AI-generated code security audit method and system based on rule and semantic fusion

Abstract

The application provides an AI-generated code security audit method and system based on rule and semantic fusion, relating to the technical field of code security audit, which comprises receiving an AI-generated code file and calling a rule matching engine for rule scanning, identifying code segments matching known vulnerability patterns, and outputting candidate vulnerability sites; extracting the context code segments of the candidate sites and parsing to generate abstract syntax tree segments, outputting valid vulnerability sites after data flow and control flow verification; performing semantic feature extraction and vector encoding on the context code segments of the valid sites to generate code semantic embedding vectors, matching the vectors with a vulnerability pattern template library for semantic similarity, obtaining semantic high-risk sites, constructing semantic review prompts corresponding to the high-risk sites, and submitting them to a large language model to generate a security audit report, thereby accurately screening out false vulnerabilities and identifying AI code hidden hazards, reducing the workload of manual audit, and improving the security audit accuracy of AI code.

Description

Technical Field

[0001] This invention relates to the field of code security auditing technology, and in particular to a method and system for security auditing AI-generated code based on rule and semantic fusion. Background Technology

[0002] As large-scale model-generated code is widely incorporated into development processes, AI-generated code commonly suffers from defects such as lack of boundary checks and over-reliance on external data, making conventional code security detection methods often insufficiently adaptable. Traditional auditing methods rely on static lexical rules for matching and identification, which can only capture known vulnerabilities with clearly defined features, but struggles to identify risks hidden in semantic logic, easily generating a large number of false positives and false negatives.

[0003] Traditional tools only perform surface-level labeling, failing to combine abstract syntax trees for in-depth verification of data flow and control flow. This makes them unable to determine the reachability of vulnerabilities and results in the labeling of numerous code snippets that only pose theoretical risks, increasing the burden of manual review. Furthermore, single-rule matching techniques cannot understand the deep semantics of the code, making it difficult to identify hidden defects that differ from standard vulnerability patterns but share the same underlying risk.

[0004] When merging patches into a code repository, existing auditing methods can only simply compare the presence or absence of vulnerabilities. They lack a unified quantitative evaluation method, making it impossible to objectively measure the degree of optimization of security risks by patches, distinguish between patched vulnerabilities and newly added risks, and intuitively evaluate the patch's remediation effectiveness, resulting in insufficient precision in code security management.

[0005] Therefore, it is necessary to provide a method and system for security auditing AI-generated code based on rule and semantic fusion to solve the above-mentioned technical problems. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a method and system for security auditing AI-generated code based on rule and semantic fusion. This method solves the problems of traditional code auditing methods that rely solely on rule matching, are prone to missing hidden semantic vulnerabilities in AI code, have a large number of false positives, and cannot quantitatively evaluate the security remediation effect of code patches.

[0007] The present invention provides a security auditing method for AI-generated code based on rule and semantic fusion, the method comprising: Receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites; The candidate context code fragments of the candidate vulnerability sites are located and extracted, and the abstract syntax tree fragments are generated by parsing. After the structure of the data flow and control flow is verified, the valid vulnerability sites are output. Semantic features are extracted and vectorized into the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors. The code semantic embedding vectors are then matched with a preset vulnerability pattern template library for semantic similarity to filter out semantically high-risk sites. Construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report.

[0008] Preferably, the step of receiving the AI-generated code file to be audited, calling a preset rule matching engine to perform rule scanning on the AI-generated code file, identifying code segments that match known vulnerability patterns, and outputting candidate vulnerability sites includes: The system receives the AI-generated code file to be audited and calls the preset rule matching engine to perform rule scanning on the AI-generated code file, including: performing line-by-line lexical parsing on the AI-generated code file, and performing word-by-word segmentation on the AI-generated code file according to the target programming language specification to generate a code tag sequence arranged in the logical order of code execution, and at the same time associating each code tag with the corresponding code line number information and the scope information to which it belongs; Load a preset security audit rule set, wherein the preset security audit rule set includes general security vulnerability rules and AI-generated code defect rules; the general security vulnerability rules include injection vulnerability rules, insecure deserialization vulnerability rules, hard-coded sensitive credential vulnerability rules, and insecure encryption algorithm usage vulnerability rules; the AI-generated code defect rules include incomplete input boundary verification defect rules and excessive trust in external interface return values ​​defect rules. The code marker sequence is matched with each rule in the preset security audit rule set using lexical pattern matching. After traversing all rules, all matching code segments are marked, and the start and end positions of each code segment are recorded. Each code segment is assigned a unique identifier, vulnerability type label, and confidence score corresponding to the rule, and sorted according to the order of code location to output the candidate vulnerability sites.

[0009] Preferably, the step of locating and extracting candidate context code fragments of the candidate vulnerability sites and parsing them to generate abstract syntax tree fragments, and outputting valid vulnerability sites after data flow and control flow structure verification, includes: Based on the code positions recorded in the candidate vulnerability sites, locate the function scope and code block boundary of each candidate vulnerability site, and extract the candidate context code fragment of the preset candidate context range of the candidate vulnerability site; The candidate context code fragments are parsed to construct the corresponding abstract syntax tree fragments, and each syntax node in the abstract syntax tree fragment is attached with node type attribute, scope attribute and data flow attribute; Performing data flow tracing and control flow analysis on the abstract syntax tree fragment includes: for the abstract syntax tree fragment, identifying the data flow tracing path from the external input source to the convergence point of the dangerous operation, verifying the actual reachability of the data flow tracing path in the control flow analysis logic, eliminating theoretical vulnerabilities that cannot be triggered by the data flow tracing path, outputting the effective vulnerability sites, and attaching corresponding data flow tracing descriptions and control flow analysis descriptions to the effective vulnerability sites.

[0010] Preferably, the step of extracting semantic features and vectorizing the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors, and then performing semantic similarity matching between the code semantic embedding vectors and a preset vulnerability pattern template library to filter out semantically high-risk sites, includes: Extract the valid context code fragment within a preset valid context range from the valid vulnerability sites; The pre-trained code embedding model trained with security semantic adaptation is invoked to extract semantic features and vectorize the effective context code fragments, and the code text and structural information in the effective context code fragments are mapped to a high-dimensional feature space to generate the code semantic embedding vectors. The semantic similarity of the code semantic embedding vector with each standard vulnerability pattern template vector in the preset vulnerability pattern template library is calculated, and the code semantic embedding vector is sorted from high to low according to the semantic similarity. Obtain a preset semantic similarity threshold, and mark the effective vulnerability sites corresponding to the effective context code segments of the code semantic embedding vectors whose semantic similarity is higher than the preset semantic similarity threshold as the semantic high-risk sites.

[0011] Preferably, the step of constructing semantic review prompts corresponding to the semantically high-risk sites and submitting them to a large language model for semantic review, generating an AI-generated code security audit report, includes: The rule matching information, abstract syntax tree analysis conclusions, similar vulnerability template information, and code call context information corresponding to the semantically high-risk sites are summarized and organized in a structured manner according to a preset prompt format to construct the corresponding semantic review prompts; The semantic verification prompt is submitted to the large language model, which guides the large language model to analyze the security of the semantically high-risk site based on the code call context information and outputs the semantic verification judgment result. The semantic review judgment result is structured and parsed to extract the standard vulnerability classification number, vulnerability severity level, vulnerability cause analysis and explanation and code repair suggestion information from the semantic review judgment result and convert them into vulnerability data entries to generate the AI-generated code security audit report.

[0012] Preferably, the method further includes: In response to a code merge request event from the code repository, extract the AI-generated code files from the versions before and after the patch operation, identify the changed code segments, and output the code from the versions before and after the patch operation corresponding to the code segments. Based on the Shapley value method, security audits were performed on the code versions before and after the patch operation, and security risk scores were calculated. By comparing the security risk scores of the code versions before and after the patching operation, vulnerabilities eliminated and vulnerabilities added by the patch are identified. Based on the risk entropy measurement method, the patch coverage and patch performance index are calculated, and a patch risk comparison audit report is output.

[0013] Preferably, the step of performing security audits on the code versions before and after the patch operation based on the Shapley value method and calculating security risk scores includes: Based on the Shapley value method, and introducing a coupling effect adjustment coefficient, the joint risk value v(S) of any set of vulnerabilities S in the code version before the patch operation is calculated as follows: ; In the formula, Let S be the severity weight of the i-th vulnerability in any vulnerability set S. Let be the semantic risk confidence of the i-th vulnerability in any set of vulnerabilities. This is the coupling effect adjustment coefficient, used to characterize the risk amplification effect between vulnerabilities; Based on cooperative game theory, the Shapley risk contribution value for each vulnerability is calculated as follows: ; In the formula, Let N be the Shapley risk contribution value for the i-th vulnerability, and N be the set of all vulnerabilities. This indicates that any vulnerability set S belongs to the vulnerability set N after removing vulnerability i, where n is the total number of vulnerabilities in the vulnerability set N. Let S be the factorial operation of the number of vulnerabilities |S| in any set of vulnerabilities S. Number of vulnerabilities factorial operation, This is the factorial operation of the total number of vulnerabilities n in the entire vulnerability set N. The joint risk value is the sum of any set of vulnerabilities S and the new set consisting of the i-th vulnerability. The security risk score of the code version before the patch operation is obtained by summing the Shapley risk contribution values ​​of all vulnerabilities in the entire vulnerability set. for: ; Security risk assessment of the version code after the patch operation The calculation method is the same as above.

[0014] Preferably, the calculation of patch repair coverage and patch repair efficiency index based on the risk entropy measurement method includes: Extract the Shapley risk contribution value and security risk score of all vulnerabilities in the code version before the patch operation, and calculate the version risk entropy of the code version before the patch operation. for: ; In the formula, This represents the percentage of risk contribution of the i-th vulnerability in the code version prior to the patch operation. ; The version risk entropy of the code after the patch operation The calculation method is the same as above; Calculate the increment of safety risk change respectively Version risk entropy change increment for: ; Identify the number of vulnerabilities removed by patches during patch operations. Number of vulnerabilities added in patches Calculate the patch repair coverage. The patch repair performance index E is: .

[0015] A security audit system for AI-generated code based on rule and semantic fusion, the system comprising: The candidate vulnerability identification module is used to receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites. The effective vulnerability output module is used to locate and extract candidate context code fragments of the candidate vulnerability sites and parse them to generate abstract syntax tree fragments. After the data flow and control flow structure is verified, the effective vulnerability sites are output. The semantic high-risk screening module is used to extract semantic features and vectorize the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors, and to perform semantic similarity matching between the code semantic embedding vectors and the preset vulnerability pattern template library to screen out semantic high-risk sites. The semantic review module is used to construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report.

[0016] Compared with related technologies, the AI-generated code security auditing method and system based on rule and semantic fusion provided by this invention has the following beneficial effects: This invention receives AI-generated code files to be audited, calls a preset rule matching engine to scan the AI-generated code files according to rules, identifies code segments that match known vulnerability patterns, and outputs candidate vulnerability sites; locates and extracts candidate context code fragments of the candidate vulnerability sites and parses them to generate abstract syntax tree fragments, outputting valid vulnerability sites after data flow and control flow structure verification; extracts semantic features and vectorizes the valid context code fragments of the valid vulnerability sites to generate code semantic embedding vectors, and performs semantic similarity matching between the code semantic embedding vectors and a preset vulnerability pattern template library to screen out semantically high-risk sites; constructs semantic review prompts corresponding to semantically high-risk sites and submits them to a large language model for semantic review, generating an AI-generated code security audit report, thereby accurately screening out false vulnerabilities and identifying hidden risks in AI code, evaluating the effectiveness of code patch repairs, reducing the workload of manual auditing, and improving the accuracy of AI code security auditing.

[0017] This invention first quickly identifies suspicious code locations based on security rules, then uses abstract syntax trees to analyze data flow and control flow to eliminate unreachable theoretical vulnerabilities and filter out false risks that exist only at the theoretical level but cannot be triggered in practice, effectively reducing mislabeled content and the workload of manual verification. This invention can extract deep semantic features from code and identify hidden semantic risks through template similarity matching, overcoming the incompleteness of simple text matching. It accurately captures logical defects in AI-generated code, and then performs semantic verification on high-risk code, automatically generating audit reports and reducing the difficulty of manual judgment. This invention can uniformly measure the security risk level of code, accurately distinguish between patch-eliminated risks and newly added hidden dangers, and quantify patch coverage and repair effectiveness. Therefore, it can simultaneously improve the risk scanning speed and risk identification accuracy of AI-generated code, adapt to various defect scenarios of AI-generated code, and comprehensively improve the comprehensiveness and ease of use of code security detection. Attached Figure Description

[0018] Figure 1A flowchart of a rule-based and semantic fusion-based AI-generated code security auditing method provided in an embodiment of the present invention; Figure 2 A system block diagram of an AI-generated code security auditing system based on rule and semantic fusion provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] like Figure 1 The diagram shown is a flowchart of the AI-generated code security auditing method based on rule and semantic fusion provided in an embodiment of the present invention. Figure 1 The execution subject of the method shown can be a software and / or hardware device. The execution subject of this invention can include, but is not limited to, at least one of the following: user equipment, network equipment, etc. User equipment can include, but is not limited to, computers, smartphones, personal digital assistants (PDAs), and the aforementioned electronic devices. Network equipment can include, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of computers or network servers. Cloud computing is a type of distributed computing, consisting of a super virtual computer composed of a group of loosely coupled computers. This embodiment does not limit this. Steps S1 to S4 are detailed as follows: S1, receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites.

[0021] The process involves receiving the AI-generated code file to be audited, calling a preset rule matching engine to perform rule scanning on the AI-generated code file, identifying code segments that match known vulnerability patterns, and outputting candidate vulnerability locations, including: The system receives the AI-generated code file to be audited and calls the preset rule matching engine to perform rule scanning on the AI-generated code file, including: performing line-by-line lexical parsing on the AI-generated code file, and performing word-by-word segmentation on the AI-generated code file according to the target programming language specification to generate a code tag sequence arranged in the logical order of code execution, and at the same time associating each code tag with the corresponding code line number information and the scope information to which it belongs; Load a preset security audit rule set, wherein the preset security audit rule set includes general security vulnerability rules and AI-generated code defect rules; the general security vulnerability rules include injection vulnerability rules, insecure deserialization vulnerability rules, hard-coded sensitive credential vulnerability rules, and insecure encryption algorithm usage vulnerability rules; the AI-generated code defect rules include incomplete input boundary verification defect rules and excessive trust in external interface return values ​​defect rules. The code marker sequence is matched with each rule in the preset security audit rule set using lexical pattern matching. After traversing all rules, all matching code segments are marked, and the start and end positions of each code segment are recorded. Each code segment is assigned a unique identifier, vulnerability type label, and confidence score corresponding to the rule, and sorted according to the order of code location to output the candidate vulnerability sites.

[0022] Upon receiving the AI-generated code file to be audited, the system's built-in preset rule matching engine is activated to scan the file for rules. This engine reads the AI-generated code file line by line, performs lexical analysis, and breaks the code into multiple independent code tags according to the syntax requirements of the programming language used in the AI-generated code file. Then, it arranges all the code tags into a code tag sequence according to the actual execution order of the program. Simultaneously, it assigns corresponding information to each separated code tag, including the line number of the code tag and the scope information such as the function or code block to which the code tag belongs.

[0023] Retrieve pre-configured security audit rule sets, including general security vulnerability rules, to find common risks in ordinary programs. These rules include four categories of matching rules: injection vulnerabilities, insecure deserialization, writing account passwords in plaintext, and faulty encryption algorithms. Customized defect rules for AI-generated code specifically identify two types of problems that AI-generated code is prone to: incomplete input validation and directly trusting data returned by external interfaces.

[0024] The separated code is marked with a sequence of tags and then compared lexically with each rule in the security audit rule set. After all rules are compared in a loop, all code segments that match the rule characteristics are marked. At the same time, the start and end positions of each suspicious code segment in the AI-generated code file are recorded to lock down the scope of risky code.

[0025] For each matched code segment, you can attach the rule number that triggered the match, the corresponding vulnerability category label, and the credibility score of this match result. All suspicious code segments are rearranged according to their order from top to bottom in the AI-generated code file, and after sorting, a structured list of candidate vulnerability sites is output.

[0026] S2, locate and extract candidate context code fragments of the candidate vulnerability sites and parse them to generate abstract syntax tree fragments. After structural verification of data flow and control flow, output the valid vulnerability sites.

[0027] The process involves locating and extracting candidate context code fragments of the candidate vulnerability sites, parsing them to generate abstract syntax tree fragments, and outputting valid vulnerability sites after data flow and control flow structure verification, including: Based on the code positions recorded in the candidate vulnerability sites, locate the function scope and code block boundary of each candidate vulnerability site, and extract the candidate context code fragment of the preset candidate context range of the candidate vulnerability site; The candidate context code fragments are parsed to construct the corresponding abstract syntax tree fragments, and each syntax node in the abstract syntax tree fragment is attached with node type attribute, scope attribute and data flow attribute; Performing data flow tracing and control flow analysis on the abstract syntax tree fragment includes: for the abstract syntax tree fragment, identifying the data flow tracing path from the external input source to the convergence point of the dangerous operation, verifying the actual reachability of the data flow tracing path in the control flow analysis logic, eliminating theoretical vulnerabilities that cannot be triggered by the data flow tracing path, outputting the effective vulnerability sites, and attaching corresponding data flow tracing descriptions and control flow analysis descriptions to the effective vulnerability sites.

[0028] Read the code location information stored in the candidate vulnerability site, accurately locate the function scope and code block boundary to which the candidate vulnerability site belongs, and extract the candidate context code fragment containing the candidate vulnerability site and its surrounding code according to the pre-set context value range.

[0029] Construct an abstract syntax tree fragment with attribute annotations. Each syntax node representing a code element in the tree will be bound to three types of attribute information: the node type attribute corresponding to the node itself, the scope attribute of the program to which the node belongs, and the data flow attribute of the node participating in the data transmission logic.

[0030] For the annotated abstract syntax tree fragments, data flow tracing and control flow analysis are performed to filter theoretical vulnerabilities and output valid vulnerability sites. Data flow tracing traces the data flow path from external input data to high-risk operation code; control flow analysis determines whether this data transmission path can actually be reached in the program's actual execution logic, thus directly eliminating false vulnerabilities that are theoretically impossible to execute, leaving the points that can actually trigger risks as valid vulnerability sites. Each valid vulnerability site is accompanied by corresponding textual descriptions, including data flow tracing descriptions and control flow analysis descriptions.

[0031] By using the above methods, we can overcome the problem of existing technologies that simply match rules by looking at the code text without considering the program's execution logic. This can filter out a large number of false alarms that do not pose a real threat, simplify the processing objects for subsequent semantic analysis, and improve the accuracy and efficiency of code security auditing.

[0032] S3, extract semantic features and vectorize the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors, and perform semantic similarity matching between the code semantic embedding vectors and the preset vulnerability pattern template library to filter out semantically high-risk sites.

[0033] The process involves extracting semantic features and vectorizing the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors. These vectors are then semantically similar to a preset vulnerability pattern template library to filter out semantically high-risk sites, including: Extract the valid context code fragment within a preset valid context range from the valid vulnerability sites; The pre-trained code embedding model trained with security semantic adaptation is invoked to extract semantic features and vectorize the effective context code fragments, and the code text and structural information in the effective context code fragments are mapped to a high-dimensional feature space to generate the code semantic embedding vectors. The semantic similarity of the code semantic embedding vector with each standard vulnerability pattern template vector in the preset vulnerability pattern template library is calculated, and the code semantic embedding vector is sorted from high to low according to the semantic similarity. Obtain a preset semantic similarity threshold, and mark the effective vulnerability sites corresponding to the effective context code segments of the code semantic embedding vectors whose semantic similarity is higher than the preset semantic similarity threshold as the semantic high-risk sites.

[0034] Read the valid vulnerability sites after data flow and control flow verification, and extract the valid context code fragment containing the vulnerability sites and their surrounding logic code based on the pre-defined valid context value range.

[0035] A pre-trained code embedding model, specifically trained on security semantics, is launched. The extracted, valid context code snippets are input into this model, which simultaneously extracts two types of semantic features: the textual content of the code and the program structure information, and performs vectorized encoding. This model can uniformly map all logical information contained in the code to a high-dimensional feature space, transforming it into standardized, quantifiable, and computationally calculable code semantic embedding vectors, thus converting abstract code meaning into real vectors that can be compared and computed.

[0036] The semantic embedding vectors generated from the current code are used to perform semantic similarity calculations against all standard vulnerability template vectors in the preset vulnerability pattern template library, one by one, to obtain the semantic similarity between the two code segments. After all comparisons are completed, the semantic embedding vectors corresponding to the effective vulnerability sites are arranged in descending order of semantic similarity scores to intuitively distinguish the degree of fit between the code logic and the standard vulnerability templates.

[0037] A pre-set semantic similarity threshold is used as the criterion to compare the semantic similarity values ​​of each code semantic embedding vector. If the semantic similarity value of a valid vulnerability site is higher than the threshold, it means that the underlying logic of this code is highly similar to known high-risk vulnerabilities, and the valid vulnerability site is marked as a semantically high-risk site.

[0038] By using the above methods, we can capture hidden vulnerabilities that have different wording but the same underlying risk, accurately screen out points where there are hidden dangers in the deep logic, and improve the accuracy and comprehensiveness of risk identification in code security audits.

[0039] S4. Construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report.

[0040] The process of constructing semantic review prompts corresponding to the high-risk semantic sites and submitting them to a large language model for semantic review, generating an AI-generated code security audit report, includes: The rule matching information, abstract syntax tree analysis conclusions, similar vulnerability template information, and code call context information corresponding to the semantically high-risk sites are summarized and organized in a structured manner according to a preset prompt format to construct the corresponding semantic review prompts; The semantic verification prompt is submitted to the large language model, which guides the large language model to analyze the security of the semantically high-risk site based on the code call context information and outputs the semantic verification judgment result. The semantic review judgment result is structured and parsed to extract the standard vulnerability classification number, vulnerability severity level, vulnerability cause analysis and explanation and code repair suggestion information from the semantic review judgment result and convert them into vulnerability data entries to generate the AI-generated code security audit report.

[0041] All data associated with each semantically high-risk site is uniformly summarized, including rule matching information generated from the first round of rule scanning, analysis conclusions derived from data flow and control flow verification by the abstract syntax tree, similar vulnerability template information obtained by comparing vulnerability templates during the semantic matching phase, and code call context information during code execution. Following a pre-defined standard prompt format, the above multiple types of information are organized into clearly structured content, generating semantic review prompts that can be read and analyzed by the large language model.

[0042] The semantic verification prompts are submitted to the large language model. Based on the code call context information attached to the semantic verification prompts, the large language model is guided to determine the real security risk of each semantically high-risk point and output the semantic verification judgment result. With the powerful code understanding capabilities of the large language model, false risks and real high-risk vulnerabilities can be accurately distinguished.

[0043] The system reads the semantic verification results from the large language model, performs structured decomposition and extraction of the text content, and separates standard vulnerability classification numbers, vulnerability severity levels, vulnerability cause analysis, and code remediation suggestions. These are then uniformly packaged into standardized vulnerability data entries. After integrating all vulnerability data entries, an AI-generated code security audit report is automatically compiled, which can significantly reduce the workload of manually compiling and judging vulnerabilities.

[0044] The method further includes: In response to a code merge request event from the code repository, extract the AI-generated code files from the versions before and after the patch operation, identify the changed code segments, and output the code from the versions before and after the patch operation corresponding to the code segments. Based on the Shapley value method, security audits were performed on the code versions before and after the patch operation, and security risk scores were calculated. By comparing the security risk scores of the code versions before and after the patching operation, vulnerabilities eliminated and vulnerabilities added by the patch are identified. Based on the risk entropy measurement method, the patch coverage and patch performance index are calculated, and a patch risk comparison audit report is output.

[0045] The Shapley value method is used to perform security audits on the code versions before and after the patch operation, and calculate security risk scores, including: Based on the Shapley value method, and introducing a coupling effect adjustment coefficient, the joint risk value v(S) of any set of vulnerabilities S in the code version before the patch operation is calculated as follows: ; In the formula, Let S be the severity weight of the i-th vulnerability in any vulnerability set S. Let be the semantic risk confidence of the i-th vulnerability in any set of vulnerabilities. This is the coupling effect adjustment coefficient, used to characterize the risk amplification effect between vulnerabilities; Based on cooperative game theory, the Shapley risk contribution value for each vulnerability is calculated as follows: ; In the formula, Let N be the Shapley risk contribution value for the i-th vulnerability, and N be the set of all vulnerabilities. This indicates that any vulnerability set S belongs to the vulnerability set N after removing vulnerability i, where n is the total number of vulnerabilities in the vulnerability set N. Let S be the factorial operation of the number of vulnerabilities |S| in any set of vulnerabilities S. Number of vulnerabilities factorial operation, This is the factorial operation of the total number of vulnerabilities n in the entire vulnerability set N. The joint risk value is the sum of any set of vulnerabilities S and the new set consisting of the i-th vulnerability. The security risk score of the code version before the patch operation is obtained by summing the Shapley risk contribution values ​​of all vulnerabilities in the entire vulnerability set. for: ; Security risk assessment of the version code after the patch operation The calculation method is the same as above.

[0046] The patch repair coverage and patch repair performance index calculated based on the risk entropy measurement method include: Extract the Shapley risk contribution value and security risk score of all vulnerabilities in the code version before the patch operation, and calculate the version risk entropy of the code version before the patch operation. for: ; In the formula, This represents the percentage of risk contribution of the i-th vulnerability in the code version prior to the patch operation. ; The version risk entropy of the code after the patch operation The calculation method is the same as above; Calculate the increment of safety risk change respectively Version risk entropy change increment for: ; Identify the number of vulnerabilities removed by patches during patch operations. Number of vulnerabilities added in patches Calculate the patch repair coverage. The patch repair performance index E is: .

[0047] The system monitors code merge request events pushed by the code repository in real time. Once the event is captured, it automatically pulls the AI-generated code files before and after the patch modification operation. It compares the contents of the two files segment by segment to accurately locate the modified code segment. It extracts the text before and after the modification of the code segment, thereby isolating the scope of the change, avoiding duplicate code audits, and performing comparative analysis only on the changed content, thus improving the efficiency of version comparison.

[0048] Based on the Shapley score method, a coupling effect adjustment coefficient is introduced to calculate the joint risk value of any set of vulnerabilities. The calculation considers both the independent risk of a single vulnerability and the coupled risk of multiple vulnerabilities amplifying each other when they coexist, quantifying the risk amplification effect of multiple vulnerabilities stacked together. Based on cooperative game theory, the Shapley risk contribution value corresponding to each independent vulnerability is calculated to measure the individual contribution of a single vulnerability to the overall code risk. The security risk score for the current code version is obtained by summing the risk contribution values ​​of all vulnerabilities. The calculation method for the security risk score of the code version after patching is the same as that of the code version before patching.

[0049] Based on the risk entropy measurement method, the risk contribution value and total risk score of all vulnerabilities in the pre-patch version are first extracted to calculate the risk contribution ratio of each individual vulnerability. The version risk entropy is then calculated based on this ratio. The same calculation logic is used to obtain the corresponding risk entropy for the post-patch version. The difference between the risk scores and risk entropies of the pre- and post-patch versions is calculated to obtain the risk change increment and entropy change increment. Then, the vulnerabilities eliminated by this patch and the newly generated vulnerabilities are statistically analyzed to calculate the patch coverage rate and patch remediation effectiveness index. The patch coverage rate reflects the effectiveness of the modification in eliminating existing vulnerabilities while deducting the negative impact of newly added vulnerabilities. The remediation effectiveness index combines the risk reduction rate and risk entropy fluctuations to comprehensively evaluate the security optimization value of the patch operation.

[0050] The above methods can transform the security improvement effect of code patches into quantifiable metrics, which can distinguish between patched and newly added vulnerabilities and effectively measure the actual security benefits of patching operations.

[0051] like Figure 2 The diagram shown is a system block diagram of an AI-generated code security auditing system based on rule and semantic fusion provided in an embodiment of the present invention. The system includes: The candidate vulnerability identification module is used to receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites. The effective vulnerability output module is used to locate and extract candidate context code fragments of the candidate vulnerability sites and parse them to generate abstract syntax tree fragments. After the data flow and control flow structure is verified, the effective vulnerability sites are output. The semantic high-risk screening module is used to extract semantic features and vectorize the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors, and to perform semantic similarity matching between the code semantic embedding vectors and the preset vulnerability pattern template library to screen out semantic high-risk sites. The semantic review module is used to construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report.

[0052] Figure 2 The apparatus of the illustrated embodiment can be used to perform corresponding actions. Figure 1 The steps in the method embodiments shown are implemented in a similar manner and have similar technical effects, and will not be repeated here.

[0053] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor performs the steps of the rule-based and semantic fusion-based AI-generated code security auditing method as described in any of the above.

[0054] like Figure 3 The diagram shown is a hardware structure schematic of an electronic device according to an embodiment of the present invention. The electronic device 30 includes: a processor 31, a memory 32, and a computer program; wherein... The memory 32 is used to store the computer program, and the memory may also be flash memory. The computer program is, for example, an application program or functional module that implements the above method.

[0055] Processor 31 is configured to execute the computer program stored in the memory to implement the various steps performed by the device in the above method. For details, please refer to the relevant descriptions in the preceding method embodiments.

[0056] Alternatively, the memory 32 can be either standalone or integrated with the processor 31.

[0057] When the memory 32 is a device independent of the processor 31, the device may further include: Bus 33 is used to connect the memory 32 and the processor 31.

[0058] A readable storage medium storing a computer program, which, when executed by a processor, is used to implement the steps of the rule-based and semantic fusion-based AI-generated code security auditing method as described in any of the above claims.

[0059] The readable storage medium can be a computer storage medium or a communication medium. A communication medium includes any medium that facilitates the transfer of computer programs from one location to another. A computer storage medium can be any available medium accessible to a general-purpose or special-purpose computer. For example, a readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application-Specific Integrated Circuit (ASIC). Alternatively, the ASIC can be located in a user equipment. Of course, the processor and the readable storage medium can also exist as discrete components in a communication device. The readable storage medium can be a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0060] The present invention also provides a program product including executable instructions stored in a readable storage medium. At least one processor of the device can read the executable instructions from the readable storage medium, and the at least one processor executes the executable instructions to cause the device to implement the methods provided in the various embodiments described above.

[0061] In the embodiments of the above-described device, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security auditing method for AI-generated code based on rule and semantic fusion, characterized in that, The method includes: Receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites; The candidate context code fragments of the candidate vulnerability sites are located and extracted, and the abstract syntax tree fragments are generated by parsing. After the structure of the data flow and control flow is verified, the valid vulnerability sites are output. Semantic features are extracted and vectorized into the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors. The code semantic embedding vectors are then matched with a preset vulnerability pattern template library for semantic similarity to filter out semantically high-risk sites. Construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report; The process of constructing semantic review prompts corresponding to the high-risk semantic sites and submitting them to a large language model for semantic review, generating an AI-generated code security audit report, includes: The rule matching information, abstract syntax tree analysis conclusions, similar vulnerability template information, and code call context information corresponding to the semantically high-risk sites are summarized and organized in a structured manner according to a preset prompt format to construct the corresponding semantic review prompts; The semantic verification prompt is submitted to the large language model, which guides the large language model to analyze the security of the semantically high-risk site based on the code call context information and outputs the semantic verification judgment result. The semantic review judgment result is structured and parsed to extract the standard vulnerability classification number, vulnerability severity level, vulnerability cause analysis and explanation and code repair suggestion information from the semantic review judgment result and convert them into vulnerability data entries to generate the AI-generated code security audit report; In response to a code merge request event from the code repository, extract the AI-generated code files from the versions before and after the patch operation, identify the changed code segments, and output the code from the versions before and after the patch operation corresponding to the code segments. Based on the Shapley value method, security audits were performed on the code versions before and after the patch operation, and security risk scores were calculated. By comparing the security risk scores of the code versions before and after the patching operation, vulnerabilities eliminated and vulnerabilities added by the patch are identified. Based on the risk entropy measurement method, the patch coverage and patch performance index are calculated, and a patch risk comparison audit report is output.

2. The AI-generated code security auditing method based on rule and semantic fusion according to claim 1, characterized in that, The process involves receiving the AI-generated code file to be audited, calling a preset rule matching engine to perform rule scanning on the AI-generated code file, identifying code segments that match known vulnerability patterns, and outputting candidate vulnerability locations, including: The system receives the AI-generated code file to be audited and calls the preset rule matching engine to perform rule scanning on the AI-generated code file, including: performing line-by-line lexical parsing on the AI-generated code file, and performing word-by-word segmentation on the AI-generated code file according to the target programming language specification to generate a code tag sequence arranged in the logical order of code execution, and at the same time associating each code tag with the corresponding code line number information and the scope information to which it belongs; Load a preset security audit rule set, wherein the preset security audit rule set includes general security vulnerability rules and AI-generated code defect rules; the general security vulnerability rules include injection vulnerability rules, insecure deserialization vulnerability rules, hard-coded sensitive credential vulnerability rules, and insecure encryption algorithm usage vulnerability rules; the AI-generated code defect rules include incomplete input boundary verification defect rules and excessive trust in external interface return values ​​defect rules. The code marker sequence is matched with each rule in the preset security audit rule set using lexical pattern matching. After traversing all rules, all matching code segments are marked, and the start and end positions of each code segment are recorded. Each code segment is assigned a unique identifier, vulnerability type label, and confidence score corresponding to the rule, and sorted according to the order of code location to output the candidate vulnerability sites.

3. The AI-generated code security auditing method based on rule and semantic fusion according to claim 1, characterized in that, The process involves locating and extracting candidate context code fragments of the candidate vulnerability sites, parsing them to generate abstract syntax tree fragments, and outputting valid vulnerability sites after data flow and control flow structure verification, including: Based on the code positions recorded in the candidate vulnerability sites, locate the function scope and code block boundary of each candidate vulnerability site, and extract the candidate context code fragment of the preset candidate context range of the candidate vulnerability site; The candidate context code fragments are parsed to construct the corresponding abstract syntax tree fragments, and each syntax node in the abstract syntax tree fragment is attached with node type attribute, scope attribute and data flow attribute; Performing data flow tracing and control flow analysis on the abstract syntax tree fragment includes: for the abstract syntax tree fragment, identifying the data flow tracing path from the external input source to the convergence point of the dangerous operation, verifying the actual reachability of the data flow tracing path in the control flow analysis logic, eliminating theoretical vulnerabilities that cannot be triggered by the data flow tracing path, outputting the effective vulnerability sites, and attaching corresponding data flow tracing descriptions and control flow analysis descriptions to the effective vulnerability sites.

4. The AI-generated code security auditing method based on rule and semantic fusion according to claim 1, characterized in that, The process involves extracting semantic features and vectorizing the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors. These vectors are then semantically similar to a preset vulnerability pattern template library to filter out semantically high-risk sites, including: Extract the valid context code fragment within a preset valid context range from the valid vulnerability sites; The pre-trained code embedding model trained with security semantic adaptation is invoked to extract semantic features and vectorize the effective context code fragments, and the code text and structural information in the effective context code fragments are mapped to a high-dimensional feature space to generate the code semantic embedding vectors. The semantic similarity of the code semantic embedding vector with each standard vulnerability pattern template vector in the preset vulnerability pattern template library is calculated, and the code semantic embedding vector is sorted from high to low according to the semantic similarity. Obtain a preset semantic similarity threshold, and mark the effective vulnerability sites corresponding to the effective context code segments of the code semantic embedding vectors whose semantic similarity is higher than the preset semantic similarity threshold as the semantic high-risk sites.

5. The AI-generated code security auditing method based on rule and semantic fusion according to claim 1, characterized in that, The Shapley value method is used to perform security audits on the code versions before and after the patch operation, and calculate security risk scores, including: Based on the Shapley value method, and introducing a coupling effect adjustment coefficient, the joint risk value v(S) of any set of vulnerabilities S in the code version before the patch operation is calculated as follows: ； In the formula, Let S be the severity weight of the i-th vulnerability in any vulnerability set S. Let be the semantic risk confidence of the i-th vulnerability in any set of vulnerabilities. This is the coupling effect adjustment coefficient, used to characterize the risk amplification effect between vulnerabilities; Based on cooperative game theory, the Shapley risk contribution value for each vulnerability is calculated as follows: ； In the formula, Let N be the Shapley risk contribution value for the i-th vulnerability, and N be the set of all vulnerabilities. This indicates that any vulnerability set S belongs to the vulnerability set N after removing vulnerability i, where n is the total number of vulnerabilities in the vulnerability set N. Let S be the factorial operation of the number of vulnerabilities |S| in any set of vulnerabilities S. Number of vulnerabilities factorial operation, This is the factorial operation of the total number of vulnerabilities n in the entire vulnerability set N. The joint risk value is the sum of any set of vulnerabilities S and the new set consisting of the i-th vulnerability. The security risk score of the code version before the patch operation is obtained by summing the Shapley risk contribution values ​​of all vulnerabilities in the entire vulnerability set. for: ； Security risk assessment of the version code after the patch operation The calculation method is the same as above.

6. The AI-generated code security auditing method based on rule and semantic fusion according to claim 5, characterized in that, The patch repair coverage and patch repair performance index calculated based on the risk entropy measurement method include: Extract the Shapley risk contribution value and security risk score of all vulnerabilities in the code version before the patch operation, and calculate the version risk entropy of the code version before the patch operation. for: ； In the formula, This represents the percentage of risk contribution of the i-th vulnerability in the code version prior to the patch operation. ; The version risk entropy of the code after the patch operation The calculation method is the same as above; Calculate the increment of safety risk change respectively Version risk entropy change increment for: ； Identify the number of vulnerabilities removed by patches during patch operations. Number of vulnerabilities added in patches Calculate the patch repair coverage. The patch repair performance index E is: 。 7. A security audit system for AI-generated code based on rule and semantic fusion, characterized in that, The system, applied to the AI-generated code security auditing method based on rule and semantic fusion as described in any one of claims 1-6, comprises: The candidate vulnerability identification module is used to receive the AI-generated code file to be audited, call the preset rule matching engine to perform rule scanning on the AI-generated code file, identify code segments that match known vulnerability patterns, and output candidate vulnerability sites. The effective vulnerability output module is used to locate and extract candidate context code fragments of the candidate vulnerability sites and parse them to generate abstract syntax tree fragments. After the data flow and control flow structure is verified, the effective vulnerability sites are output. The semantic high-risk screening module is used to extract semantic features and vectorize the effective context code fragments of the effective vulnerability sites to generate code semantic embedding vectors, and to perform semantic similarity matching between the code semantic embedding vectors and the preset vulnerability pattern template library to screen out semantic high-risk sites. The semantic review module is used to construct semantic review prompts corresponding to the high-risk semantic sites and submit them to the large language model for semantic review, generating an AI-generated code security audit report.

Images