A large model automatic vulnerability patch code generation method, system, device and storage medium

Abstract

The application discloses a large model automatic vulnerability patch code generation method, system, device and storage medium, comprising: preprocessing input vulnerability code, constructing a vulnerability probability graph model based on the preprocessed vulnerability code, fusing an abstract syntax tree and a data flow graph; inputting the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and corresponding generation probabilities; for each candidate patch code, a corresponding patch probability graph model is constructed, and the graph matching probability of the patch probability graph model and the vulnerability probability graph model is calculated, and the target patch code is selected from the multiple candidate patch codes according to the graph matching probability; verifying the target patch code, optimizing the patch that passes the verification, and generating the final patch code; the final patch code and the corresponding vulnerability code form a new training sample, which is fed back to the code large language model to update the model parameters, forming a closed-loop optimization mechanism. Automatic patch code generation can be realized.

Description

Technical Field

[0001] This invention relates to the technical field of software vulnerability repair, and in particular to a method, system, device, and storage medium for generating automated vulnerability patch code for large models. Background Technology

[0002] Software vulnerabilities refer to defects or weaknesses in software systems. These vulnerabilities can be maliciously exploited, leading to serious consequences such as data breaches, system crashes, and service interruptions, causing significant economic losses and security risks to individuals, businesses, and nations. Traditional software vulnerability remediation relies primarily on manual methods. Developers need to spend considerable time analyzing vulnerable code, understanding the causes of the vulnerability, and then manually writing patches to fix it. This method is not only inefficient but also easily affected by factors such as the developer's experience and skill level, resulting in inconsistent patch quality. In actual development, a complex software vulnerability may take weeks or even months to fix, during which time the software system remains vulnerable to attack. Furthermore, with the rapid pace of software system updates and the constant emergence of new vulnerabilities, manual vulnerability remediation is no longer sufficient to meet the demands of rapid response.

[0003] In recent years, artificial intelligence technology has developed rapidly, with large-scale modeling demonstrating powerful capabilities in fields such as natural language processing and image recognition. By learning from massive amounts of data, large-scale models can automatically capture patterns and rules within the data, generating high-quality content. In the software field, large-scale models are increasingly being applied to tasks such as code generation, code completion, and code translation, bringing new ideas and methods to software development. However, directly applying large-scale models to patch code generation tasks faces some challenges. The patch code generated by large-scale models may have mismatches in structure and semantics with the vulnerable code, resulting in the generated patch code failing to effectively fix the vulnerability and potentially even introducing new problems. Summary of the Invention

[0004] In view of the aforementioned existing problems, this invention is proposed. Therefore, this invention provides a method, system, device, and storage medium for automatically generating vulnerability patch code for large models, solving the problem of mismatch between the generated patch code and the structure and semantics of the vulnerability code.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a method for generating automated vulnerability patch code for large models, comprising: preprocessing the input vulnerability code, and constructing a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerability code; The vulnerability code is input into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities. For each candidate patch code, a corresponding patch probability graph model is constructed, and the graph matching probability between the patch probability graph model and the vulnerability probability graph model is calculated. The target patch code is then selected from the multiple candidate patch codes based on the graph matching probability. The target patch code is verified, and the verified patches are optimized to generate the final patch code; The final patch code and the corresponding vulnerability code are combined to form a new training sample, which is then fed back to the code-large language model to update the model parameters, forming a closed-loop optimization mechanism.

[0006] As a preferred embodiment of the large-scale automated vulnerability patch code generation method of the present invention, wherein: comments and redundant whitespace characters are removed from the vulnerability code, and the construction of a vulnerability probability graph model integrating an abstract syntax tree and a data flow graph based on the preprocessed vulnerability code includes: A control flow graph is constructed based on the abstract syntax tree. The function body is split into basic blocks and control flow edges are established. The reachable sets of variable definitions at the entry and exit points of each basic block are calculated on the control flow graph. The control flow graph is converted to a static single-assignment form. Functions are inserted at the merging points and variables are renamed. All variable usage points are scanned, and each variable is uniquely bound to its corresponding definition point according to its static single-assignment version, generating weighted data flow edges. Inter-process pointer analysis is performed to construct a call graph, and parameters, return values, and heap objects are abstracted into cross-function data flow edges. All generated data flow edges are serialized into an adjacency list format to form the data flow graph.

[0007] As a preferred embodiment of the large-model automated vulnerability patch code generation method described in this invention, it further includes: The nodes in the abstract syntax tree and data flow graph are aligned with a unified node identifier ID and fused to obtain a probabilistic graphical model representing the structure and semantic features of the vulnerability code. The node set of the probabilistic graphical model includes grammatical structure nodes from the abstract syntax tree and data dependency nodes from the data flow graph. The edge set includes control flow, grammatical parent-child relationships, and data flow relationships, and each edge is assigned a joint probability weight. The vulnerability probability graph is modeled, where each node corresponds to a univariate potential function and each edge corresponds to a binary potential function; for any candidate patch code, the similarity score between its vulnerability probability graph model and the known vulnerability probability graph model is calculated, and the similarity score is used as the matching basis.

[0008] As a preferred embodiment of the large-model automated vulnerability patch code generation method of the present invention, the method involves inputting the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities, including: Insert a low-rank matrix into the weight matrix of the code-large language model, freeze the original model parameters, and train only the low-rank matrix; The preprocessed vulnerability code is used as input to the code big language model to generate multiple candidate patch codes. During the generation process, the generation probability of each candidate patch code is calculated. The generation probability is the joint probability of the model outputting the patch code under the given vulnerability code conditions. The pre-training data consists of a vulnerability function and a corresponding manually labeled patch function, and is trained by an optimizer that combines cosine learning rate decay, gradient pruning, and early stopping mechanisms.

[0009] In a preferred embodiment of the large-model automated vulnerability patch code generation method described in this invention, the pre-training data is composed of vulnerability functions and corresponding manually annotated patch functions. The concatenation format is: classification marker, vulnerability function code, separator marker, manually annotated patch function code, and sequence end marker.

[0010] As a preferred embodiment of the large-model automated vulnerability patch code generation method of the present invention, the method includes: verifying the target patch code and optimizing the verified patch to generate the final patch code. If the target patch code passes verification, it will be used as the final output. If the target patch code fails verification, the next candidate patch code will be selected from the remaining candidate patch codes in order of matching probability for verification, until a patch code that passes verification is found or all candidate patch codes are exhausted.

[0011] As a preferred embodiment of the large-model automated vulnerability patch code generation method of the present invention, the step of verifying the target patch code includes: Compile the target patch code into an executable program; The executable program is dynamically tested using a pre-defined set of test cases to check for crashes or abnormal exits. The target patch code was scanned using static analysis tools to check for any new security flaws.

[0012] Secondly, this invention provides a large-scale automated vulnerability patch code generation system, comprising: The vulnerability code analysis module is used to preprocess the input vulnerability code and construct a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerability code. The large model generation module is used to input the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities. The probabilistic graph matching and filtering module is used to construct a corresponding patch probabilistic graph model for each candidate patch code, calculate the graph matching probability between the patch probabilistic graph model and the vulnerability probabilistic graph model, and filter out the target patch code from the multiple candidate patch codes according to the graph matching probability. The patch code verification and optimization module is used to verify the target patch code, optimize the verified patches, and generate the final patch code. The feedback and iteration module is used to combine the final patch code with the corresponding vulnerability code to form a new training sample, and feed it back to the code large language model to update the model parameters, forming a closed-loop optimization mechanism.

[0013] Thirdly, the present invention provides an electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, which, when executed by the processor, implement the steps of the large model automated vulnerability patch code generation method.

[0014] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the large-model automated vulnerability patch code generation method.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention can generate multiple patch code snippets in a short time, improving the efficiency of patch code generation and shortening the vulnerability repair cycle; it uses multi-dimensional structural and semantic matching to select the optimal patch, avoiding the introduction of new defects and improving the quality and reliability of patch code; this invention supports multiple programming languages ​​and vulnerability types, has good versatility, and further realizes model self-learning and capability iteration through feedback mechanisms, realizing the automated generation and optimization of patch code, reducing the burden of manual repair for developers, and improving development efficiency.

[0016] This invention's architecture supports the continuous evolution of algorithms, data, and strategies, integrating static analysis, dynamic testing, and fuzz testing to ensure patch reliability. It enables rapid response to high-risk vulnerabilities and reduces the risk of attack. By constructing a verification knowledge base of vulnerabilities and corresponding patch code, this invention improves the accuracy of verifying new patch code and provides reference and learning resources for other developers, promoting knowledge sharing and dissemination. This invention can be integrated into the continuous integration process of software development, automatically detecting and fixing vulnerabilities in code, ensuring that every code commit complies with security standards, thereby promoting the development of automated software security and providing strong support for the sustainable development of the software industry. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart illustrating a method for generating automated vulnerability patch code for large models according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating the implementation of an automated vulnerability patch code generation method for large models according to an embodiment of the present invention. Figure 3 This is a system architecture diagram of a large-model automated vulnerability patch code generation system according to an embodiment of the present invention. Detailed Implementation

[0018] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0019] Example 1, referring to Figures 1-2 As one embodiment of the present invention, this embodiment provides a method for automatically generating vulnerability patch code for large models, such as... Figure 1 As shown, it includes: S100: Preprocess the input vulnerability code and construct a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerability code; S200: Input the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities; S300: For each candidate patch code, construct its corresponding patch probability graph model, calculate the graph matching probability between the patch probability graph model and the vulnerability probability graph model, and select the target patch code from multiple candidate patch codes based on the graph matching probability; S400: Verify the target patch code, optimize the verified patch, and generate the final patch code; S500: The final patch code and the corresponding vulnerability code are combined to form a new training sample, which is then fed back to the code big language model to update the model parameters, forming a closed-loop optimization mechanism.

[0020] It should be noted that existing similar products primarily rely on detecting existing vulnerabilities and lack proactive patch generation technology. Similar products utilize vulnerability detection technology, aiming to identify and locate vulnerabilities in software code. Their main purpose is to discover potential security issues as early as possible during software development and maintenance, allowing developers to fix them promptly. Vulnerability detection technology is mainly applied in the early stages of software development and maintenance, including code auditing and security testing, focusing on problem discovery—that is, determining whether security flaws exist in the code, and the specific location and type of these flaws. While large-scale models can generate diverse patch code, the generated patch code may not match the vulnerable code in terms of structure and semantics. For example, the generated patch code may change the logical structure of the original code, or introduce new variables and function calls, making the patch code unusable for vulnerability repair and potentially introducing new problems. After patch code is generated, it needs to be verified to ensure it effectively repairs the vulnerability without introducing new problems. However, existing verification methods may have false positives and false negatives, making it difficult to fully and accurately assess the quality of the patch code. For example, static analysis tools may not fully understand the runtime behavior of the patch code, while dynamic testing requires a large number of test cases and test environment support. Probabilistic graphical matching requires constructing probabilistic graphical models of the vulnerable code and candidate patch code, and calculating the matching probability between them. This process involves complex graph structure analysis and matching algorithms, resulting in high computational complexity. Especially when dealing with large-scale code, it consumes huge computational resources and may reduce the efficiency of generating patch code.

[0021] To enable large models to generate high-quality patch code, they require dedicated training and fine-tuning. However, training and fine-tuning large models requires a large amount of labeled data, which is often difficult to obtain. Furthermore, the training process necessitates adjusting numerous hyperparameters to optimize model performance, further complicating the training and fine-tuning process.

[0022] This invention combines the generative capabilities of large-scale models with the precise filtering capabilities of probabilistic graphical matching to achieve automated patch code generation. It utilizes a large-scale model to generate a series of candidate patch codes based on the contextual information of the vulnerable code. By constructing a probabilistic graphical model of the vulnerable code and candidate patch codes and calculating the matching probability between them, the patch code that best matches the structure and semantics of the vulnerable code is selected. The generated patch code is then verified and optimized to ensure that it effectively fixes the vulnerability without introducing new problems. Figure 2 As shown, this invention combines the powerful generation capabilities of large models with the precise matching capabilities of probabilistic graph matching technology to achieve efficient and high-quality automatic generation of patch code. This addresses the inefficiency and inconsistent quality of traditional manual software vulnerability repair, as well as the matching issues inherent in directly generating patch code from large models. It aims to promote automation in the software security field, reduce reliance on manual intervention, and improve the overall security of software systems. By automating the generation and optimization of patch code, developers can be freed from tedious vulnerability repair work, improving work efficiency. Furthermore, the automated patch code generation method can be better integrated into the software development lifecycle, combining with existing software development tools and processes to form a complete automated software security solution.

[0023] In a feasible approach, code parsing tools such as ANTLR or Pygments can be used to perform initial code cleanup, removing comments and redundant spaces to simplify the code and highlight its core logic. Then, the Clang library is used to construct an Abstract Syntax Tree (AST) from the preprocessed vulnerable code. An AST is a tree-like structure that clearly represents the syntactic structure of code, including function definitions, variable declarations, and statement blocks. By constructing the AST, syntactic information can be extracted, providing a syntactic structural foundation for subsequent probabilistic graphical model construction.

[0024] After constructing the Abstract Syntax Tree (AST), the data flow information in the code is further extracted. This embodiment of the invention uses data flow analysis algorithms, such as Reaching Definitions Analysis. The algorithm analyzes the definition points, usage points, and propagation paths of variables to construct a Data Flow Graph (DFG). In this embodiment of the invention, step S100, which involves removing comments and redundant whitespace characters from the vulnerable code and constructing a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerable code, includes: The control flow graph is constructed based on the abstract syntax tree. The function body is split into basic blocks and control flow edges are established. The reachable sets of variable definitions at the entry and exit points of each basic block are calculated on the control flow graph. The control flow graph is converted to a static single-assignment form. Functions are inserted at the merging points and variables are renamed. All variable usage points are scanned, and each variable is uniquely bound to its corresponding definition point according to its static single-assignment version, generating weighted data flow edges. Inter-process pointer analysis is performed to construct the call graph, and parameters, return values, and heap objects are abstracted into cross-function data flow edges. All generated data flow edges are serialized into an adjacency list format to form a data flow graph.

[0025] Specifically, the process for extracting data stream information includes steps A1 to A6: Step A1: Using the function body AST generated by Clang as input, split it into BasicBlock and establish control flow edges; Step A2: Iterating Reaching-Definitions: Compute the IN / OUT of each block on the control flow graph CFG to obtain the reachable set of variable definitions; Step A3: Insert at the meeting point - Functions and rename variables to ensure that each version assigns a value only once; Step A4: Scan all se, uniquely bind them to the definition according to the static single-assignment SSA version, and generate edges with a weight of 1 / (path length + 1); Step A5: Use Andersen pointers to analyze the call graph and abstract parameters, return values, and heap objects into cross-function data flow edges; Step A6: Serialize into a JSON adjacency list <src,dst,type,weight,line,col> for direct matching by the probabilistic graphical model.

[0026] It should be noted that data flow graphs can represent the dependencies between variables and the data propagation path, providing data flow information for subsequent probabilistic graphical models.

[0027] In this embodiment of the invention, step S100 further includes: The nodes in the abstract syntax tree and data flow graph are aligned using a unified node identifier ID and fused to obtain a probabilistic graphical model representing the structure and semantic features of the vulnerability code. The node set of the probabilistic graphical model contains grammatical structure nodes from the abstract syntax tree and data dependency nodes from the data flow graph. The edge set contains control flow, grammatical parent-child relationships, and data flow relationships, and each edge is assigned a joint probability weight. A vulnerability probability graph is modeled, where each node corresponds to a univariate potential function and each edge corresponds to a binary potential function. For any candidate patch code, the similarity score between its vulnerability probability graph model and the known vulnerability probability graph models is calculated, and this similarity score is used as the matching criterion.

[0028] In one feasible approach, AST and DFG are combined to construct a probabilistic graphical model of the vulnerable code. Nodes in the probabilistic graphical model represent statements, variables, etc., in the code, and edges represent relationships between them, such as control flow and data flow. This invention uses a Markov random field model to construct the probabilistic graph, and the process includes steps B1-B5: Step B1: Unify the AST and DFG with the same set of node IDs to obtain the hybrid graph G=(V,E), where V contains both syntax nodes and data flow nodes.

[0029] Step B2: Assign a joint probability weight w to each edge, reflecting the confidence level of the relationship in the vulnerability context.

[0030] Step B3: Model using Markov Random Fields (MRF): Node features → Potential function φ_u, Edge features → Potential function The final overall probability Step B4: in, It is a univariate potential function. It is a binary potential function. The normalization constant is For nodes eigenvectors.

[0031] Step B5: Analyze the candidate patch graph calculate The maximum posterior is taken as the matching score.

[0032] It should be noted that probabilistic graphical models can comprehensively represent the structural and semantic features of vulnerable code, providing a basis for subsequent patch code matching and screening.

[0033] It should also be noted that during the generation of patch code from the large model, constraints for probabilistic graph matching are introduced in real time. Specifically, the probabilistic graph model of the vulnerability code is used as a reference to guide the large model in generating patch code that better matches the structure and semantics of the vulnerability code. During the generation process, the matching probability between the probabilistic graph of the candidate patch code and the probabilistic graph of the vulnerability code is calculated, and this matching probability is used as a weighting factor in the generation process to guide the large model in generating patch code that better meets the requirements. Generation guided by probabilistic graph matching can effectively improve the matching accuracy of the generated patch code. This method not only utilizes the generation capabilities of the large model but also ensures, through the constraints of probabilistic graph matching, that the generated patch code is highly matched to the vulnerability code in terms of structure and semantics, thereby improving the quality and reliability of the patch code. When constructing the probabilistic graph model, the graph structure is simplified by removing some redundant nodes and edges. Specifically, some details that do not affect the main logic of the code can be ignored, thereby reducing the complexity of the graph and computational complexity. Graph structure simplification can significantly reduce the computational complexity of probabilistic graph matching. This method not only improves computational efficiency but also reduces the consumption of computational resources, making the probabilistic graph matching process more efficient.

[0034] Furthermore, in this embodiment of the invention, a large-scale model architecture suitable for code generation tasks is selected, such as a Transformer-based model (e.g., GPT, Qwen). These models possess powerful language understanding and generation capabilities, enabling them to handle complex code text. In this embodiment, the Qwen large-scale model is used, which, through its large-scale pre-training, can understand the contextual information of the code and generate reasonable patch code.

[0035] In this embodiment of the invention, step S200, which involves inputting the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities, includes: Insert a low-rank matrix into the weight matrix of the code-large language model, freeze the original model parameters, and train only the low-rank matrix; The preprocessed vulnerability code is used as input to the code big language model to generate multiple candidate patch codes. During the generation process, the generation probability of each candidate patch code is calculated. The generation probability is the joint probability of the model outputting the patch code given the vulnerability code. The pre-training data consists of a vulnerability function and a corresponding manually labeled patch function, and is trained by an optimizer that combines cosine learning rate decay, gradient pruning, and early stopping mechanisms.

[0036] In a feasible approach, a large amount of code data is collected, including normal code and code with known vulnerabilities and corresponding patches. The data is cleaned and preprocessed, transforming it into a format suitable for model input, such as a tokenized sequence. The code text is converted into a tokenized form that the model can understand, facilitating model learning and generation. The LoRA (Low-Rank Adaptation) method is used to fine-tune the large model. LoRA is an efficient fine-tuning method that reduces the number of parameters required for fine-tuning and improves fine-tuning efficiency by inserting low-rank matrices into the weight matrix of the pre-trained model. The specific steps are as follows: Inserting low-rank matrices: Low-rank matrices are inserted into the weight matrix of the pre-trained model. The rank of these low-rank matrices is much smaller than the rank of the original weight matrix, thus significantly reducing the number of parameters that need to be trained.

[0037] Training the low-rank matrix: Train the inserted low-rank matrix using the prepared data. Concatenate the vulnerability function <VUL> and the manually annotated patch function <FIX> into a single input, i.e.: [CLS]〈VUL〉[SEP]〈FIX〉[EOS] During training, specific loss functions, such as those tailored to code structure and semantics, are used to optimize the model's output. The training process includes steps C1 through C6: Step C1: Initialization. Load the pre-trained code large model and freeze all its parameters; only initialize the newly added LoRA matrix using He.

[0038] Step C2: Hyperparameter configuration. Batch size 64, maximum length 1024 tokens, initial learning rate 2×10⁻⁶. -4 Cosine attenuation was used to reduce the concentration to 2×10⁻⁶. -5 Warm-up steps: 500; weight decay: 0.01; dropout: 0.05.

[0039] Step C3: Optimizer. Using AdamW, β1=0.9, β2=0.95, eps=1×10 -8 Gradient clipping norm 1.0.

[0040] Step C4: Distributed training. 8×A100 40GB, DeepSpeedZeRO-2 stage, mixed precision FP16, active checkpoint enabled, actual memory usage 35GB / card.

[0041] Step C5: Iteration and Validation. Every 200 steps, calculate the perplexity PPL on the validation set. If the PPL does not decrease for 3 consecutive times, trigger early stopping. Training takes 3.6 epochs (18k steps) and converges in about 6.5 hours.

[0042] Step C6: Parameter merging. After training, the LoRA parameters are merged with the original weights according to W′=W+BA to obtain a single static model file, which can be directly deployed without additional plugins during the inference phase.

[0043] It should be noted that the LoRA method is used for fine-tuning large models. LoRA is an efficient fine-tuning method that achieves fine-tuning by inserting low-rank matrices into the weight matrix of the pre-trained model, thereby reducing the number of parameters required for fine-tuning and improving fine-tuning efficiency. This invention achieves automated patch code generation through four steps: vulnerability code analysis, large model-based candidate patch code generation, probabilistic graph matching and filtering, and patch code verification and optimization. The entire process combines the generation capabilities of large models with the filtering capabilities of probabilistic graph matching, ensuring that the generated patch code is highly matched to the vulnerability code in structure and semantics, effectively fixing the vulnerability without introducing new problems. Through detailed analysis and optimization steps, this invention can generate patch code efficiently and with high quality, promoting the development of automated software security.

[0044] Furthermore, the vulnerable code and its context information are input into the fine-tuned large model. The model outputs a series of candidate patch codes, each with a corresponding generation probability. For example, the model generates multiple possible patch code fragments based on the input vulnerable code, and each fragment has a generation probability value, indicating the likelihood that the model considers the fragment a reasonable patch.

[0045] In this embodiment of the invention, the pre-training data in step S200 is composed of vulnerability functions and corresponding manually annotated patch functions. The splicing format is: classification marker, vulnerability function code, separator marker, manually annotated patch function code, and sequence end marker.

[0046] It should be noted that in step S200 of this embodiment, a probabilistic graphical model is constructed for each candidate patch code. Similar to the construction of the probabilistic graphical model for the vulnerability code, the syntactic structure and data flow information of the candidate patch code are combined to construct the probabilistic graphical model. A Markov model is also used to construct the probabilistic graph of the candidate patch code, enabling it to represent the structural and semantic features of the candidate patch code.

[0047] Furthermore, a graph matching algorithm is used to calculate the matching probability between the probabilistic graph of the candidate patch code and the probabilistic graph of the vulnerable code. By calculating factors such as the number of edge matches and node similarity between the two probabilistic graphs, a comprehensive matching probability value is obtained. That is, if the two probabilistic graphs are highly similar in structure and semantics, the matching probability value will be higher. The process is as follows: Constructing based on feature cosine similarity The matrix is ​​used to find the optimal one-to-one mapping using the Hungarian algorithm to obtain the average node similarity. .

[0048] On the maximum common subgraph (MCS) induced by aligned nodes, calculate edge recall and precision to obtain structural similarity. Simultaneously, the semantic strength is obtained by taking the geometric mean of the edge potential function ψ of the vulnerability graph and the patch graph for each MCS edge. .

[0049] in, This is the Sigmoid function, which outputs a matching probability of 0–1, used for sorting candidate patches.

[0050] In this embodiment of the invention, step S400, which verifies the target patch code and optimizes the verified patch to generate the final patch code, includes: If the target patch code passes verification, it will be used as the final output; if the target patch code fails verification, the next candidate patch code will be selected from the remaining candidate patch codes in order of matching probability for verification, until a patch code that passes verification is found or all candidate patch codes are exhausted.

[0051] In one feasible approach, patch code that best matches the structure and semantics of the vulnerable code is selected based on probabilistic graph matching probabilities. The candidate patch code with the highest matching probability can be chosen as the final output, or weighted sampling can be performed based on the matching probabilities to generate higher-quality patch code. For example, if one candidate patch code has a probabilistic graph matching probability of 0.9 and another has 0.6, the patch code with the matching probability of 0.9 is preferred.

[0052] In this embodiment of the invention, the step of verifying the target patch code in step S400 includes: Compile the target patch code into an executable program; Use a pre-defined set of test cases to dynamically test the executable program and check for crashes or abnormal exits. Use static analysis tools to scan the target patch code to check for the introduction of new security flaws.

[0053] Specifically, static code analysis tools (SonarQube, FindBugs) are used to perform syntax and semantic checks on the generated patch code. Unit testing and integration testing are used to verify the functional correctness of the patch code. Fuzzing tools are then used to further detect potential security issues in the patch code. The specific implementation process includes steps D1 to D3: Step D1: Perform syntax compliance checks using Clang-Tidy, rule compliance scoring using SonarQube (threshold ≥ B), and null pointer / memory leak verification using Infer in sequence; only after all three pass can you proceed to dynamic testing.

[0054] Step D2: Unit testing: Add a new test (Patch, CVE_2024_xxx) within the original project test framework (gtest / Catch2) to cover the original trigger test cases and boundary values. The pass rate must be 100%.

[0055] Integration testing: Put the patch version into the CI pipeline, run the full feature set and regression set, and the time taken should be ≤ +5% of the baseline.

[0056] Fuzzing: Run LibFuzzer continuously for 8 hours, with the seed set being vulnerability samples. No ASAN / UBSAN alarms are considered a pass.

[0057] Step D3: Combine the static defect density (DD = defect / KLoC) and the number of dynamic crashes to calculate the safety score S = 100 - DD × 10 - crashes × 20; only those with S ≥ 90 can be included in the database.

[0058] Furthermore, the patch code is optimized based on the verification results. This includes simplifying code logic, optimizing variable naming, and improving code readability and maintainability. Code performance is also optimized to ensure the patch code does not negatively impact system performance. The code optimization process includes steps E1 through E3: Step E1: Variable renaming: Rename the temporary variables t1 and buf2 within the patch to safeLen and sanitizedBuf, respectively, to conform to coding standards. Early termination simplification: Replace deep if-else statements with guard statements to reduce nesting by more than two levels.

[0059] Step E2: If the patch introduces a strlen loop, replace it with strnlen_s and cache the result. The complexity is reduced from O(n^2) to O(n^2). 2 The time complexity has been reduced to O(n). For the log strings added in the patch, static constants are now used for concatenation, reducing runtime formatting CPU usage by 30%.

[0060] Step E3: The original patch's extra malloc allocation of 512B was optimized to a stack array chartmp

[256] , and compile-time assertions were added to ensure sufficient capacity, eliminating heap overhead. Further verification: After optimization, static + unit + integration tests were rerun to ensure zero new defects and a performance regression of <2%.

[0061] Furthermore, the validated and optimized patch code is fed back into the large model as new training data for iterative training. Through continuous iterative training, the model can generate higher-quality patch code that better meets real-world needs. For example, the optimized patch code is re-inputted into the model, allowing it to learn more effective patch generation patterns and gradually improve its performance and generation quality. The iterative optimization process includes steps F1 to F4: Step F1: Pair the "vulnerable function + optimized patch" into the incremental training set and mark it as quality level A (passes all tests).

[0062] Step F2: Freeze the backbone and train only the low-rank matrix; learning rate 1e-4, epoch=1, batch=64, completed in 30 minutes. Training objective: Maximize the patch log-likelihood while minimizing the difference from the old model (KL divergence ≤ 0.02).

[0063] Step F3: Perform blind testing with 100 unseen new CVEs, and the generation pass rate increases from 82% to 89%, with the average matching probability increasing by 6%.

[0064] Step F4: Automatically collect ≥50 verified patches each week to trigger incremental training and achieve continuous model evolution.

[0065] It should be noted that this invention comprehensively utilizes multiple verification methods, including static analysis, dynamic testing, and fuzz testing, to evaluate the quality of patch code from different perspectives. Specifically, static analysis tools are first used to check the patch code for syntax and semantic errors. Then, dynamic testing verifies the behavior of the patch code in a real-world operating environment. Finally, fuzz testing is used to further detect any potential security issues in the patch code. By combining multiple verification methods, the quality of the patch code can be comprehensively evaluated, reducing false positives and false negatives. This improves the accuracy of verification and ensures that the generated patch code effectively fixes vulnerabilities without introducing new problems.

[0066] It should also be noted that this invention utilizes the powerful generative capabilities of large-scale models to rapidly generate a series of candidate patch codes. Compared to traditional manual vulnerability patching methods, large-scale models can generate multiple patch code fragments in a short time, significantly improving patch code generation efficiency. Traditional manual patching may take weeks, while this method can generate multiple candidate patch codes in minutes or even seconds, significantly shortening the vulnerability patching cycle. By using probabilistic graph matching technology to screen the generated patch codes, it is ensured that the patch codes and the vulnerability code have a high degree of structural and semantic matching. Probabilistic graph matching evaluates the code from multiple dimensions, including structural features (such as control flow and data flow) and semantic features (such as variable relationships and function call relationships), to select the patch codes that best meet the vulnerability patching requirements. This helps avoid the generated patch codes introducing new problems and improves the quality and reliability of the patch codes.

[0067] This invention is adaptable to different types of software vulnerabilities and multiple programming languages. The large-scale model possesses powerful language understanding and generation capabilities, and through appropriate training and fine-tuning, it can be applied to various programming languages ​​and software development scenarios. Simultaneously, the probabilistic graphical matching technology does not rely on specific programming language characteristics but is based on the general structure and semantic features of the code for matching, thus exhibiting good cross-language adaptability. This means that this method can be widely applied to software systems written in multiple programming languages ​​such as C, C++, Java, and Python, providing effective patch code generation solutions for different types of software vulnerabilities, demonstrating broad applicability and versatility. This invention achieves continuous learning and optimization of the model by feeding back verified and optimized patch code to the large-scale model. In practical applications, the types and repair methods of software vulnerabilities are constantly changing. Through the continuous feedback mechanism, the large-scale model can continuously learn new vulnerability repair patterns and patch code characteristics, thereby continuously improving its generation capabilities. This allows this method to continuously improve the quality and accuracy of patch code generation over time and with the accumulation of practical experience, better adapting to ever-changing software security needs. This invention achieves automated patch code generation and optimization, reducing the time and effort developers spend on vulnerability repair. Developers no longer need to manually write patch code, allowing them to focus more time and effort on software feature development and innovation. Furthermore, automated patch code generation methods can be better integrated into the software development lifecycle, combining with existing software development tools and processes to form a complete automated software security solution. This not only improves software development efficiency but also reduces software security risks, enhancing the quality and competitiveness of software products.

[0068] Example 2, refer to Figure 3The above embodiment is an illustrative scheme of a method for generating automated vulnerability patch code for large models. It should be noted that the technical solution of this automated vulnerability patch code generation system for large models and the technical solution of the above-described automated vulnerability patch code generation method for large models belong to the same concept. Details not described in detail in this embodiment can be found in the description of the above-described automated vulnerability patch code generation method for large models.

[0069] This embodiment describes a large-scale automated vulnerability patch code generation system, comprising: The vulnerability code analysis module is used to preprocess the input vulnerability code and build a vulnerability probability graph model that integrates abstract syntax trees and data flow graphs based on the preprocessed vulnerability code. The large model generation module is used to input the vulnerable code into the pre-trained code large language model and generate multiple candidate patch codes and their corresponding generation probabilities. The probabilistic graph matching and filtering module is used to construct a corresponding patch probabilistic graph model for each candidate patch code, calculate the graph matching probability between the patch probabilistic graph model and the vulnerability probabilistic graph model, and filter the target patch code from multiple candidate patch codes based on the graph matching probability. The patch code verification and optimization module is used to verify the target patch code, optimize the verified patches, and generate the final patch code. The feedback and iteration module is used to combine the final patch code with the corresponding vulnerability code to form a new training sample, which is then fed back to the code big language model to update the model parameters, forming a closed-loop optimization mechanism.

[0070] It should be noted that, in this embodiment of the invention, the vulnerability code analysis module is responsible for preprocessing the vulnerability code, constructing an abstract syntax tree, extracting data flow information, and building a probabilistic graphical model. The large model generation module uses the large model to generate candidate patch codes, specifically including selecting the large model architecture, data preparation, LoRA fine-tuning, and generating candidate patch codes. The probabilistic graphical matching and filtering module uses probabilistic graphical matching technology to filter out the patch codes that best match the structure and semantics of the vulnerability code. The patch code verification and optimization module verifies and optimizes the generated patch codes to ensure that they can effectively fix the vulnerability without introducing new problems. The feedback and iteration module feeds the verified and optimized patch codes back to the large model, enabling continuous learning and optimization of the model.

[0071] Specifically, the vulnerability code analysis module first preprocesses the collected vulnerability code, removing comments and redundant spaces to streamline the code and highlight its core logic. This process utilizes code parsing tools such as ANTLR or Pygments to perform initial code cleanup, laying the foundation for subsequent analysis. The preprocessed code text retains the core logic and structure of the code, facilitating further analysis.

[0072] Using code parsing tools, such as the Clang library, an Abstract Syntax Tree (AST) is constructed from the preprocessed vulnerable code. An AST is a tree-like structure that clearly represents the syntactic structure of code, including function definitions, variable declarations, and statement blocks. By constructing the AST, syntactic information can be extracted from the code, providing a syntactic structural foundation for subsequent probabilistic graphical model construction.

[0073] After constructing the Abstract Syntax Tree (AST), data flow information is further extracted from the code. This process is implemented using data flow analysis algorithms, such as Reaching Definitions Analysis (RDA). The algorithm analyzes the definition points, usage points, and propagation paths of variables to construct a Data Flow Graph (DFG). The DFG represents the dependencies between variables and the data propagation paths, providing data flow information for subsequent probabilistic graphical models.

[0074] This invention combines Abstract Syntax Trees (ASTs) and Graph Digitization Trees (DFGs) to construct a probabilistic graphical model of vulnerable code. Nodes in the probabilistic graphical model represent statements, variables, etc., in the code, while edges represent relationships between them, such as control flow and data flow. The weights of the edges can be calculated based on factors such as the strength of dependencies between variables. This invention uses a Markov model to construct the probabilistic graph. The probabilistic graphical model can comprehensively represent the structural and semantic features of vulnerable code, providing a basis for subsequent patch code matching and selection.

[0075] Specifically, the large model generation module selects large model architectures suitable for code generation tasks, such as Transformer-based models (e.g., GPT-3, CodeBERT). These models have powerful language understanding and generation capabilities and can handle complex code text.

[0076] A large amount of code data is collected, including normal code and code with known vulnerabilities and corresponding patches. The data is cleaned and preprocessed, transformed into a format suitable for model input, such as tokenized sequences. The data preparation phase ensures that the model can learn rich code patterns and remediation strategies.

[0077] Large models can be fine-tuned using the LoRA (Low-Rank Adaptation) method. LoRA is an efficient fine-tuning method that reduces the number of parameters required for fine-tuning by inserting a low-rank matrix into the weight matrix of the pre-trained model, thereby improving fine-tuning efficiency. The specific steps are as follows: Inserting low-rank matrices: Low-rank matrices are inserted into the weight matrix of the pre-trained model. The rank of these low-rank matrices is much smaller than the rank of the original weight matrix, thus significantly reducing the number of parameters that need to be trained.

[0078] Training the low-rank matrix: The inserted low-rank matrix is ​​trained using the prepared data. By training the low-rank matrix, the model can quickly adapt to the patch code generation task without needing to fine-tune the entire pre-trained model.

[0079] Optimize the training process: During training, use specific loss functions, such as loss functions tailored to code structure and semantics, to optimize the model's output. By optimizing the training process, the model can generate higher-quality patch code.

[0080] The vulnerable code and its context information are input into a finely tuned large model, which outputs a series of candidate patch codes, each with a corresponding probability of generation. These candidate patch codes will serve as the basis for subsequent screening and verification.

[0081] Specifically, the probabilistic graph matching and filtering module constructs a corresponding Markov probability graph for each candidate patch code and calculates the matching probability between the candidate patch code's probability graph and the vulnerability code's probability graph. The matching probability is calculated by comparing the structural and semantic features of the two probability graphs, using methods such as the maximum subgraph isomorphism algorithm and the graph edit distance algorithm. The matching probability reflects the degree of structural and semantic similarity between the candidate patch code and the vulnerability code.

[0082] Based on the matching probability, a sampling weight is calculated for each candidate patch. The sampling weight is proportional to the matching probability; the higher the matching probability, the greater the sampling weight. The sampling weight guides the sampling process of the large model, ensuring that the sampling results are more inclined towards patches with a high degree of matching with the vulnerable code.

[0083] During the sampling process of the large model, weighted sampling is performed based on the calculated sampling weights. Specifically, candidate patch codes are selected based on the sampling weights, with higher weights indicating a greater probability of selection. This makes it more likely that the large model will generate patch codes with a high degree of structural and semantic matching to the vulnerable code, thereby improving the quality and reliability of the generated patch codes.

[0084] Specifically, the patch code verification and optimization module uses static code analysis tools (such as SonarQube and FindBugs) to perform syntax and semantic checks on the generated patch code. It verifies the functional correctness of the patch code through unit testing and integration testing. Fuzzing tools are used to further detect potential security issues in the patch code. The verification process ensures that the generated patch code effectively fixes vulnerabilities without introducing new problems.

[0085] The patch code was optimized based on the verification results. This included simplifying code logic, optimizing variable naming, and improving code readability and maintainability. Code performance was also optimized to ensure the patch code would not negatively impact system performance. The optimization process further improved the quality and reliability of the patch code.

[0086] The validated and optimized patch code is fed back to the large model as new training data for iterative training. Through continuous iterative training, the model can generate higher-quality patch code that better meets real-world requirements. This feedback and iteration process ensures the continuous optimization and improvement of the model, enabling it to adapt to ever-changing software security needs.

[0087] Specifically, the feedback and iteration module feeds back the verified and optimized patch code to the large model as new training data. This feedback mechanism ensures that the model can learn the latest vulnerability fix patterns and patch code characteristics, thereby continuously improving its generation capabilities.

[0088] Through continuous iterative training, the model is able to generate higher-quality patch code that better meets real-world needs. This continuous optimization process not only improves the model's performance but also ensures that the generated patch code can adapt to ever-changing software security requirements.

[0089] It should be noted that by automating the generation of high-quality patch code, this invention can quickly fix software vulnerabilities, reduce the risk of vulnerability exploitation, and thus improve the overall security of the software system. Upon discovering a high-risk vulnerability, patch code can be quickly generated and deployed to the production environment to promptly fix the vulnerability and protect user data and system security. The architecture of this invention has good scalability and flexibility; its performance and adaptability can be continuously improved by expanding the dataset, optimizing the model architecture, and refining the probabilistic graph matching algorithm. Furthermore, the parameters and strategies of the probabilistic graph matching can be flexibly adjusted according to different application scenarios and needs to adapt to different vulnerability remediation requirements.

[0090] This invention not only generates patch code but also comprehensively verifies it using various methods such as static analysis, dynamic testing, and fuzz testing to ensure it effectively fixes vulnerabilities without introducing new problems. Furthermore, the patch code is optimized to improve its performance and readability. This comprehensive verification and optimization mechanism ensures the high quality and reliability of the generated patch code, providing strong support for the stable operation of the software system. By feeding the verified and optimized patch code back to the large model, this invention not only achieves continuous model optimization but also accumulates a wealth of vulnerability remediation knowledge and experience. This knowledge and experience can be shared and learned by other developers, promoting the improvement of security levels across the entire software development community. Further establishing a verification knowledge base containing known vulnerabilities and corresponding patch code, and comparing and verifying newly generated patch code with known patch code in the knowledge base, not only improves the accuracy of verifying new patch code but also provides reference and learning resources for other developers, promoting knowledge sharing and dissemination. This drives the automation development in the field of software security, reduces reliance on manual intervention, and improves the overall security of software systems. By automating the generation and optimization of patch code, this invention provides an effective solution for software security automation, helping to improve software development efficiency, reduce software security risks, and enhance the quality and competitiveness of software products. Integrating this invention into the continuous integration process of software development can automatically detect and fix vulnerabilities in the code, ensuring that every code commit meets security standards, thereby promoting the development of software security automation and providing strong support for the sustainable development of the software industry.

[0091] This embodiment also provides an electronic device applicable to the large-model automated vulnerability patch code generation method, including: The system includes a memory and a processor. The memory stores computer-executable instructions, and the processor executes these instructions to implement the automated vulnerability patching code generation method for large models as proposed in the above embodiments.

[0092] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the method for generating automated vulnerability patch code for large models as proposed in the above embodiments.

[0093] The storage medium proposed in this embodiment and the method for generating automated vulnerability patch code for large models proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0094] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0095] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for automatically generating vulnerability patch code for large models, characterized in that, include: The input vulnerability code is preprocessed, and a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph is constructed based on the preprocessed vulnerability code. The vulnerability code is input into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities. For each candidate patch code, a corresponding patch probability graph model is constructed, and the graph matching probability between the patch probability graph model and the vulnerability probability graph model is calculated. The target patch code is then selected from the multiple candidate patch codes based on the graph matching probability. The target patch code is verified, and the verified patches are optimized to generate the final patch code; The final patch code and the corresponding vulnerability code are combined to form a new training sample, which is then fed back to the code-large language model to update the model parameters, forming a closed-loop optimization mechanism.

2. The method for generating automated vulnerability patch code for large models as described in claim 1, characterized in that, include: Removing comments and redundant whitespace characters from the vulnerable code, and constructing a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerable code, includes: A control flow graph is constructed based on the abstract syntax tree. The function body is split into basic blocks and control flow edges are established. The reachable sets of variable definitions at the entry and exit points of each basic block are calculated on the control flow graph. The control flow graph is converted to a static single-assignment form. Functions are inserted at the merging points and variables are renamed. All variable usage points are scanned, and each variable is uniquely bound to its corresponding definition point according to its static single-assignment version, generating weighted data flow edges. Inter-process pointer analysis is performed to construct a call graph, and parameters, return values, and heap objects are abstracted into cross-function data flow edges. All generated data flow edges are serialized into an adjacency list format to form the data flow graph.

3. The method for generating automated vulnerability patch code for large models as described in claim 2, characterized in that, Also includes: The nodes in the abstract syntax tree and data flow graph are aligned with a unified node identifier ID and fused to obtain a probabilistic graphical model representing the structure and semantic features of the vulnerability code. The node set of the probabilistic graphical model includes grammatical structure nodes from the abstract syntax tree and data dependency nodes from the data flow graph. The edge set includes control flow, grammatical parent-child relationships, and data flow relationships, and each edge is assigned a joint probability weight. The vulnerability probability graph is modeled, where each node corresponds to a univariate potential function and each edge corresponds to a binary potential function; for any candidate patch code, the similarity score between its vulnerability probability graph model and the known vulnerability probability graph model is calculated, and the similarity score is used as the matching basis.

4. The method for generating automated vulnerability patch code for large models as described in claim 3, characterized in that, The vulnerable code is input into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities, including: Insert a low-rank matrix into the weight matrix of the code-large language model, freeze the original model parameters, and train only the low-rank matrix; The preprocessed vulnerability code is used as input to the code big language model to generate multiple candidate patch codes. During the generation process, the generation probability of each candidate patch code is calculated. The generation probability is the joint probability of the model outputting the patch code under the given vulnerability code conditions. The pre-training data consists of a vulnerability function and a corresponding manually labeled patch function, and is trained by an optimizer that combines cosine learning rate decay, gradient pruning, and early stopping mechanisms.

5. The method for generating automated vulnerability patch code for large models as described in claim 4, characterized in that, In the step of constructing the pre-training data by concatenating vulnerability functions and corresponding manually annotated patch functions, the concatenation format is: classification marker, vulnerability function code, separator marker, manually annotated patch function code, and sequence end marker.

6. The method for generating automated vulnerability patch code for large models as described in claim 5, characterized in that, The process of verifying the target patch code and optimizing the verified patches to generate the final patch code includes: If the target patch code passes verification, it will be used as the final output. If the target patch code fails verification, the next candidate patch code will be selected from the remaining candidate patch codes in order of matching probability for verification, until a patch code that passes verification is found or all candidate patch codes are exhausted.

7. The method for generating automated vulnerability patch code for large models as described in claim 6, characterized in that, The steps for verifying the target patch code include: Compile the target patch code into an executable program; The executable program is dynamically tested using a pre-defined set of test cases to check for crashes or abnormal exits. The target patch code was scanned using static analysis tools to check for any new security flaws.

8. A large-model automated vulnerability patch code generation system, applied to the method described in any one of claims 1-7, characterized in that, include: The vulnerability code analysis module is used to preprocess the input vulnerability code and construct a vulnerability probability graph model that integrates an abstract syntax tree and a data flow graph based on the preprocessed vulnerability code. The large model generation module is used to input the vulnerability code into a pre-trained code large language model to generate multiple candidate patch codes and their corresponding generation probabilities. The probabilistic graph matching and filtering module is used to construct a corresponding patch probabilistic graph model for each candidate patch code, calculate the graph matching probability between the patch probabilistic graph model and the vulnerability probabilistic graph model, and filter out the target patch code from the multiple candidate patch codes according to the graph matching probability. The patch code verification and optimization module is used to verify the target patch code, optimize the verified patches, and generate the final patch code. The feedback and iteration module is used to combine the final patch code with the corresponding vulnerability code to form a new training sample, and feed it back to the code large language model to update the model parameters, forming a closed-loop optimization mechanism.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the large model automated vulnerability patch code generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the large-model automated vulnerability patch code generation method according to any one of claims 1 to 7.

Images