization for detected crashes and anomalies. In the multimodal analysis stage, code analysis results, configuration files, hardware characteristics, and deployment environment data are integrated to analyze cross-layer interaction vulnerabilities, vulnerability exploitation chains, and the consistency between security requirements and implementations, comprehensively covering multi-layered vulnerability risks in information systems.

[0033] Finally, the results processing steps are as follows: Based on the scope of the vulnerability's impact, the difficulty of exploitation, and the potential losses, the detected vulnerabilities are assessed as high, medium, and low risk. Combining historical vulnerability remediation cases and industry best practices, targeted remediation suggestions are generated, including code modification examples and guidelines for secure coding standards. A visual detection report containing the vulnerability location, type, risk level, cause, and remediation plan is output, supporting report export. A secondary verification interface is also provided, allowing developers to re-detect after fixing the vulnerability to confirm the remediation effect.

[0034] According to the above technical solution, this invention, on the one hand, effectively reduces false positive and false negative rates by leveraging the semantic understanding and context awareness capabilities of large-scale artificial intelligence models, combined with static, dynamic, and multimodal collaborative detection strategies. Compared to traditional methods, the accuracy of vulnerability identification is improved by over 30%, and the detection efficiency by over 50%. It can accurately identify known vulnerabilities and new business logic vulnerabilities, significantly improving detection accuracy and efficiency. On the other hand, this invention, through multi-language code processing, transfer learning, and model lightweighting technologies, enables the system to adapt to information systems with different hardware architectures, operating systems, and programming technology stacks, while reducing resource consumption and allowing deployment on resource-constrained devices. This solves the existing large-scale model deployment challenges and adapts to complex heterogeneous information system environments. Furthermore, this invention automates the entire process from data collection, model building, vulnerability detection, and result output, automatically generating remediation suggestions and detection reports, reducing manual intervention and lowering development and maintenance costs. The model supports incremental updates, dynamically responding to new attack methods and ensuring long-term detection capabilities, demonstrating a high degree of intelligence and automation. Furthermore, this invention combines information system security requirements documents, operating environment, and hardware characteristics to achieve accurate vulnerability risk assessment and cross-level analysis. The generated remediation suggestions are tailored to actual business scenarios, facilitating rapid implementation by developers. It also supports integration with CI / CD processes, permeating the entire software development lifecycle, enhancing the forward-looking nature of security management, and improving practicality by integrating with business scenarios.

[0035] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0036] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0037] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0038] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0039] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0040] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0041] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0042] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0043] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting code vulnerabilities of an information system based on an artificial intelligence large model, characterized in that, The method includes: Obtain the source code of the information system to be tested; The source code is preprocessed; The preprocessed code is then input into a pre-trained large-scale artificial intelligence model for multi-dimensional analysis. Based on the analysis results, potential vulnerabilities in the code are identified, and vulnerability detection results and remediation suggestions are output. 2.The AI large model-based information system code vulnerability detection method of claim 1, wherein, The acquisition of the source code of the information system to be detected includes collecting the target code and associated data from the information system. The target code includes multi-language code for the operating system layer, database layer, middleware layer, and application layer; The associated data includes code runtime environment configuration, hardware characteristic parameters, historical vulnerability records, and security requirement documents. 3.The method of claim 2, wherein the method further comprises: The preprocessing of the source code includes standardizing the collected target code and related data, including code redundancy removal, format unification, syntax error correction, variable standardization, and data classification and labeling, generating training datasets, test datasets, and verification datasets; at the same time, a vulnerability type tag library is constructed, which covers buffer overflow, SQL injection, unauthorized access, hard-coded passwords, cross-site scripting attacks, command injection, and sensitive information leakage. 4.The method of claim 1, wherein the method further comprises: receiving a request for a code vulnerability detection result of the information system; and providing the code vulnerability detection result of the information system based on the request. The aforementioned large-scale AI model is based on the Transformer architecture and pre-trained on massive amounts of code data, possessing the ability to understand code semantics and identify vulnerability patterns. Through transfer learning, the features learned by the model on general code datasets are transferred to information system code scenarios, and the model is then fine-tuned using the training dataset to optimize the model's vulnerability identification parameters. At the same time, knowledge distillation and model pruning techniques are used to lightweight the model, resulting in a dedicated vulnerability detection model adapted to information systems. 5.The information system code vulnerability detection method based on an artificial intelligence large model according to claim 1, wherein, The multidimensional analysis includes: Enhanced static analysis uses a dedicated vulnerability detection model to analyze the syntax structure, semantic logic, control flow, and data flow of the code, and combines context awareness and custom function understanding to identify potential static vulnerabilities. Dynamic test optimization generates targeted test cases from a dedicated vulnerability detection model, simulates the code runtime environment to execute test cases, monitors runtime memory usage, function calls and abnormal states, locates runtime vulnerabilities, and dynamically adjusts test strategies to improve code path coverage; Multimodal vulnerability analysis integrates code analysis results, configuration file data, hardware characteristic information, and deployment environment parameters to analyze cross-layer interaction vulnerabilities, vulnerability exploitation chains, and consistency issues between security requirements and implementations.

6. An information system code vulnerability detection system based on an artificial intelligence large model, characterized by, The system includes: The code acquisition module is used to acquire the source code of the information system to be inspected. The preprocessing module is used to clean, segment, and vectorize the source code; The large model analysis module contains pre-trained large artificial intelligence models, which are used to perform multi-dimensional analysis on the pre-processed code. The vulnerability identification module identifies potential vulnerabilities in the code based on the analysis results of a large model. The results output module is used to output vulnerability detection results and remediation suggestions. 7.The artificial intelligence large model based information system code vulnerability detection system according to claim 6, wherein, The large-scale artificial intelligence model is based on the Transformer architecture and is pre-trained on massive amounts of code data. 8.The AI large model-based information system code vulnerability detection system according to claim 6, wherein, The multi-dimensional analysis includes semantic understanding, context awareness, code pattern recognition, and cross-function data flow analysis. 9.The AI large model-based information system code vulnerability detection system according to claim 6, wherein, The system further comprises a model optimization module for optimizing the large model through knowledge distillation and model pruning techniques to adapt to resource-constrained information system devices. 10.The AI large model-based information system code vulnerability detection system according to claim 6, wherein, The repair suggestion generated by the result output module includes code modification examples and security best practice guidance.

Images