24 results about "Code audit" patented technology

The invention relates to an automatic code auditing method and device, computer equipment and a storage medium. The automatic code auditing method comprises the steps of obtaining a grammar structure, a control flow and a data flow of a to-be-audited code; constructing a context graph of the to-be-audited code according to the grammatical structure, the control flow and the data flow of the to-be-audited code; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path, a large model reasoning method based on semantic understanding and weights of the methods; and identifying one or more code vulnerabilities, the vulnerability type of each code vulnerability and the confidence coefficient according to the context graph of the to-be-audited code and the multi-modal collaborative vulnerability detection method. According to the method, the audit codes of various vulnerability types can be processed while the code audit efficiency can be improved.

The invention provides a business code auditing method, belongs to the field of large model application, and can be used in the field of information security, the field of big data and the technical field of artificial intelligence. The method comprises the following steps: acquiring target business information and a target business code; performing preliminary scanning on the target business code to obtain a first analysis result; based on the first analysis result and the target service information, performing service logic analysis by using a service code auditing model to obtain a second analysis result; and verifying the first analysis result based on the second analysis result, and generating a business code auditing result based on the second analysis result and a verification result.

The invention relates to the technical field of code auditing, and discloses a code auditing method and system, and the method comprises the steps: based on code data uploaded by a user, analyzing an initial risk point fixed point, carrying out the operation simulation based on an initial risk positioning point, generating simulation execution path data, carrying out the potential path risk simulation, obtaining an extended risk point set, and carrying out the code auditing. Performing verification during actual operation on the extended risk point set, generating a dynamic verification result, performing cross comparison on the result and the initial risk positioning point set, generating a verified risk vulnerability list, performing vulnerability association analysis in combination with service logic and data flow context, generating associated vulnerability data, and performing code repair. According to the code auditing method and the code auditing device, the code auditing efficiency and the code auditing accuracy can be improved.

The invention belongs to the technical field of software engineering, and particularly relates to a quick code repairing method for lightweight compressed context generation. According to the method, efficient repair is realized by constructing a'retrieval-compression-generation 'collaborative architecture; comprising the following steps: constructing a cross-file code retrieval database, designing a lightweight semantic compression encoder (SCE), and compressing retrieved cross-file code blocks into short tokens with high semantic density; semantic compatibility with a large language model (LLM) is realized through a two-stage training strategy; wherein in the semantic alignment stage, the SCE is trained so that the compression token can be accurately analyzed by the LLM, and in the task alignment stage, the LLM is finely adjusted so that the compression token can be utilized to complete repair. Experiments show that on the premise that key logic dependence is reserved, the reasoning efficiency of the model can be improved, the code repairing effect is guaranteed, the method is suitable for cross-file dependence repairing scenes of a large code warehouse and can be integrated into integrated development environment plug-ins, automatic code auditing tools and the like, and the software development and maintenance efficiency is remarkably improved.

The invention discloses a segmentation method based on modification point context extraction. The segmentation method comprises the steps that a local code management tool code warehouse is pulled, cleaned and updated through a code management tool based on a remote code warehouse; based on the local incremental code, a target file is obtained through submission triggering analysis, splitting and merging, the target file comprises modification point data, the modification point data at least comprises modification types, modification information and code blocks, and the modification types at least comprise deletion, addition, modification and maintenance; based on the target file, obtaining an abstract syntax tree by identifying a language type; based on the abstract syntax tree, obtaining a simplified file set, data of the simplified file set and the modification points through segmentation and simplification, wherein the simplified file set is used for code auditing, code merging and code reviewing; and based on each sub-file of the simplified file set, deciding to write or merge the sub-files independently by judging the token.

The application relates to an automatic code auditing method and device, computer equipment and a storage medium, comprising the following steps: obtaining the syntax structure, control flow and data flow of a code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path and a large model reasoning method based on semantic understanding, and the weights of the methods; and identifying one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The method can improve the code auditing efficiency and process auditing codes of various vulnerability types.

The present invention relates to a method and system for auditing smart contract code using a large language model based on retrieval-enhanced generation and step-back prompt words. The method comprises: slicing the smart contract code to be audited and inputting it into an embedding model, calculating the cosine similarity between feature vectors and outputting a set of similar feature vectors; using retrieval-enhanced generation technology to obtain historical audit cases; identifying security risk points through a large language model to obtain a set of risk points; using the large language model using a step-back prompt word method to calculate an audit result set, and generating an audit report based on the audit result set. By slicing the smart contract code into logical units and utilizing the powerful capabilities of the large language model, potential risks can be more accurately identified and analyzed, thereby improving the security and reliability of the smart contract; combined with the step-back prompt word technology, the audit efficiency and accuracy are significantly improved, providing comprehensive security protection for the development and application of smart contracts.

The embodiment of the application provides a kind of big model safety detection and code audit method, belong to big model technical field.The method includes: the safety specification data of electric power industry is collected, and the code data about electric power industry is collected, to build safety evaluation set and code specification constraint library, the safety evaluation set includes evaluation problem subset and corresponding standard answer subset and code problem subset;Obtain evaluation problem subset request and corresponding code request, and enter corresponding detection channel based on request type;According to evaluation problem subset request, the content of corresponding evaluation problem subset is sent into big model safety detection channel, obtains big model generation result subset, and evaluates generation result subset according to the standard answer subset obtained.The method can carry out text safety detection and code audit.

The application discloses a code intelligent analysis and auditing system and method based on a large language model, and belongs to the technical field of software engineering and artificial intelligence. The system comprises a front-end display layer, a core business processing layer and a data persistence layer. The core business processing layer is provided with a multi-source project obtainer, an intelligent code auditing engine, a multi-model collaborative scheduling and fusion engine and a task scheduler. The method imports code through the multi-source project obtainer, utilizes the multi-model collaborative scheduling and fusion engine to schedule multiple large language models in parallel to analyze code units and fuse results, and stores the results after multi-dimensional auditing by the intelligent code auditing engine. The application solves the problems of insufficient semantic understanding of traditional tools and low accuracy of general large models in specific project analysis, effectively improves the accuracy, efficiency and automation level of code auditing, and supports the generation of professional auditing reports.

The invention relates to a compliance code auditing method and device and computer equipment. The method comprises the following steps: receiving a code database and a scanning rule file; the code database is obtained based on a to-be-audited source code; the scanning rule file is obtained based on a general defect enumeration database; generating a configuration file based on the code database and the path of the scanning rule file; based on the configuration file, running a code auditing tool so as to utilize the scanning rule file to audit a vulnerability item corresponding to the code database, and outputting an auditing result; and generating a structured audit report based on the audit result, thereby solving the problems of low efficiency and non-standardization of traditional manual line-by-line audit, outputting a unified audit report based on a set of standardized process, automatically calling an automatic tool, efficiently detecting vulnerabilities, standardizing the vulnerability detection standard through a general defect enumeration database, and improving the audit efficiency. The coverage rate and authority of vulnerability detection are ensured, and the auditing speed and quality are greatly improved.

The application discloses a code submission method and device, electronic equipment and computer program product, and relates to the technical field of computers.The method comprises the following steps: in response to a code submission operation of a first branch, a first audit request is sent to a code audit system; a modification difference file of a first audit identifier is obtained according to the first audit identifier generated by the code audit system based on the first audit request; after the audit result of the first audit identifier returned by the code audit system is passed, code modification description information of the first audit identifier is obtained; and based on the code modification description information, the first audit identifier and branch information of the first branch, submission information of the first branch is generated; and at least one of the modification difference file and a target code file and the submission information of the first branch are submitted to the first branch in a code repository.The application solves the technical problem that redundant manual operation exists when a code file is submitted in the related art, resulting in low submission efficiency.

A code privacy-preserving inference method and apparatus based on model segmentation and random activation, wherein the method includes the following steps: Step 1, segmenting the original code audit model into an original client and a server; Step 2, expanding the feedforward neural network of the Transformer block inside the original client to generate a pseudo client; Step 3, establishing a key authentication mechanism on the pseudo client; if key authentication is successful, the expanded neuron part automatically does not participate in the processing of input data, and the pseudo client automatically transforms into a client; if key authentication fails, the pseudo client randomly activates the expanded neuron part according to a random activation strategy; Step 4, establishing an encrypted channel connection mechanism between the pseudo client and the server. This invention can greatly defend against member inference attacks and inversion reconstruction attacks, while not affecting the model performance during normal user use.

The application discloses an application method of DevOps pipeline business code auditing, belongs to the technical field of business code auditing, and comprises a code auditing system composed of a code warehouse unit, a design management unit, an LLM code auditing unit and an auditing auxiliary unit, wherein the design management unit is composed of a design management module and a rule engine. In the code architecture process, the application is combined based on the LLM model and the rule engine, the code auditing efficiency and the auditing quality can be greatly improved, in the auditing process, the auditing code efficiency and the auditing quality can be improved through the agent auditing of the LLM auditing module, the auditing labor cost and the time cost are greatly reduced, the problems and the modification suggestions of the code are directly marked on specific code lines or code blocks through the LLM code auditing unit, the developer can confirm and complete the problem corresponding to the modification suggestion by referring to the modification suggestion step by step, and the problem solving efficiency is greatly improved.

The invention discloses a data circulation application management and control method for blocking a trusted data space based on code auditing and driving, relates to the technical field of data processing, and can improve the security of data circulation application management and control of the trusted data space. The method comprises the following steps: receiving a program source code submitted by a data user through a trusted data space client, performing automatic access code auditing, and recording an auditing log of the program source code passing the auditing; test data is extracted in advance for auditing, an operation list is formed for matching analysis with a contract rule, and processing logic is verified in real time through sampling data comparison in subsequent actual operation, so that violation behaviors are intercepted in time, full-process coverage from code auditing to management and control during operation is formed, and the efficiency is improved. And the security of data circulation application management and control of the trusted data space is improved.

The invention provides a code vulnerability detection method and device, a storage medium and electronic equipment, and relates to the technical field of artificial intelligence, and the method comprises the steps: extracting corresponding input code data from code auditing input streams of all dimensions, and carrying out the preprocessing to generate a code attribute graph; performing vulnerability reasoning on the code attribute graph by adopting a double-engine dynamic routing mode, and dynamically selecting a first detection model or a second detection model to execute detection according to the confidence coefficient of a vulnerability reasoning result; automatically labeling the vulnerability detection result based on feedback information of a developer on the vulnerability detection result, and screening effective labeled data to form an incremental training candidate set; automatically synthesizing a sample with a vulnerability code and corresponding labeling information based on user configuration parameters, and supplementing the synthesized sample to a training sample library; and based on the incremental training candidate set and the supplemented training sample library, periodically updating model parameters of the first detection model and the second detection model by adopting an incremental fine tuning technology. The vulnerability detection precision can be improved.

The application relates to the technical field of blockchain code auditing, and discloses a code auditing system based on a blockchain. The system comprises three modules, namely, an auditing feature extraction module, a vulnerability feature disambiguation module and a risk path analysis module. When the storage capacity of a target code repository reaches a preset threshold, the auditing feature extraction module calls a blockchain node to obtain a version snapshot, and extracts a code structure and a security attribute feature set; the vulnerability feature disambiguation module separates a to-be-verified vulnerability feature sequence from the code structure feature set, searches a candidate item set according to a vulnerability knowledge base, inputs a multi-level semantic decoupling model to generate a disambiguation vulnerability feature set; and the risk path analysis module constructs an auditing risk vector according to the security attribute and the disambiguation vulnerability feature set, and labels conflict and consistent path feature partition tags. The system guarantees data reliability by means of a blockchain, optimizes an auditing process by means of multi-module cooperation, and provides strong support for software system security auditing.

This invention discloses a source code security analysis and vulnerability verification system based on an AI-powered automated detection engine, relating to the field of application security. The system includes a candidate vulnerability extraction module, a decompilation and path extraction module, an AI-powered judgment module, a sensitive data de-identification module, an interface reasoning module, a verification request construction module, an active detection module, and a multi-dimensional judgment module. These modules work collaboratively, relying on the AI-powered automated detection engine to construct a fully automated closed loop. The AI-powered judgment module uses a large language model with code understanding, semantic reasoning, and text generation capabilities as its core reasoning unit, deeply participating in the entire process of source code security analysis and vulnerability verification. Combined with functions such as JAR decompilation, path extraction, sensitive data de-identification, and multi-dimensional evidence constraints, it achieves automated verification from candidate risks to real vulnerabilities. This system solves the problems of high false positives, reliance on manual labor, and low automation in traditional code auditing. It possesses advantages such as high accuracy, high automation, wide applicability, and data security compliance, upgrading traditional code detection into a highly reliable and automated source code security analysis and vulnerability verification system, meeting the current technical needs of the source code security detection field. This invention also discloses the method and computer configuration applied to this system.

The invention relates to the technical field of block chain code auditing, and discloses a code auditing system based on a block chain. The system comprises an audit feature extraction module, a vulnerability feature disambiguation module and a risk path analysis module. When the storage capacity of the target code warehouse reaches a preset threshold value, an audit feature extraction module calls a block chain node to obtain a version snapshot, and extracts a code structure and a security attribute feature set; a vulnerability feature disambiguation module separates a to-be-verified vulnerability feature sequence from the code structure feature set, retrieves a candidate entry set according to a vulnerability knowledge base, and inputs a multi-level semantic decoupling model to generate a disambiguation vulnerability feature set; and the risk path analysis module constructs an audit risk vector and marks conflicting and consistent path feature partition tags according to the security attributes and the disambiguation vulnerability feature set. According to the system, data reliability is guaranteed by means of the block chain, the auditing process is optimized by means of multi-module cooperation, and powerful support is provided for software system security auditing.

The invention relates to the technical field of information security maintenance, and particularly discloses a horizontal unauthorized security vulnerability code auditing method and device, equipment and a storage medium. According to the method, automatic mining of horizontal unauthorized vulnerabilities is realized through code preprocessing, code analysis and multi-agent collaborative auditing, the to-be-audited code is analyzed to generate the target data set, so that a large model can quickly and accurately read the code, the code auditing efficiency is improved, and the user experience is improved. Cooperative auditing is carried out on the to-be-audited codes through the agents of the large model, and the accuracy of the auditing result is improved. The method is applied to financial systems such as transactions, bank accounts and the like and medical systems such as medical record management, patient information and the like, the level unauthorized vulnerabilities can be quickly and accurately recognized, the vulnerability solving efficiency is improved, and the system stability and safety are maintained.

The application provides an Angular framework code auditing method, an electronic device, a storage medium and a program product, and relates to the technical field of security. The method divides source code into semantic code units with complete context by using Angular framework syntax features, which can effectively improve the understanding ability of a large language model for framework-specific logic and avoid missing detection of semantics such as decorators and dependency injection by general tools. Meanwhile, based on the dynamic retrieval of a rule knowledge base according to a user-specified auditing dimension label, accurate matching of auditing rules and auditing intentions is achieved, and then accurate auditing of code is performed by a large language model based on a target auditing rule set.

This invention discloses a cross-language source code auditing method based on deep learning, belonging to the interdisciplinary fields of software security and artificial intelligence. This invention standardizes variable definitions, sensitive operations, and data flow paths in multi-language source code to construct a unified abstract expression, and combines this with natural language templates to complete structured transcription, thereby eliminating language differences and achieving unified analysis of mixed C / C++, Java, and Python projects. The transcription results are integrated with a large language model, utilizing a multi-layered prompting mechanism to enhance the model's semantic understanding and contextual reasoning capabilities, improving the detection effect of complex vulnerabilities such as deep data flow dependencies and sensitive path propagation. Simultaneously, a semantic equivalence test set is used to verify the consistency of multi-language analysis results, and the template and prompting strategy are automatically optimized when the deviation exceeds a threshold, giving the system good stability and adaptability.

A system for continuous contextual policy-aware vulnerability mapping, security posture determination and attack planning and simulation, comprising an indexing service configured to create a dataset by processing and indexing source code of a project by a developer, perform a code audit on the indexed source code, store results from the code audit in the dataset, gather additional information relating to the provided project as intended and as operated, store the additional information in the dataset, and store the dataset into memory; and a monitoring service configured to continuously monitor the project for source code and operational changes and performance and make changes to the dataset as needed.

The application provides a code audit vulnerability knowledge graph construction and correlation analysis method, relates to the technical field of security vulnerability detection, S1: based on the device history, a dynamic normal knowledge graph is constructed, when the current behavior deviates, the first data is generated; S2: based on the global topology, a predictive attack path knowledge graph is constructed, including attack path probability, constituting the second data; S3: the first data and the second data are fused, and an indication signal is generated by calculating through a probability fusion model; S4: based on the indication signal exceeding the confirmation threshold, a control instruction is generated; S5: the instruction is executed, the attack probability of the second data is updated, and the prospective defense for the next target is executed; the abnormal behavior evidence and the attack intention context are fused by using the probability fusion model, so that the attack confirmation signal is generated, and the prospective defense action and the adaptive update of the knowledge graph are driven based on the attack confirmation signal.