An intelligent audit method and system for industrial control software vulnerabilities and a medium

Abstract

The present application relates to an industrial control software vulnerability intelligent auditing method, system and medium, the system comprises: static analysis and risk point standardization module, CPG generation and language adaptation module, alarm anchor point and local evidence mapping module, double route evidence package module, evidence sufficiency auditing module, artificial checking and typed feedback module, query evolution and deterministic compilation module and acceptance and report module. The present application only artificially reviews the decisive record of sufficient evidence, encodes stable alarm identification, evidence routing, original conclusion, corrected conclusion and premise change into typed feedback; query is expressed as query gene composed of semantic source, semantic sink, guard, context constraint and output specification, the change of the model can only be proposed from the registered directory, and the change is limited by the type constraint, and then the deterministic controller is compiled into a predefined query template, so as to convert artificial experience into a verifiable query modification instead of an arbitrary generation.

Description

Technical Field

[0001] This invention relates to the field of industrial control software analysis, and in particular to an intelligent auditing method, system and medium for industrial control software vulnerabilities. Background Technology

[0002] With the integration of industrial networks and Ethernet, path processing, authentication and authorization, configuration reading and writing, log output, script execution, and cross-language calls in the source code may pose security risks. Existing static analyzers can quickly identify risk points, but the discovery of rule hits, local syntax patterns, or a data stream by a static analyzer does not necessarily prove that the corresponding problem meets the exploitability conditions; the true conclusion also depends on security prerequisites such as whether the input is of low trustworthiness, whether the entry point is reachable, whether the protection measures are effective, whether the permission boundaries are crossed, and whether the target version is compatible.

[0003] An existing invention patent with publication number CN122174244A discloses a code vulnerability detection method and system that integrates rule semantics and code attribute graphs. This scheme, based on rule-hitting functions and semantic supplementary candidate functions, extracts the call context and data flow paths from the code attribute graph and outputs vulnerability existence judgment, vulnerability type, and cause, which helps to expand the candidate range and reduce model context overhead. However, according to its disclosure, this scheme does not explicitly provide a dual-routing contract from the original alert to local graph evidence, nor does it explicitly retain verifiable abstention results when critical security prerequisites are missing, and it does not disclose a mechanism for converting manual corrections into compileable typed query changes. Another invention patent with publication number CN119848869A discloses a static software vulnerability detection method based on statement-level code attribute graph queries. This scheme constructs and simplifies code attribute graphs at the statement granularity and executes queries in a graph database to discover vulnerabilities, mainly addressing the issues of graph size and query efficiency. However, according to its published content, this solution does not clearly handle the retention path after alarm location mapping failure, nor does it clearly divide the results into three states: evidence support, evidence rebuttal, and abstention, based on the sufficiency of evidence. Furthermore, invention patent CN120805137A discloses a vulnerability detection method based on compressed code attribute graphs and edge type differentiation processing. This solution aggregates compressed code attribute graphs through syntax subtrees and improves detection performance through edge type differentiation learning processing, primarily focusing on graph representation compression and model inference. However, according to its published content, this solution does not clearly establish a bounded evidence fragment anchored by a single alarm, evidence routing, and a deterministic query evolution closed loop after manual verification. Moreover, invention patent CN110955898A discloses a vulnerability auditing method, system, and related devices for website building systems. This solution transforms code into abstract syntax trees and control flow graphs, performs data flow analysis, deduplicates suspected vulnerabilities, and generates reports, providing valuable reference for traditional static detection. However, according to its publicly available information, the scheme does not clearly define how to preserve multilingual semantics, local evidence packages, explicitly retain missing premises, or handle query changes generated through type-constrained feedback.

[0004] While the existing solutions mentioned above involve code attribute graphs, rule scanning, graph queries, or model-assisted detection, they still have the following shortcomings: First, static alerts often only describe local syntax, data flow, or rule hits, making it difficult to simultaneously explain security prerequisites such as entry trust level, authentication protection, persistent configuration, execution permissions, and target version, which can easily increase the burden of false alarm review. Second, directly providing the model with the full source code or global program graph introduces a large amount of irrelevant context, while providing only alert text or a small amount of code snippets lacks verifiable program relationships. Third, for alerts without reliable CPG mapping or missing security prerequisites, directly discarding them will miss risks, while directly identifying them as vulnerabilities will introduce unverified threat conditions. Fourth, if the model directly generates or modifies executable static analysis queries, it is easy to generate illegal classes, predicates, interfaces, cross-language semantic assumptions, or unverified coverage changes, making it difficult to ensure that changes are rollbackable, compileable, and re-executable. Fifth, if historical vulnerability numbers, patches, affected versions, and reserved tags are directly involved in query optimization, evaluation information can easily leak into the optimization process, making it difficult to objectively reproduce the query results. Therefore, there is a need for an industrial control software vulnerability auditing method that can build traceable evidence around the original alarm, explicitly preserve gaps when evidence is insufficient, and absorb human verification results in a controlled manner. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide an intelligent auditing method, system and medium for industrial control software vulnerabilities, thus solving the deficiencies of the prior art.

[0006] The objective of this invention is achieved through the following technical solution: an intelligent auditing method for vulnerabilities in industrial control software, the method comprising:

[0007] S1. Obtain the fixed version source code of the industrial control software, execute one or more static analyzers on it, and unify the results into a SARIF risk point set.

[0008] S2. Based on the consistency of standardized document paths, line number overlap, method, and source category, locate risk point a to the CPG node. ,by Centered on the alarm path, the expansion extends only along a pre-defined set of allowed edge types E, with the expansion range limited by a finite maximum hop count h. Simultaneously, the set of association methods is determined based on the alarm path location and entry point relationship. And add the nodes to which these methods belong;

[0009] S3. Generate a structured audit record for each risk point according to the selected evidence route, and perform evidence sufficiency judgment and three-state audit on the audit record;

[0010] S4. Submit the two types of decisive records, namely evidence support and evidence rebuttal, to security auditors for source code review. Represent each static analysis query as a query gene g consisting of semantic source, semantic sink, guard, context constraint, and output specification.

[0011] S5. Perform deterministic acceptance testing on candidate changes and generate a vulnerability audit report using the audit records after freeze query and manual review.

[0012] S1 specifically includes:

[0013] For each risk point 'a', save the rule identifier, main location, thread flow location, source file version, and code language, and generate a stable alarm identifier. The risk point is only used as an audit anchor point and is not directly used as a vulnerability label.

[0014] CPGs are generated for different coding languages, preserving their original semantics. C / C++ graphs preserve pointers, boundaries, file or process interfaces, and command-line entry points; Java graphs preserve controller, annotation, service, persistence, and logging relationships; and JavaScript graphs preserve routing, request, middleware, dynamic execution, and configuration relationships.

[0015] Contextual relationships between artifacts in different languages ​​are only recorded when there is verifiable binding evidence, and cross-language relationships based on syntactic proximity, control flow reachability, or speculation are not disguised as data flows that can be controlled by attackers.

[0016] The process of generating structured audit records for each risk point according to the selected evidence route specifically includes:

[0017] Through formula Indicate risk points Audit records ,in, As an entry condition, As a semantic source, For semantics, For the path of evidence, Assemble for the guards. For context constraints, For version prerequisites, For the state of sufficiency of evidence, For the selected evidence route, take the CPG route or the SARIF route;

[0018] CPG routing only allows reference to real nodes and edges in the evidence package, while SARIF routing only allows reference to the original risk point, adjacent thread flow steps, and corresponding source code fragments. Each entry point, source, sink, path, guard, permission, configuration, and version fact that the conclusion depends on is written into a referential stable artifact identifier.

[0019] The aforementioned assessment of the sufficiency of evidence and the three-state audit of audit records include:

[0020] Only when all the facts upon which the conclusion depends are supported by stable procedural artifacts. Only then is it sufficient, and the model is allowed to output supporting or refuting evidence based on audit logs. If any critical security prerequisite is missing, it will output abstention and register the missing entry, protection, permission, configuration, version, or cross-language related prerequisites.

[0021] In routing The following model makes the decision when hour, ,when hour, Where f represents the decision mapping from audit records to supporting or refuting evidence under the condition of sufficient evidence, where, This indicates that the evidence is sufficient. This indicates an abstention.

[0022] The S4 section includes multiple query gene sampling evaluation directions. In comparison, among them, This indicates valid output. This indicates consistency with human corrections. Indicates stability. Let U represent semantic diversity, X represent the abstention rate, X represent the contradiction rate, and K represent complexity. Indicates runtime;

[0023] The model can only propose type-constrained candidate changes—additions, deletions, splits, mergers, retentions, obsolescences, or relaxations—from a pre-registered directory of descriptors based on type feedback. Executable query code must not be directly output, nor may classes, predicates, or interfaces outside the directory be referenced. The deterministic controller compiles the constraint descriptors into the predefined query template, where... This represents the candidate query gene obtained after applying one or more compatible type-constrained changes based on the current query gene g.

[0024] The deterministic acceptance of candidate changes includes:

[0025] Candidate g' is only accepted if it passes pattern verification, descriptor directory verification, compilation, testing, evaluation information isolation, evidence verification, and coverage verification simultaneously. The acceptance criteria are as follows: , where Schema, Catalog, Compile, Tests, Isolation, Evidence, and Coverage represent Boolean tests for schema, catalog, compilation, test, isolation, evidence, and coverage, respectively;

[0026] If any test fails, the system rejects the candidate, retains the original query status, and records the failure stage, descriptor combination, and reason for rejection. Candidates that pass all tests and are rated as non-inferior are entered into the query archive and used for the next round of auditing.

[0027] An intelligent auditing system for industrial control software vulnerabilities includes: a static analysis and risk point standardization module, a CPG generation and language adaptation module, an alarm anchor point and local evidence mapping module, a dual-route evidence package module, an evidence sufficiency auditing module, a manual verification and typified feedback module, a query evolution and deterministic compilation module, and an acceptance and reporting module.

[0028] The static analysis and risk point standardization module: aggregates risk information generated by different static analyzers and forms a unified, traceable audit anchor point;

[0029] The CPG generation and language adaptation module: constructs a program relationship graph that can be used for evidence extraction and preserves the original semantics of different languages;

[0030] The alarm anchor point and local evidence mapping module: locates the SARIF risk point to the specific program location in the CPG and extracts local evidence with a controlled range.

[0031] The dual-route evidence package module retains auditable evidence in both successful and failed CPG mapping scenarios.

[0032] The evidence sufficiency audit module: determines whether the security premises on which the conclusion depends are supported by stable program artifacts and outputs a three-state result;

[0033] The manual verification and typified feedback module: verifies the decisive conclusions and converts manual corrections into constraint information that can be processed by machines;

[0034] The query evolution and deterministic compilation module generates controlled query changes and prevents the model from directly outputting executable query code.

[0035] The acceptance and reporting module verifies query candidates, freezes valid queries, and generates a traceable vulnerability audit report.

[0036] The CPG generation and language adaptation module specifically generates syntax, control flow, calls, control dependencies, defines usage and references through the front-end of each language, registers language-specific edge types and semantic attributes, and records cross-language context relationships only when there are verifiable artifacts in configuration, interface or binding files;

[0037] The alarm anchor point and local evidence mapping module specifically achieves node matching by standardizing file paths, overlapping line numbers, consistency of the method and source category, expanding along the allowed edge type within a limited number of hops with the matching node as the center, while supplementing the associated method node, and recording the mapping confidence, truncation status and failure reason;

[0038] The dual-route evidence package module specifically judges the routing conditions. When the mapping is stable and the local graph is complete, it encapsulates real nodes, real edges, source code locations, entry points, and configuration clues to form a local CPG evidence package. When the mapping is unstable or the critical path is incomplete, it encapsulates rules, locations, thread flows, source code fragments, and original sources to form a SARIF fallback evidence package. The two types of evidence are output using a unified field.

[0039] The evidence sufficiency audit module specifically verifies the entry point, source, sink, path, guard, permission, configuration, and version facts item by item, and binds them to the retrievable workpiece identifier. When the evidence is sufficient, it outputs evidence support or evidence rebuttal; when the evidence is insufficient, it outputs abstention and registers the missing premise.

[0040] The static analysis and risk point standardization module specifically achieves this by calling one or more static analyzers, parsing their SARIF output, unifying file path, rule identifier, main location, thread flow location, code language, and source file version, and generating stable alarm identifiers based on the above fields.

[0041] The manual verification and typified feedback module is implemented by presenting structured audit records to auditors, recording the original conclusions, corrected conclusions, evidence routes and changes in premises, and then encoding the corrected content into typified operations constrained by the schema and descriptor directory.

[0042] The query evolution and deterministic compilation module specifically represents the query as a query gene consisting of semantic source, semantic sink, guard, context constraint and output specification. It restricts the model to only propose candidate operations for adding, deleting, splitting, merging, retaining, discarding or relaxing from the registered descriptor directory. The deterministic controller then performs type checking and compiles the query into a predefined query template.

[0043] The acceptance and reporting module is implemented by sequentially executing the mode, descriptor directory, compilation, testing, evaluation information isolation, evidence and coverage verification, combining the evaluation vector to save non-dominated candidates, rejecting failed candidates and retaining the reasons for failure, freezing the query after reaching the budget or stopping conditions, and then summarizing the three-state conclusions, evidence routing, missing prerequisites and candidate acceptance records according to the stable alarm identifier.

[0044] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of an intelligent auditing method for vulnerabilities in industrial control software.

[0045] The present invention has the following advantages:

[0046] 1. Instead of directly treating static alerts as vulnerability conclusions, it requires that the dependent facts, such as entry point, source, sink, path, guards, permissions, configuration, and version, all have traceable artifacts. This transforms security conclusions from rule hits into evidence-supported claims, reducing the burden of reviewing false alarms caused by a lack of threat premises.

[0047] 2. Only decisive records with sufficient evidence are manually reviewed. Stable alarm indicators, evidence routes, original conclusions, corrected conclusions, and changes in premises are encoded as typified feedback. Queries are represented as query genes consisting of semantic sources, semantic sinks, guards, contextual constraints, and output specifications. The model is restricted to proposing type-constrained changes only from the registration directory. These changes are then compiled into predefined query templates by the deterministic controller, thereby transforming human experience into verifiable rather than arbitrarily generated query modifications.

[0048] 3. For each query candidate, implement schema, descriptor directory, compilation, testing, evaluation information isolation, evidence and coverage verification simultaneously, and save non-dominated candidates by combining effective output, consistency of manual correction, stability, semantic diversity, abstention rate, contradiction rate, complexity and running time; isolate historical vulnerability materials before query freezing, and use them for playback after freezing, and retain the original semantics of each language in multilingual analysis without fabricating cross-language data streams lacking artifact support. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the architecture process of the present invention.

[0050] Figure 2 A flowchart illustrating the dual-certificate routing and three-state audit process.

[0051] Figure 3 A flowchart illustrating the process of generating evolution and audit reports. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of this application provided below with reference to the accompanying drawings is not intended to limit the scope of protection of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application. The present invention will be further described below with reference to the accompanying drawings.

[0053] The technical problem this invention aims to solve is to establish a traceable, verifiable, and controllably evolving vulnerability audit process for industrial control software using languages ​​such as C / C++, Java, and JavaScript, without directly equating raw static alerts with vulnerabilities or allowing models to directly generate executable queries. This process provides scope-controlled and locatable evidence for each risk point, retains the alert source regardless of whether local CPG evidence is available or not, indicates insufficient evidence as abstention or a prerequisite for supplementation, transforms manual verification and correction into query changes with type constraints, compileability, testability, and rollback capability, and isolates historical vulnerability materials from query evolution.

[0054] like Figure 1 As shown, based on the problems addressed above, one embodiment of the present invention relates to an intelligent auditing system for industrial control software vulnerabilities. This system includes a static analysis and risk point standardization module, a CPG generation and language adaptation module, an alarm anchor point and local evidence mapping module, a dual-route evidence package module, an evidence sufficiency auditing module, a manual verification and typified feedback module, a query evolution and deterministic compilation module, and an acceptance and reporting module. Each module transmits information around the same fixed version snapshot and stable alarm identifier; wherein, the model only reads structured records constrained by the evidence contract and proposes typified changes, and the deterministic controller is responsible for verification, compilation, and query execution.

[0055] Furthermore, the functions and specific implementation methods of each module are as follows:

[0056] The function of the static analysis and risk point standardization module is to aggregate risk information generated by different static analyzers and form a unified and traceable audit anchor point;

[0057] Specifically, this is achieved by calling one or more static analyzers, parsing their SARIF output, unifying the file path, rule identifier, main location, thread stream location, code language, and source file version, and generating stable alarm identifiers based on the above fields.

[0058] The function of the CPG (Code Attribute Graph) generation and language adaptation module is to construct a program relationship graph that can be used for evidence extraction while preserving the original semantics of different languages;

[0059] Specifically, this is achieved by generating nodes and edges such as syntax, control flow, invocation, control dependencies, definition, usage, and references in each language frontend, registering language-specific edge types and semantic attributes, and recording cross-language context relationships only when verifiable artifacts such as configuration, interfaces, or binding files exist.

[0060] The function of the alarm anchor point and local evidence mapping module is to locate SARIF risk points to specific program locations in CPG and extract local evidence with controlled scope.

[0061] Specifically, node matching is performed by standardizing file paths, line number overlap, and consistency of the method and source category. The matching node is used as the center to expand along the allowed edge type within a limited number of hops. At the same time, associated method nodes are added, and the mapping confidence, truncation status and failure reason are recorded.

[0062] The dual-route evidence package module retains auditable evidence in both successful and failed CPG mapping scenarios.

[0063] Specifically, the routing conditions are used to determine the evidence. When the mapping is stable and the local graph is complete, the real nodes, real edges, source code locations, entry points, and configuration clues are encapsulated to form a local CPG evidence package. When the mapping is unstable or the critical path is incomplete, the rules, locations, thread flows, source code fragments, and original sources are encapsulated to form a SARIF backoff evidence package. Both types of evidence are output using a unified field.

[0064] The function of the evidence sufficiency audit module is to determine whether the security premises on which the conclusion depends are supported by stable procedural artifacts and output a three-state result;

[0065] Specifically, this is achieved by verifying the entry point, source, rendezvous point, path, guard, permissions, configuration, and version facts item by item, binding them to a retrievable artifact identifier, outputting evidence support or evidence rebuttal when the evidence is sufficient, and outputting abstention and registering the missing premise when the evidence is insufficient.

[0066] The function of the manual verification and typified feedback module is to review the decisive conclusions and convert manual corrections into constraint information that can be processed by machines.

[0067] Specifically, this is achieved by presenting structured audit logs to auditors, recording the original conclusions, corrected conclusions, evidence routing, and changes in premises, and then encoding the corrected content into typed operations constrained by schema and descriptor directories; abstention records remain in an abstention state and are not directly generated as query candidates.

[0068] The query evolution and deterministic compilation module is designed to generate controlled query changes and prevent the model from directly outputting executable query code.

[0069] Specifically, by representing queries as a query gene consisting of semantic sources, semantic sinks, guards, context constraints, and output specifications, the model is restricted to proposing candidate operations such as adding, deleting, splitting, merging, retaining, discarding, or relaxing from the registered descriptor directory. The deterministic controller then performs type checks and compiles the results into a predefined query template.

[0070] The acceptance and reporting module is responsible for verifying query candidates, freezing valid queries, and generating a traceable vulnerability audit report.

[0071] Specifically, this is achieved by sequentially executing the mode, descriptor directory, compilation, testing, evaluation information isolation, evidence and coverage verification, combining evaluation vectors to save non-dominated candidates, rejecting failed candidates and retaining the reasons for failure, freezing queries after reaching the budget or stopping conditions, and then summarizing the three-state conclusions, evidence routing, missing prerequisites and candidate acceptance records according to the stable alarm flag.

[0072] Another embodiment of the present invention relates to an intelligent auditing method for vulnerabilities in industrial control software, specifically including the following:

[0073] S1. Obtain a fixed version of the industrial control software's source code, execute one or more static analyzers on it, and unify the results into a SARIF risk point set. For each risk point... The system saves rule identifiers, main locations, thread flow locations, source file versions, and code languages, and generates stable alert identifiers. Risk points serve only as audit anchors and are not directly used as vulnerability labels. CPGs (Content Processing Groups) retaining the original semantics of different code languages ​​are generated separately; C / C++ graphs retain pointers, boundaries, file or process interfaces, and command-line entry points; Java graphs retain controller, annotation, service, persistence, and logging relationships; and JavaScript graphs retain routing, request, middleware, dynamic execution, and configuration relationships. Contextual relationships between artifacts of different languages ​​are only recorded when verifiable binding evidence exists; cross-language relationships based on syntactic proximity, control flow reachability, or speculation are not disguised as attacker-controllable data flows.

[0074] S2, such as Figure 2 As shown, based on the consistency of standardized file paths, line number overlap, method, and source category, risk point a is located at the CPG node. After successful mapping, with Centered on the alarm path, expansion is limited only along a pre-defined set of edge types E, which includes edges related to parameters, calls, control flow, control dependencies, definition usage, and references, with the expansion range constrained by a finite maximum hop count h. Simultaneously, the set of associated methods is determined based on the alarm path location and entry relationship. And add the nodes to which these methods belong. The set of local evidence nodes corresponding to risk point a. Determine by the following formula:

[0075] (1),

[0076] In the formula, For local evidence nodes, This represents the graph distance calculated only along the edge types in set E. Represents a node The method is defined as follows: h is pre-set to a finite non-negative integer according to the project scale and the context required for auditing, so that local evidence does not expand into an unbounded global graph. For risk points with stable mapping and complete local graphs, a local CPG evidence package is formed, containing real nodes, real edges, source code locations, entry points, configuration clues, and truncation states; for risk points that cannot be stably mapped, whose local graphs are truncated, or whose critical paths cannot be restored, the risk points are not deleted, but instead, a SARIF fallback evidence package is formed that retains the rules, locations, thread flows, source code fragments, and original sources.

[0077] S3. Generate a structured audit record for each risk point according to the selected evidence route. Risk Point Audit records It can be expressed as follows:

[0078] (2),

[0079] In the formula, As an entry condition, As a semantic source, For semantics, For the path of evidence, Assemble for the guards. For context constraints, For version prerequisites, For the state of sufficiency of evidence, The selected evidence is routed using either a CPG route or a SARIF route. CPG routes are only allowed to reference real nodes and edges in the evidence packet; SARIF routes are only allowed to reference the original risk point, adjacent thread flow steps, and corresponding source code fragments. Each entry point, source, sink, path, guard, permission, configuration, and version fact that the conclusion depends on is written to a referential stable artifact identifier.

[0080] S4. Perform an sufficiency of evidence assessment and a three-state audit on the audit records. Only when all facts upon which the conclusion is based are supported by stable procedural artifacts... Only when this is sufficient, and the model (the external inference model called by the system, which can be a pre-trained large language model or other models with structured input inference capabilities) outputs supporting or refuting evidence based on audit logs; if any critical security premise is missing, it outputs abstention and registers the missing entry point, protection, permission, configuration, version, or cross-language related premise. Model Decision In routing Determine using the following formula:

[0081] (3),

[0082] In the formula, This indicates a state of sufficient evidence, meaning that the facts upon which the audit conclusion is based, such as the entry point, source, sink, path, guard, authority, configuration, and version, are all supported by traceable and stable procedural artifacts. This is a prerequisite for the model to output evidence to support or refute it. The "abstention" status indicates that when critical security prerequisites or procedural artifacts are insufficient, the system does not output supporting or refuting evidence. Instead, it retains the existing evidence and registers the missing prerequisites, pending supplementary materials before re-auditing. "f" represents the decision mapping from audit records to supporting or refuting evidence under the condition of sufficient evidence. Abstention records continue to retain existing evidence and missing prerequisites but do not generate accepted query candidates. The mapping and evidence judgment can be re-executed when new procedural artifacts are obtained or audit materials are supplemented.

[0083] S5, such as Figure 3 As shown, two types of decisive records—supporting evidence and rebuttal evidence—are submitted to security auditors for source code review. Controlled verification may be used when necessary, but the verification script is not used as model input. The decision is made after manual review. Determine by the following formula:

[0084] (4),

[0085] In the formula, R represents the manual review mapping, and a different symbol is used to avoid confusion with the maximum number of hops h in formula (1). Manual review only corrects the decisive conclusions, and abstention records remain in the abstention state. For decisive records that have been manually confirmed or corrected, the system encodes the stable alarm identifier, evidence route, original conclusion, corrected conclusion, and query premises that have been established or are still missing into typified feedback, so that the feedback can point back to specific evidence.

[0086] S6. Represent each static analysis query as a current query gene g consisting of a semantic source, semantic sink, guards, context constraints, and output specifications. The model can only propose type-constrained candidate changes from a pre-registered descriptor directory based on type feedback, such as adding, deleting, splitting, merging, retaining, discarding, or relaxing. You must not directly output executable query code, nor may you reference classes, predicates, or interfaces outside the directory. This represents the candidate query genes obtained after applying one or more compatible type-constrained changes based on g. These genes must undergo schema, cataloging, compilation, testing, isolation, evidence, and coverage verification; only after passing acceptance can they be included in the query archive. The deterministic controller compiles the constraint-compliant descriptors into predefined query templates. Multiple query genes are evaluated using the evaluation vector shown below. Compare:

[0087] (5),

[0088] In the formula, This indicates valid output. This indicates consistency with human corrections. Indicates stability. Let U represent semantic diversity, X represent the abstention rate, X represent the contradiction rate, and K represent complexity. This indicates the runtime. The larger the first four values, the better; the latter four values ​​are evaluated with negative values. The system uses this information to store non-dominated query genes, rather than determining the quality of candidates based on the number of single vulnerabilities.

[0089] S7. Perform deterministic acceptance testing on candidate changes. Candidate g' is only acceptable if it simultaneously passes schema validation, descriptor directory validation, compilation, testing, evaluation information isolation, evidence validation, and coverage validation. Its acceptance criteria are expressed by the following formula:

[0090] (6),

[0091] In the formula, The representation and operation are as follows: Schema, Catalog, Compile, Tests, Isolation, Evidence, and Coverage represent Boolean tests for schema, catalog, compilation, testing, isolation, evidence, and coverage, respectively. If any test fails, the system rejects the candidate, retains the original query state, and records the failure stage, descriptor combination, and rejection reason. Candidates that pass all tests and are non-inferiorly evaluated are added to the query archive and used for the next round of auditing. Query evolution is controlled by a preset budget B, which can be determined by the maximum number of iterations, the maximum number of candidates, and the no-improvement patience window. The current query archive is frozen after the budget is reached or the stopping condition is met.

[0092] S8. Generate a vulnerability audit report using the audit logs after frozen queries and manual review. The report lists evidence routes, evidence support, evidence rebuttal or abstention status, referenced artifacts, and missing prerequisites according to stable alarm indicators, and retains records of query candidate acceptance and rejection. Historical vulnerability numbers, patches, affected versions, and reserved evaluation tags must not be included in the model input or candidate generation process during query evolution; they are only used for replay evaluation after the query is frozen, thereby avoiding query optimization driven by known answers.

[0093] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of an intelligent auditing method for vulnerabilities in industrial control software.

[0094] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the method of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0095] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and improvements, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method for intelligent auditing of vulnerabilities in industrial control software, characterized in that: The method includes: S1. Obtain the fixed version source code of the industrial control software, execute one or more static analyzers on it, and unify the results into a SARIF risk point set. S2. Based on the consistency of standardized document paths, line number overlap, method, and source category, locate risk point a to the CPG node. ,by Centered on the alarm path, the expansion extends only along a pre-defined set of allowed edge types E, with the expansion range limited by a finite maximum hop count h. Simultaneously, the set of association methods is determined based on the alarm path location and entry point relationship. And add the nodes to which these methods belong; S3. Generate a structured audit record for each risk point according to the selected evidence route, and perform evidence sufficiency judgment and three-state audit on the audit record; S4. Submit the two types of decisive records, namely evidence support and evidence rebuttal, to security auditors for source code review. Represent each static analysis query as a query gene g consisting of semantic source, semantic sink, guard, context constraint, and output specification. S5. Perform deterministic acceptance testing on candidate changes and generate a vulnerability audit report using the audit records after freeze query and manual review.

2. The intelligent auditing method for industrial control software vulnerabilities according to claim 1, characterized in that: S1 specifically includes: For each risk point 'a', save the rule identifier, main location, thread flow location, source file version, and code language, and generate a stable alarm identifier. The risk point is only used as an audit anchor point and is not directly used as a vulnerability label. CPGs are generated for different coding languages, preserving their original semantics. C / C++ graphs preserve pointers, boundaries, file or process interfaces, and command-line entry points; Java graphs preserve controller, annotation, service, persistence, and logging relationships; and JavaScript graphs preserve routing, request, middleware, dynamic execution, and configuration relationships. Contextual relationships between artifacts in different languages ​​are only recorded when there is verifiable binding evidence, and cross-language relationships based on syntactic proximity, control flow reachability, or speculation are not disguised as data flows that can be controlled by attackers.

3. The intelligent auditing method for industrial control software vulnerabilities according to claim 1, characterized in that: The process of generating structured audit records for each risk point according to the selected evidence route specifically includes: Through formula The audit record indicates risk point a. ,in, As an entry condition, As a semantic source, For semantics, For the path of evidence, Assemble for the guards. For context constraints, For version prerequisites, For the state of sufficiency of evidence, For the selected evidence route, take the CPG route or the SARIF route; CPG routing only allows reference to real nodes and edges in the evidence package, while SARIF routing only allows reference to the original risk point, adjacent thread flow steps, and corresponding source code fragments. Each entry point, source, sink, path, guard, permission, configuration, and version fact that the conclusion depends on is written into a referential stable artifact identifier.

4. The intelligent auditing method for industrial control software vulnerabilities according to claim 3, characterized in that: The aforementioned assessment of the sufficiency of evidence and the three-state audit of audit records include: Only when all the facts upon which the conclusion depends are supported by stable procedural artifacts. Only then is it sufficient, and the model is allowed to output supporting or refuting evidence based on audit logs. If any critical security prerequisite is missing, it will output abstention and register the missing entry, protection, permission, configuration, version, or cross-language related prerequisites. In routing The following model makes the decision when hour, ,when hour, Where f represents the decision mapping from audit records to supporting or refuting evidence under the condition of sufficient evidence, where, This indicates that the evidence is sufficient. This indicates an abstention.

5. The intelligent auditing method for industrial control software vulnerabilities according to claim 1, characterized in that: The S4 section includes multiple query gene sampling evaluation directions. In comparison, among them, This indicates valid output. This indicates consistency with human corrections. Indicates stability. Let U represent semantic diversity, X represent the abstention rate, X represent the contradiction rate, and K represent complexity. Indicates runtime; The model can only propose type-constrained candidate changes—additions, deletions, splits, mergers, retentions, obsolescences, or relaxations—from a pre-registered directory of descriptors based on type feedback. Executable query code must not be directly output, nor may classes, predicates, or interfaces outside the directory be referenced. The deterministic controller compiles the constraint descriptors into the predefined query template, where... This represents the candidate query gene obtained after applying one or more compatible type-constrained changes based on the current query gene g.

6. The intelligent auditing method for industrial control software vulnerabilities according to claim 5, characterized in that: The deterministic acceptance of candidate changes includes: Candidate g' is only accepted if it passes pattern verification, descriptor directory verification, compilation, testing, evaluation information isolation, evidence verification, and coverage verification simultaneously. The acceptance criteria are as follows: Here, Schema, Catalog, Compile, Tests, Isolation, Evidence, and Coverage represent the Boolean tests for schema, catalog, compilation, test, isolation, evidence, and coverage, respectively. AND operation; If any test fails, the system rejects the candidate, retains the original query status, and records the failure stage, descriptor combination, and reason for rejection. Candidates that pass all tests and are rated as non-inferior are entered into the query archive and used for the next round of auditing.

7. An intelligent auditing system for industrial control software vulnerabilities, characterized in that: The system includes: a static analysis and risk point standardization module, a CPG generation and language adaptation module, an alarm anchor point and local evidence mapping module, a dual-route evidence package module, an evidence sufficiency audit module, a manual verification and typified feedback module, a query evolution and deterministic compilation module, and an acceptance and reporting module. The static analysis and risk point standardization module: aggregates risk information generated by different static analyzers and forms a unified, traceable audit anchor point; The CPG generation and language adaptation module: constructs a program relationship graph that can be used for evidence extraction and preserves the original semantics of different languages; The alarm anchor point and local evidence mapping module: locates the SARIF risk point to the specific program location in the CPG and extracts local evidence with a controlled range. The dual-route evidence package module retains auditable evidence in both successful and failed CPG mapping scenarios. The evidence sufficiency audit module: determines whether the security premises on which the conclusion depends are supported by stable program artifacts and outputs a three-state result; The manual verification and typified feedback module: verifies the decisive conclusions and converts manual corrections into constraint information that can be processed by machines; The query evolution and deterministic compilation module generates controlled query changes and prevents the model from directly outputting executable query code. The acceptance and reporting module verifies query candidates, freezes valid queries, and generates a traceable vulnerability audit report.

8. The intelligent auditing system for industrial control software vulnerabilities according to claim 7, characterized in that: The CPG generation and language adaptation module specifically generates syntax, control flow, calls, control dependencies, defines usage and references through the front-end of each language, registers language-specific edge types and semantic attributes, and records cross-language context relationships only when there are verifiable artifacts in configuration, interface or binding files; The alarm anchor point and local evidence mapping module specifically achieves node matching by standardizing file paths, overlapping line numbers, consistency of the method and source category, expanding along the allowed edge type within a limited number of hops with the matching node as the center, while supplementing the associated method node, and recording the mapping confidence, truncation status and failure reason; The dual-route evidence package module specifically judges the routing conditions. When the mapping is stable and the local graph is complete, it encapsulates real nodes, real edges, source code locations, entry points, and configuration clues to form a local CPG evidence package. When the mapping is unstable or the critical path is incomplete, it encapsulates rules, locations, thread flows, source code fragments, and original sources to form a SARIF fallback evidence package. The two types of evidence are output using a unified field. The evidence sufficiency audit module specifically verifies the entry point, source, sink, path, guard, permission, configuration, and version facts item by item, and binds them to the retrievable workpiece identifier. When the evidence is sufficient, it outputs evidence support or evidence rebuttal; when the evidence is insufficient, it outputs abstention and registers the missing premise.

9. The intelligent auditing system for industrial control software vulnerabilities according to claim 7, characterized in that: The static analysis and risk point standardization module specifically achieves this by calling one or more static analyzers, parsing their SARIF output, unifying file path, rule identifier, main location, thread flow location, code language, and source file version, and generating stable alarm identifiers based on the above fields. The manual verification and typified feedback module is implemented by presenting structured audit records to auditors, recording the original conclusions, corrected conclusions, evidence routes and changes in premises, and then encoding the corrected content into typified operations constrained by the schema and descriptor directory. The query evolution and deterministic compilation module specifically represents the query as a query gene consisting of semantic source, semantic sink, guard, context constraint and output specification. It restricts the model to only propose candidate operations for adding, deleting, splitting, merging, retaining, discarding or relaxing from the registered descriptor directory. The deterministic controller then performs type checking and compiles the query into a predefined query template. The acceptance and reporting module is implemented by sequentially executing the mode, descriptor directory, compilation, testing, evaluation information isolation, evidence and coverage verification, combining the evaluation vector to save non-dominated candidates, rejecting failed candidates and retaining the reasons for failure, freezing the query after reaching the budget or stopping conditions, and then summarizing the three-state conclusions, evidence routing, missing prerequisites and candidate acceptance records according to the stable alarm identifier.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the intelligent auditing method for industrial control software vulnerabilities as described in any one of claims 1-6.

Images