Intelligent research and judgment method and system for false alarm of multi-source static analysis alarm

Abstract

This application belongs to the field of software security and program analysis technology, specifically disclosing a method and system for intelligent false alarm judgment of multi-source static analysis alarms. Through this application, raw warning data is mapped to a standardized alarm representation with a unified field structure; a target alarm data set is generated based on the deduplicated raw warning data; semantic representation learning is performed on code fragments; semantically similar alarm data are clustered; composite prompt information is constructed based on candidate knowledge entries and target code fragments corresponding to representative alarm data; and intelligent analysis and judgment are performed based on a large language model. Through the above methods, a series of processes are performed on the multi-source raw warning data generated by static analysis, including unified representation, explicit deduplication, semantic clustering, knowledge retrieval, false alarm analysis, and judgment. This achieves an integrated processing flow from alarm input to result distribution, without relying on project historical information, thereby effectively improving the efficiency and accuracy of false alarm analysis and judgment.

Description

Technical Field

[0001] This application belongs to the field of software security and program analysis technology, and more specifically, relates to a method and system for intelligent judgment of false alarms for multi-source static analysis alarms. Background Technology

[0002] Static analysis technology can analyze source code, intermediate representations, or binary code without executing the program, enabling the discovery of potential defects in the early stages of software development. This makes static analysis technology of significant value in software security auditing. With the continuous increase in software scale and complexity, static analysis tools have become an important technical means in vulnerability discovery, code auditing, and continuous integration. However, existing static analysis tools generally suffer from high false alarm rates, numerous duplicate alerts, and poor alert operability in practical applications. On the one hand, different static analysis tools have significant differences in rule systems, output fields, vulnerability naming, and alert location descriptions, which may generate multiple alerts with different forms but the same semantics for the same code defect, resulting in serious alert redundancy. On the other hand, static analysis tools typically employ analysis strategies such as abstract modeling, path approximation, and heuristic pruning, which easily generate a large number of false alarms that are "theoretically suspicious but practically unreachable" or "misjudgment due to lack of context." Therefore, it is necessary to analyze warning data from multiple static analysis tools.

[0003] Currently, common methods for false alarm analysis and warning data judgment rely on machine learning algorithms and large language models. However, machine learning algorithms require high-quality labeled data to learn patterns from historical information, and their generalization ability is limited in cross-project and cross-tool scenarios. Directly inputting warning data into a large language model for judgment still faces shortcomings such as lack of domain knowledge, insufficient contextual constraints, and large fluctuations in inference results. Therefore, the efficiency and accuracy of the above methods for false alarm analysis and judgment are relatively low. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this application aims to provide an intelligent method and system for analyzing false alarms based on multi-source static analysis. This addresses the issues of low efficiency and accuracy in false alarm analysis and judgment caused by the reliance on high-quality labeled data for machine learning algorithms to learn patterns from historical information, limited generalization capabilities across projects and tools, and the lack of domain knowledge, insufficient contextual constraints, and large fluctuations in inference results when large language models directly process warning data.

[0005] To achieve the above objectives, firstly, this application provides an intelligent method for judging false alarms in multi-source static analysis alarms, including: Upon receiving raw warning data from multiple static analysis tools, the raw warning data is mapped into a standardized alarm representation with a unified field structure; Based on the standardized alarm representation, a target alarm data set is generated from the deduplicated original alarm data, and semantic representation learning is performed on the code segments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector. Based on the alarm semantic vector, the semantically similar alarm data in the target alarm data set are clustered, and candidate knowledge entries corresponding to each representative alarm data in the cluster are determined. A composite prompt message is constructed based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster. Based on the large language model, intelligent analysis is performed on the composite prompt message, and the original warning data is judged as a false alarm based on the intelligent analysis results.

[0006] In one embodiment, the step of generating a target alarm data set based on the standardized alarm representation and the deduplicated original alarm data, and performing semantic representation learning on the code fragments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector, includes: Based on the standardized alarm representation, the code snippets corresponding to the original warning data are standardized. Generate a token normalized signature based on the normalized code snippet, and generate an alarm fingerprint based on the token normalized signature; When the alarm fingerprints corresponding to multiple original alarm data are the same, the multiple original alarm data are deduplicated, and a target alarm data set is generated based on the deduplicated multiple original alarm data. The code snippets corresponding to each alarm data in the target alarm data set are input into the pre-trained code representation model, and the alarm semantic vectors output by the pre-trained code representation model are obtained to complete the semantic representation learning for the code snippets.

[0007] In one embodiment, the step of clustering semantically similar alarm data in the target alarm data set based on the alarm semantic vector and determining candidate knowledge entries corresponding to each representative alarm data in the cluster includes: Obtain semantically similar alarm data from the target alarm data set; Based on the alarm semantic vector and the target adaptive clustering algorithm, the semantically similar alarm data are clustered, and a representative alarm data set is generated based on the clustering results; Determine the alarm vulnerability type corresponding to the representative alarm data set, and perform a first-level screening of the knowledge base organized according to the vulnerability type based on the alarm vulnerability type to obtain a candidate knowledge subset; Calculate the similarity between the alarm semantic vector of each representative alarm data in the representative alarm data set and each knowledge vector in the candidate knowledge subset; The similarities are sorted according to a preset sorting order, and the maximum similarity is extracted from the sorting results. Obtain the target knowledge vector corresponding to the maximum similarity, and filter candidate knowledge entries corresponding to the target knowledge vector from the candidate knowledge subset, and use the candidate knowledge entries as candidate knowledge entries representing alarm data.

[0008] In one embodiment, before the step of performing a first-level screening of the knowledge base organized according to the vulnerability type based on the alert vulnerability type to obtain a candidate knowledge subset, the method further includes: Each knowledge item is organized according to the general vulnerability enumeration type and subtype, wherein the knowledge item includes a vulnerability pattern description, vulnerability positive example code, security negative example code, and remediation suggestions; By calling database templates, a knowledge base organized by vulnerability type is constructed based on multiple knowledge entries of the organization.

[0009] In one embodiment, the steps of constructing composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, performing intelligent analysis based on the composite prompt information using a large language model, and judging the original warning data as a false alarm based on the intelligent analysis results include: Obtain the target code fragments corresponding to each representative alarm data of the cluster; By invoking a preset prompt word template, composite prompt information is constructed based on the candidate knowledge items, the target code fragment, and preset analysis instructions. The composite prompt information is input into a large language model so that the large language model can perform intelligent analysis based on the composite prompt information and make a false alarm judgment on the original warning data based on the intelligent analysis results.

[0010] In one embodiment, after the steps of constructing composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, performing intelligent analysis based on the composite prompt information using a large language model, and judging the original warning data as a false alarm based on the intelligent analysis results, the method further includes: Obtain the judgment results output by the large language model in a preset structured format, and extract the confidence score and authenticity judgment field corresponding to each representative alarm data from the judgment results; When the confidence score is higher than a preset high threshold, the vulnerability corresponding to the representative alarm data is determined to be a real vulnerability based on the authenticity determination field. If yes, the representative alarm data is assigned to the priority repair queue; otherwise, the representative alarm data is automatically turned off or suppressed. Representative alarm data with confidence scores below a preset low threshold are marked as high uncertainty cases, and these high uncertainty cases are assigned to a priority manual review queue. Representative alarm data whose confidence scores fall between the preset high threshold and the preset low threshold are allocated to the manual review queue to achieve alarm analysis and scheduling.

[0011] Secondly, this application provides an intelligent false alarm judgment system for multi-source static analysis alarms, including: The mapping module is used to map raw warning data from multiple static analysis tools into a standardized alarm representation with a unified field structure when raw warning data is received. The generation module is used to generate a target alarm data set based on the standardized alarm representation and the deduplicated original alarm data, and to perform semantic representation learning on the code fragments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector. The clustering module is used to cluster semantically similar alarm data in the target alarm data set based on the alarm semantic vector, and to determine candidate knowledge entries corresponding to each representative alarm data in the cluster. The analysis module is used to construct composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, perform intelligent analysis based on the composite prompt information based on the large language model, and make false alarm judgments on the original warning data based on the intelligent analysis results.

[0012] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method described in the first aspect or any possible implementation thereof.

[0013] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0014] Fifthly, this application provides a computer program product that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0015] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0016] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art: (1) When receiving raw warning data from multiple static analysis tools, this application pre-defines a unified field structure, maps and normalizes the raw warning data from multiple sources to form a standardized alarm representation, and eliminates the processing obstacles caused by the inconsistent output formats of different analysis tools. In order to facilitate subsequent clustering, knowledge retrieval and intelligent judgment processes, the vulnerability type field is preferably uniformly mapped to a general vulnerability enumeration type. Then, semantic representation learning is performed on the code segments corresponding to each alarm data, and the alarm data with similar semantics are clustered based on the alarm semantic vector. This can identify deep similar alarms that have undergone grammatical transformation but are semantically equivalent, realize efficient semantic grouping across tools and code variants, and introduce a large language model to perform intelligent analysis and judgment based on composite prompt information. In the entire process of the above processing, there is no need to rely on project historical information, thereby effectively improving the efficiency and accuracy of false alarm analysis and judgment.

[0017] (2) After standardizing the code snippets corresponding to the original warning data, this application will generate token standardization signatures based on the standardized code snippets and further generate alarm fingerprints to quickly eliminate explicit duplicate alarms, thereby effectively improving the accuracy of generating the target alarm data set and the efficiency of compressing alarm data. According to the type of alarm vulnerability, the knowledge base organized by vulnerability type is screened at the first level. The similarity between the alarm semantic vector of each representative alarm data in the alarm data set and each knowledge vector in the candidate knowledge subset is calculated. After screening the candidate knowledge entries corresponding to the target knowledge vector from the candidate knowledge subset, the candidate knowledge entries are used as the candidate knowledge entries corresponding to the representative alarm data. Through the two-level retrieval mechanism of "vulnerability type filtering + semantic similarity matching", the retrieval scope can be narrowed while effectively improving the relevance between the retrieval results and the current alarm data, which can provide targeted domain knowledge support for subsequent judgment. In order to effectively improve the overall efficiency and engineering practicality of static analysis post-processing, a graded disposal mechanism based on the authenticity judgment result and confidence score will also be set up.

[0018] In summary, when receiving raw warning data from multiple static analysis tools, this application maps the raw warning data into a standardized alarm representation with a unified field structure. Based on the standardized alarm representation, a target alarm data set is generated from the deduplicated raw warning data. Semantic representation learning is performed on the code fragments corresponding to each alarm data in the target alarm data set to obtain alarm semantic vectors. Based on the alarm semantic vectors, semantically similar alarm data in the target alarm data set are clustered, and candidate knowledge entries corresponding to each representative alarm data in the cluster are determined. Composite prompt information is constructed based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data in the cluster. Based on a large language model, intelligent analysis is performed on the composite prompt information, and false alarm judgment is made on the raw warning data based on the intelligent analysis results. By employing the methods described above, a series of processes are performed on the raw warning data generated from multiple sources through static analysis, including unified representation, explicit deduplication, semantic clustering, knowledge retrieval, and intelligent analysis and judgment. This achieves an integrated processing flow from alarm input to result distribution, without relying on historical project information, thereby effectively improving the efficiency and accuracy of false alarm analysis and judgment. Attached Figure Description

[0019] Figure 1 This is one of the flowcharts illustrating the intelligent judgment method for false alarms based on multi-source static analysis alarms provided in this application embodiment; Figure 2 This is a simplified overall process diagram provided in the embodiments of this application; Figure 3 This is the second flowchart of the intelligent judgment method for false alarms based on multi-source static analysis alarms provided in the embodiments of this application; Figure 4 This is a schematic diagram of the module structure of the intelligent judgment system for false alarms based on multi-source static analysis alarms provided in this application embodiment; Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0022] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. For example, "first response message" and "second response message," etc., are used to distinguish different response messages, not to describe a specific order of response messages.

[0023] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0024] Based on this, embodiments of this application provide an intelligent method for judging false alarms in multi-source static analysis alarms, referring to... Figure 1 , Figure 1 This is one of the flowcharts illustrating the intelligent false alarm assessment method for multi-source static analysis alarms provided in this application embodiment. In this embodiment, the intelligent false alarm assessment method for multi-source static analysis alarms includes steps S10 to S40: Step S10: Upon receiving raw warning data from multiple static analysis tools, the raw warning data is mapped into a standardized alarm representation with a unified field structure.

[0025] It should be understood that due to differences in file path representation, alarm location description, vulnerability rule naming, alarm message format, and associated code organization among different static analysis tools, it is difficult to directly merge and compare the output results of different tools. Therefore, this embodiment will pre-define a unified field structure to map and normalize the original warning data from multiple sources, forming a standardized alarm representation and eliminating processing obstacles caused by inconsistencies in the output formats of different analysis tools. To facilitate subsequent clustering, knowledge retrieval, and intelligent judgment processes, the vulnerability type field is preferably uniformly mapped to a general vulnerability enumeration type.

[0026] Step S20: Based on the standardized alarm representation, generate a target alarm data set according to the deduplicated original warning data, and perform semantic representation learning on the code segments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector.

[0027] It is understandable that the target alarm data set refers to the alarm set generated by multiple original alarm data after normalization and deduplication. In order to identify deep similar alarms with different surface forms but the same vulnerability pattern, semantic representation learning will be performed on the code fragments corresponding to each alarm data in the target alarm data set to obtain the alarm semantic vector corresponding to the code fragment.

[0028] Step S30: Based on the alarm semantic vector, cluster the semantically similar alarm data in the target alarm data set, and determine the candidate knowledge entries corresponding to each representative alarm data in the cluster.

[0029] It should be understood that, in order to aggregate the superficially inconsistent alarm data caused by variable renaming, local structure adjustment or code writing differences into the same semantic cluster, after obtaining the alarm semantic vector, the semantically similar alarm data in the target alarm data set can be clustered based on the alarm semantic vector, and a representative warning data is retained in each semantic cluster to obtain a representative alarm data set. The candidate knowledge entries refer to the knowledge entries determined by the two-level retrieval of "vulnerability type filtering + vector similarity matching".

[0030] Further, step S30 includes: acquiring semantically similar alarm data from the target alarm data set; clustering the semantically similar alarm data based on the alarm semantic vector and the target adaptive clustering algorithm, and generating a representative alarm data set based on the clustering results; determining the alarm vulnerability type corresponding to the representative alarm data set, and performing a first-level screening on the knowledge base organized according to the vulnerability type based on the alarm vulnerability type to obtain a candidate knowledge subset; calculating the similarity between the alarm semantic vector of each representative alarm data in the representative alarm data set and each knowledge vector in the candidate knowledge subset; sorting each similarity according to a preset sorting order, and extracting the maximum similarity from the sorting results; acquiring the target knowledge vector corresponding to the maximum similarity, and filtering candidate knowledge entries corresponding to the target knowledge vector from the candidate knowledge subset, and using the candidate knowledge entries as candidate knowledge entries corresponding to the representative alarm data.

[0031] It should be noted that after obtaining the alarm semantic vectors, the semantically similar alarm data can be clustered based on the similarity relationship between the alarm semantic vectors and the target adaptive clustering algorithm. The target adaptive clustering algorithm refers to the density-based adaptive clustering algorithm, which can be the DBSCAN clustering algorithm.

[0032] Understandably, for each representative alarm data in the representative alarm data set, knowledge retrieval is required. Specifically, this involves: firstly filtering the knowledge base organized by vulnerability type based on the alarm vulnerability type; calculating the similarity between the alarm semantic vector of each representative alarm data in the representative alarm data set and each knowledge vector in the candidate knowledge subset; using an algorithm that calculates cosine similarity; and then selecting candidate knowledge entries corresponding to the target knowledge vector from the candidate knowledge subset, and using these candidate knowledge entries as the corresponding candidate knowledge entries for the representative alarm data. Through this two-level retrieval mechanism of "vulnerability type filtering + semantic similarity matching," the relevance between the retrieval results and the current alarm data can be effectively improved while narrowing the retrieval scope.

[0033] Furthermore, before the step of performing a first-level screening of the knowledge base organized according to the vulnerability type based on the alarm vulnerability type to obtain a candidate knowledge subset, the method further includes: organizing each knowledge item according to a general vulnerability enumeration type and subtype, wherein the knowledge item includes a vulnerability pattern description, vulnerability positive example code, security negative example code, and remediation suggestions; and constructing a knowledge base organized according to vulnerability type based on multiple organized knowledge items by calling a database construction template.

[0034] It should be understood that, in order to provide structured domain knowledge support for subsequent intelligent analysis, this embodiment will introduce a knowledge base organized according to vulnerability type. Specifically, the knowledge base organized according to vulnerability type will be screened in the first layer according to the type of the alert vulnerability to obtain a subset of candidate knowledge. For this knowledge base, each knowledge item will be organized according to a general vulnerability enumeration type or its subtype. Each knowledge item will include at least a vulnerability pattern description, a positive example of vulnerability code, a negative example of security code, and a remediation suggestion. The positive example of vulnerability code is used to represent the typical code form of a real vulnerability, the negative example of security code is used to represent code instances that are similar to the vulnerability surface but do not constitute a vulnerability, and the remediation suggestion is used to provide a direction for rectification after a real vulnerability is identified.

[0035] It should be noted that, in order to effectively improve the efficiency of building a knowledge base organized by vulnerability type, after obtaining multiple knowledge entries, a database construction template is called for construction. To achieve efficient semantic retrieval, this embodiment converts the vulnerability positive example code in the knowledge base into corresponding knowledge vectors and stores these knowledge vectors in a vector index structure. In addition, to reduce storage and computational overhead, this embodiment can also perform semantic vectorization only on the vulnerability positive example code.

[0036] Step S40: Construct composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster; perform intelligent analysis based on the composite prompt information using a large language model; and determine false alarms based on the results of the intelligent analysis of the original warning data.

[0037] Understandably, composite prompts, as input to the large language model, are used to intelligently analyze and judge false alarms from raw warning data from multiple static analysis tools. After obtaining candidate knowledge items, composite prompts can be constructed by combining the target code fragments corresponding to each representative alarm data. For example, the above information can be input into a preset prompt word template to form structured composite prompts. At this time, the composite prompts include at least the alarm code to be analyzed, the corresponding vulnerability type information, the vulnerability positive example code, the security negative example, and the remediation suggestions. Among them, adding the vulnerability positive example code can help the large language model understand the typical patterns of real vulnerabilities, adding the security negative example can help the large language model identify scenarios that are superficially similar but do not constitute vulnerabilities, and adding the remediation suggestions can help generate actionable remediation opinions while outputting the authenticity judgment.

[0038] It should be understood that by inputting composite prompt information into a large language model, which then outputs intelligent judgment results, an integrated processing flow from alarm input to result distribution is achieved. Through the coordinated efforts of the above steps, this embodiment can accurately and intelligently judge alarm data from large-scale, multi-source, and heterogeneous static analysis without relying on historical project information. Compared with conventional methods that rely solely on rule filtering, shallow feature matching, or single model classification, this embodiment can better adapt to multiple static analysis tools, multiple vulnerability types, and large-scale alarm scenarios, effectively improving false alarm identification accuracy and the usability of judgment results while ensuring processing efficiency.

[0039] Further, step S40 includes: acquiring target code fragments corresponding to each representative alarm data of the cluster; constructing composite prompt information based on the candidate knowledge entries, the target code fragments, and preset analysis instructions by calling a preset prompt word template; inputting the composite prompt information into a large language model so that the large language model performs intelligent analysis based on the composite prompt information, and makes a false alarm judgment on the original warning data based on the intelligent analysis results.

[0040] It should be understood that after constructing composite prompt information based on candidate knowledge items, target code snippets, and preset analysis instructions by calling preset prompt word templates, the composite prompt information is input into the large language model. The large language model is then constrained to output the judgment results in a structured format. The structured judgment results include at least the authenticity judgment field, the confidence score field, and the repair suggestion field, and can be output in the form of a report.

[0041] Further, after step S40, the method includes: obtaining the judgment result output by the large language model in a preset structured format, and extracting the confidence score and authenticity judgment field corresponding to each representative alarm data from the judgment result; when the confidence score is higher than a preset high threshold, determining whether the vulnerability corresponding to the representative alarm data is a real vulnerability based on the authenticity judgment field; if so, allocating the representative alarm data to a priority repair queue; if not, automatically closing or suppressing the representative alarm data; marking the representative alarm data with the confidence score lower than a preset low threshold as high uncertainty cases, and allocating the high uncertainty cases to a priority manual review queue; allocating the representative alarm data with the confidence score between the preset high threshold and the preset low threshold to a manual review queue, so as to realize the scheduling of intelligent alarm analysis and judgment.

[0042] It should be noted that after intelligent judgment based on the large language model and the composite prompt information, this embodiment will also obtain the judgment result output by the large language model in a preset structured format, and extract the confidence score and authenticity judgment field corresponding to each representative alarm data from the judgment result. Based on the authenticity judgment result and the confidence score, the representative alarm data will be classified and processed. Before this, a preset high threshold and a preset low threshold need to be set respectively. The preset high threshold represents the upper limit, and the preset low threshold represents the lower limit.

[0043] Understandably, after extracting the confidence scores corresponding to each representative alarm data from the judgment results, the alarms can be divided into three categories: high confidence, medium confidence, and low confidence based on the confidence scores. High confidence refers to a confidence score higher than a preset high threshold, medium confidence refers to a confidence score between the preset high threshold and the preset low threshold, and low confidence refers to a confidence score lower than the preset low threshold. When the confidence score is higher than the preset high threshold, it indicates that the reliability of the judgment result is relatively high. At this time, the authenticity judgment field is used to further determine whether the vulnerability corresponding to the representative alarm data is a real vulnerability. If it is, the representative alarm data is assigned to the priority remediation queue; otherwise, it is judged as a false alarm, and the representative alarm data is automatically closed or suppressed. For representative alarm data with a confidence score lower than the preset low threshold, it is directly marked as a high uncertainty case and assigned to the priority manual review queue. For representative alarm data with a confidence score between the preset high threshold and the preset low threshold, it is assigned to the manual review queue. In other words, representative alarm data with low confidence or uncertainty is assigned to the manual queue to realize the scheduling of intelligent alarm analysis and judgment, which can effectively improve the overall efficiency and engineering practicality of static analysis post-processing.

[0044] It also needs to be explained that the reference Figure 2 , Figure 2 The following is a simplified flowchart of the overall process: The input consists of raw warning data from multiple static analysis tools. Since semantic representation learning and constructing compound prompts are required for code snippets, a code repository is also needed. At this point, a token normalization signature is generated based on the normalized code snippets, and an alarm fingerprint is generated based on the token normalization signature. When the alarm fingerprints corresponding to the raw alarm data are the same, multiple raw alarm data are deduplicated, and a pre-trained code representation model outputs an alarm semantic vector to complete the semantic representation learning for the code snippets. Then, a knowledge base organized according to vulnerability types is used to determine candidate knowledge entries corresponding to the representative alarm data. Based on a large language model, intelligent judgment is performed according to the compound prompts, and the judgment result is output in the form of a report.

[0045] This embodiment, upon receiving raw warning data from multiple static analysis tools, maps the raw warning data into a standardized alarm representation with a unified field structure. Based on this standardized alarm representation, a target alarm data set is generated from the deduplicated raw warning data. Semantic representation learning is performed on the code fragments corresponding to each alarm data in the target alarm data set to obtain alarm semantic vectors. Based on the alarm semantic vectors, semantically similar alarm data in the target alarm data set are clustered, and candidate knowledge entries corresponding to each representative alarm data in the cluster are determined. Composite prompt information is constructed based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data in the cluster. Based on a large language model, intelligent analysis is performed on the composite prompt information, and the original warning data is judged as a false alarm based on the intelligent analysis results. Through the above method, a series of processes, including unified representation, explicit deduplication, semantic clustering, knowledge retrieval, intelligent analysis, and judgment, are performed on the multi-source raw warning data generated by static analysis. This achieves an integrated processing flow from alarm input to result distribution, without relying on project historical information, thereby effectively improving the efficiency and accuracy of false alarm analysis and judgment.

[0046] In one specific implementation, this application provides steps for generating a target alarm dataset and determining alarm semantic vectors. Please refer to... Figure 3 , Figure 3 This is the second flowchart illustrating the intelligent false alarm assessment method for multi-source static analysis alarms provided in this application embodiment. Step S20 includes steps S201 to S204: Step S201: Based on the standardized alarm representation, the code segment corresponding to the original warning data is standardized.

[0047] It should be noted that after completing the unified representation of the raw warning data from multiple static analysis tools, it is also necessary to normalize the code snippets corresponding to the raw warning data. This normalization process includes, but is not limited to, removing comments, standardizing whitespace characters, replacing string constants and numeric constants with uniform placeholders, and normalizing local variable identifiers, in order to reduce the impact of code surface differences on duplicate detection results.

[0048] Step S202: Generate a token normalized signature based on the normalized code snippet, and generate an alarm fingerprint based on the token normalized signature.

[0049] It is understandable that after normalizing the code snippets corresponding to the original warning data, a token normalized signature or an equivalent normalized representation can be generated based on the normalized code snippets. This embodiment uses a token normalized signature as an example for illustration, and further generates an alarm fingerprint to identify explicit duplicate alarm data. In order to effectively improve the accuracy and uniqueness of the generated alarm fingerprint, the file path, line number, and vulnerability type information in the standardized alarm representation can also be combined when generating the alarm fingerprint.

[0050] Step S203: When the alarm fingerprints corresponding to multiple original alarm data are the same, the multiple original alarm data are deduplicated, and a target alarm data set is generated based on the deduplicated multiple original alarm data.

[0051] It should be understood that when multiple original alarm data have the same alarm fingerprint, the multiple original alarm data are determined to be explicit duplicate alarm data, that is, the alarm fingerprint exists in the fingerprint dictionary. At this time, it is necessary to deduplicate the multiple original alarm data and assign a globally unique alarm ID to one of the original alarm data. That is, only one of the original alarm data is kept to enter the subsequent processing flow. Then, the target alarm data set is generated from the multiple deduplicated original alarm data.

[0052] Step S204: Input the code fragments corresponding to each alarm data in the target alarm data set into the pre-trained code representation model, and obtain the alarm semantic vectors output by the pre-trained code representation model to complete the semantic representation learning for the code fragments.

[0053] Understandably, in order to identify deep similarity alerts that have different surface forms but the same vulnerability pattern, it is also necessary to perform semantic representation learning on the code fragments corresponding to each alert data in the target alert data set. Specifically, the code fragments corresponding to each alert data are input into a pre-trained code representation model, that is, the pre-trained code representation model completes the semantic representation learning for the code fragments. This pre-trained code representation model can be the CodeBERT model, or other pre-trained models that can represent code semantics. This embodiment does not limit this and uses the CodeBERT model as an example for explanation.

[0054] This embodiment normalizes the code segments corresponding to the original warning data based on the standardized alarm representation; generates a token normalized signature based on the normalized code segments, and generates an alarm fingerprint based on the token normalized signature; when the alarm fingerprints corresponding to multiple original alarm data are the same, the multiple original alarm data are deduplicated, and a target alarm data set is generated based on the deduplicated multiple original alarm data; the code segments corresponding to each alarm data in the target alarm data set are input into a pre-trained code representation model, and the alarm semantic vector output by the pre-trained code representation model is obtained to complete the semantic representation learning for the code segments. Through the above method, after generating the token normalized signature based on the normalized code segments, an alarm fingerprint is further generated to identify explicitly duplicate alarm data. When the alarm fingerprints corresponding to multiple original alarm data are the same, the multiple original alarm data are deduplicated, retaining only one original alarm data, and the semantic representation learning for the code segments is completed through the pre-trained code representation model, thereby effectively improving the accuracy of determining the alarm semantic vector.

[0055] The following describes the intelligent false alarm assessment system for multi-source static analysis alarms provided in this application. The intelligent false alarm assessment system for multi-source static analysis alarms described below can be referred to in conjunction with the intelligent false alarm assessment method for multi-source static analysis alarms described above. Please refer to... Figure 4 , Figure 4 This is a schematic diagram of the module structure of the intelligent false alarm judgment system for multi-source static analysis alarms provided in this application embodiment, including: The mapping module T10 is used to map the raw warning data from multiple static analysis tools into a standardized alarm representation with a unified field structure when the raw warning data is received.

[0056] The generation module T20 is used to generate a target alarm data set based on the standardized alarm representation and the deduplicated original warning data, and to perform semantic representation learning on the code fragments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector.

[0057] The clustering module T30 is used to cluster semantically similar alarm data in the target alarm data set based on the alarm semantic vector, and to determine candidate knowledge entries corresponding to each representative alarm data in the cluster.

[0058] The analysis module T40 is used to construct composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, perform intelligent analysis based on the composite prompt information based on the large language model, and make false alarm judgments on the original warning data based on the intelligent analysis results.

[0059] This embodiment, upon receiving raw warning data from multiple static analysis tools, maps the raw warning data into a standardized alarm representation with a unified field structure. Based on this standardized alarm representation, a target alarm data set is generated from the deduplicated raw warning data. Semantic representation learning is performed on the code fragments corresponding to each alarm data in the target alarm data set to obtain alarm semantic vectors. Based on the alarm semantic vectors, semantically similar alarm data in the target alarm data set are clustered, and candidate knowledge entries corresponding to each representative alarm data in the cluster are determined. Composite prompt information is constructed based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data in the cluster. Based on a large language model, intelligent analysis is performed on the composite prompt information, and the original warning data is judged as a false alarm based on the intelligent analysis results. Through the above method, a series of processes, including unified representation, explicit deduplication, semantic clustering, knowledge retrieval, intelligent analysis, and judgment, are performed on the multi-source raw warning data generated by static analysis. This achieves an integrated processing flow from alarm input to result distribution, without relying on project historical information, thereby effectively improving the efficiency and accuracy of false alarm analysis and judgment.

[0060] It is understood that the detailed functional implementation of each of the above modules can be found in the description of the aforementioned method embodiments, and will not be repeated here.

[0061] It should be understood that the above system is used to execute the methods in the above embodiments. The corresponding program modules in the system are similar in implementation principle and technical effect to those described in the above methods. The working process of the system can be referred to the corresponding process in the above methods, and will not be repeated here.

[0062] Based on the methods in the above embodiments, this application provides an electronic device, please refer to... Figure 5 , Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.

[0063] It should be noted that the system may include: a processor 10, a communications interface 20, a memory 30, and a communication bus 40. The processor 10, communications interface 20, and memory 30 communicate with each other via the communication bus 40. The processor 10 can invoke logical instructions stored in the memory 30 to execute the methods described in the above embodiments.

[0064] Furthermore, the logical instructions in the aforementioned memory 30 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0065] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0066] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0067] It is understood that the processor in the embodiments of this application can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field-programmable gate arrays, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0068] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0069] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. Those skilled in the art will readily understand that the above descriptions are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for intelligently judging false alarms in multi-source static analysis alarms, characterized in that, include: Upon receiving raw warning data from multiple static analysis tools, the raw warning data is mapped into a standardized alarm representation with a unified field structure; Based on the standardized alarm representation, a target alarm data set is generated from the deduplicated original alarm data, and semantic representation learning is performed on the code segments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector. Based on the alarm semantic vector, the semantically similar alarm data in the target alarm data set are clustered, and candidate knowledge entries corresponding to each representative alarm data in the cluster are determined. A composite prompt message is constructed based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster. Based on the large language model, intelligent analysis is performed on the composite prompt message, and the original warning data is judged as a false alarm based on the intelligent analysis results.

2. The false alarm intelligent judgment method as described in claim 1, characterized in that, The steps of generating a target alarm data set based on the standardized alarm representation and the deduplicated original alarm data, and performing semantic representation learning on the code fragments corresponding to each alarm data in the target alarm data set to obtain alarm semantic vectors, include: Based on the standardized alarm representation, the code snippets corresponding to the original warning data are standardized. Generate a token normalized signature based on the normalized code snippet, and generate an alarm fingerprint based on the token normalized signature; When the alarm fingerprints corresponding to multiple original alarm data are the same, the multiple original alarm data are deduplicated, and a target alarm data set is generated based on the deduplicated multiple original alarm data. The code snippets corresponding to each alarm data in the target alarm data set are input into the pre-trained code representation model, and the alarm semantic vectors output by the pre-trained code representation model are obtained to complete the semantic representation learning for the code snippets.

3. The false alarm intelligent judgment method as described in claim 1, characterized in that, The step of clustering semantically similar alarm data in the target alarm data set based on the alarm semantic vector, and determining candidate knowledge entries corresponding to each representative alarm data in the cluster, includes: Obtain semantically similar alarm data from the target alarm data set; Based on the alarm semantic vector and the target adaptive clustering algorithm, the semantically similar alarm data are clustered, and a representative alarm data set is generated based on the clustering results; Determine the alarm vulnerability type corresponding to the representative alarm data set, and perform a first-level screening of the knowledge base organized according to the vulnerability type based on the alarm vulnerability type to obtain a candidate knowledge subset; Calculate the similarity between the alarm semantic vector of each representative alarm data in the representative alarm data set and each knowledge vector in the candidate knowledge subset; The similarities are sorted according to a preset sorting order, and the maximum similarity is extracted from the sorting results. Obtain the target knowledge vector corresponding to the maximum similarity, and filter candidate knowledge entries corresponding to the target knowledge vector from the candidate knowledge subset, and use the candidate knowledge entries as candidate knowledge entries representing alarm data.

4. The false alarm intelligent judgment method as described in claim 3, characterized in that, Before the step of performing a first-level screening of the knowledge base organized by vulnerability type according to the alert vulnerability type to obtain a candidate knowledge subset, the method further includes: Each knowledge item is organized according to the general vulnerability enumeration type and subtype, wherein the knowledge item includes a vulnerability pattern description, vulnerability positive example code, security negative example code, and remediation suggestions; By calling database templates, a knowledge base organized by vulnerability type is constructed based on multiple knowledge entries of the organization.

5. The false alarm intelligent judgment method as described in claim 1, characterized in that, The steps of constructing composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, performing intelligent analysis based on the composite prompt information using a large language model, and judging the original warning data as false alarms based on the intelligent analysis results include: Obtain the target code fragments corresponding to each representative alarm data of the cluster; By invoking a preset prompt word template, composite prompt information is constructed based on the candidate knowledge items, the target code fragment, and preset analysis instructions. The composite prompt information is input into a large language model so that the large language model can perform intelligent analysis based on the composite prompt information and make a false alarm judgment on the original warning data based on the intelligent analysis results.

6. The false alarm intelligent judgment method as described in any one of claims 1 to 5, characterized in that, After the steps of constructing composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, performing intelligent analysis based on the composite prompt information using a large language model, and judging the original warning data as false alarms based on the intelligent analysis results, the method further includes: Obtain the judgment results output by the large language model in a preset structured format, and extract the confidence score and authenticity judgment field corresponding to each representative alarm data from the judgment results; When the confidence score is higher than a preset high threshold, the vulnerability corresponding to the representative alarm data is determined to be a real vulnerability based on the authenticity determination field. If yes, the representative alarm data is assigned to the priority repair queue; otherwise, the representative alarm data is automatically turned off or suppressed. Representative alarm data with confidence scores below a preset low threshold are marked as high uncertainty cases, and these high uncertainty cases are assigned to a priority manual review queue. Representative alarm data whose confidence scores fall between the preset high threshold and the preset low threshold are allocated to the manual review queue to achieve alarm analysis and scheduling.

7. A false alarm intelligent judgment system for multi-source static analysis alarms, characterized in that, include: The mapping module is used to map raw warning data from multiple static analysis tools into a standardized alarm representation with a unified field structure when raw warning data is received. The generation module is used to generate a target alarm data set based on the standardized alarm representation and the deduplicated original alarm data, and to perform semantic representation learning on the code fragments corresponding to each alarm data in the target alarm data set to obtain an alarm semantic vector. The clustering module is used to cluster semantically similar alarm data in the target alarm data set based on the alarm semantic vector, and to determine candidate knowledge entries corresponding to each representative alarm data in the cluster. The analysis module is used to construct composite prompt information based on the candidate knowledge entries and the target code fragments corresponding to each representative alarm data of the cluster, perform intelligent analysis based on the composite prompt information based on the large language model, and make false alarm judgments on the original warning data based on the intelligent analysis results.

8. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the false alarm intelligent judgment method as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on the processor, the processor performs the false alarm intelligent judgment method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is run on the processor, the processor performs the method for intelligent false alarm judgment as described in any one of claims 1-6.

Images