36 results about "Code audit" patented technology

The invention belongs to the field of fuzz testing, and discloses an industrial control protocol fuzz testing method and system based on a large language model, and the method comprises the steps: obtaining a protocol document, a to-be-tested protocol code, and a protocol sample; analyzing the protocol document based on a large language model to obtain protocol analysis information; performing vulnerability extraction on the protocol sample with the vulnerability information based on a large language model to obtain a plurality of vulnerability documents; based on the retrieval enhancement generation framework, retrieving an external knowledge base by adopting the query statement and the protocol analysis information to generate an enriched initial seed set; performing code auditing on the protocol code to be tested based on the large language model to obtain a vulnerability code of the protocol code, and performing instrumentation on the vulnerability code of the protocol code to obtain an instrumented code; mutation is conducted on the input seeds based on a preset seed energy distribution rule, and fuzzy testing is conducted on the instrumentation codes based on the input seeds subjected to mutation. According to the invention, the probability and speed of generating abnormity in fuzzy testing are improved.

The invention relates to a large language model intelligent contract code auditing method and system based on retrieval enhancement generation and back one-step prompt words. The method comprises the steps of performing block processing on a to-be-audited smart contract code, inputting the block processing into an embedding model, calculating cosine similarity between feature vectors, and outputting a similar feature vector set; obtaining a historical audit case by adopting a retrieval enhancement generation technology; identifying security risk points through a large language model to obtain a risk point set; the large language model adopts a one-step prompt word backing method to calculate and obtain an audit result set, and an audit report is generated according to the audit result set. According to the method, intelligent contract codes are segmented and subdivided into logic units, and potential risks can be identified and analyzed more accurately by using the powerful capability of a large language model, so that the safety and reliability of the intelligent contract are improved; and in combination with a backward one-step prompt word technology, the auditing efficiency and accuracy are remarkably improved, and a comprehensive security guarantee is provided for development and application of the smart contract.

The invention relates to an automatic code auditing method and device, computer equipment and a storage medium. The automatic code auditing method comprises the steps of obtaining a grammar structure, a control flow and a data flow of a to-be-audited code; constructing a context graph of the to-be-audited code according to the grammatical structure, the control flow and the data flow of the to-be-audited code; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path, a large model reasoning method based on semantic understanding and weights of the methods; and identifying one or more code vulnerabilities, the vulnerability type of each code vulnerability and the confidence coefficient according to the context graph of the to-be-audited code and the multi-modal collaborative vulnerability detection method. According to the method, the audit codes of various vulnerability types can be processed while the code audit efficiency can be improved.

The invention is suitable for the field of code auditing, and discloses a large-scale project code library code auditing method and tool, and the method comprises the steps: screening out a first vulnerability rule used for auditing operation from a preset basic vulnerability rule library, and screening out a second vulnerability rule used for auditing operation from a preset user-defined vulnerability rule library; combining the screened first vulnerability rule and the second vulnerability rule into an audit rule set; searching codes in the large-scale project code library by using the auditing rule set to obtain potential vulnerability codes; the potential vulnerability codes are compared with audited codes in a preset auditing historical database, if the potential vulnerability codes are repeated with the audited codes, the potential vulnerability codes are skipped, and if the potential vulnerability codes are not repeated with the audited codes, the potential vulnerability codes are marked as to-be-audited codes; and after the audit operation of the to-be-audited code is completed, the audit result is stored in the audit historical database, so that the audit efficiency and the audit depth can be effectively improved.

The invention provides a business code auditing method, belongs to the field of large model application, and can be used in the field of information security, the field of big data and the technical field of artificial intelligence. The method comprises the following steps: acquiring target business information and a target business code; performing preliminary scanning on the target business code to obtain a first analysis result; based on the first analysis result and the target service information, performing service logic analysis by using a service code auditing model to obtain a second analysis result; and verifying the first analysis result based on the second analysis result, and generating a business code auditing result based on the second analysis result and a verification result.

The invention relates to the technical field of code auditing, and discloses a code auditing method and system, and the method comprises the steps: based on code data uploaded by a user, analyzing an initial risk point fixed point, carrying out the operation simulation based on an initial risk positioning point, generating simulation execution path data, carrying out the potential path risk simulation, obtaining an extended risk point set, and carrying out the code auditing. Performing verification during actual operation on the extended risk point set, generating a dynamic verification result, performing cross comparison on the result and the initial risk positioning point set, generating a verified risk vulnerability list, performing vulnerability association analysis in combination with service logic and data flow context, generating associated vulnerability data, and performing code repair. According to the code auditing method and the code auditing device, the code auditing efficiency and the code auditing accuracy can be improved.

The invention provides a code auditing method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of auditing. The method is applied to auditing equipment, and comprises the following steps: acquiring an LLM; obtaining N to-be-audited code modules belonging to the same business logic, wherein N is an integer greater than 1; and according to the LLM, auditing the N code modules to be audited to obtain an auditing result, the auditing result comprising the location, the type and the modification suggestion of the vulnerability. Compared with manual code auditing, the mode has the advantages that the auditing efficiency is higher, the requirement for auditing personnel is low, and the coverage rate of the auditing result on vulnerabilities in the codes is high. The LLM is used for auditing the codes, modification suggestions for the audited vulnerabilities can be directly output, and code modification work can be completed more quickly.

The invention belongs to the technical field of software engineering, and particularly relates to a quick code repairing method for lightweight compressed context generation. According to the method, efficient repair is realized by constructing a'retrieval-compression-generation 'collaborative architecture; comprising the following steps: constructing a cross-file code retrieval database, designing a lightweight semantic compression encoder (SCE), and compressing retrieved cross-file code blocks into short tokens with high semantic density; semantic compatibility with a large language model (LLM) is realized through a two-stage training strategy; wherein in the semantic alignment stage, the SCE is trained so that the compression token can be accurately analyzed by the LLM, and in the task alignment stage, the LLM is finely adjusted so that the compression token can be utilized to complete repair. Experiments show that on the premise that key logic dependence is reserved, the reasoning efficiency of the model can be improved, the code repairing effect is guaranteed, the method is suitable for cross-file dependence repairing scenes of a large code warehouse and can be integrated into integrated development environment plug-ins, automatic code auditing tools and the like, and the software development and maintenance efficiency is remarkably improved.

The invention discloses a segmentation method based on modification point context extraction. The segmentation method comprises the steps that a local code management tool code warehouse is pulled, cleaned and updated through a code management tool based on a remote code warehouse; based on the local incremental code, a target file is obtained through submission triggering analysis, splitting and merging, the target file comprises modification point data, the modification point data at least comprises modification types, modification information and code blocks, and the modification types at least comprise deletion, addition, modification and maintenance; based on the target file, obtaining an abstract syntax tree by identifying a language type; based on the abstract syntax tree, obtaining a simplified file set, data of the simplified file set and the modification points through segmentation and simplification, wherein the simplified file set is used for code auditing, code merging and code reviewing; and based on each sub-file of the simplified file set, deciding to write or merge the sub-files independently by judging the token.

The application relates to an automatic code auditing method and device, computer equipment and a storage medium, comprising the following steps: obtaining the syntax structure, control flow and data flow of a code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path and a large model reasoning method based on semantic understanding, and the weights of the methods; and identifying one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The method can improve the code auditing efficiency and process auditing codes of various vulnerability types.

The present invention relates to a method and system for auditing smart contract code using a large language model based on retrieval-enhanced generation and step-back prompt words. The method comprises: slicing the smart contract code to be audited and inputting it into an embedding model, calculating the cosine similarity between feature vectors and outputting a set of similar feature vectors; using retrieval-enhanced generation technology to obtain historical audit cases; identifying security risk points through a large language model to obtain a set of risk points; using the large language model using a step-back prompt word method to calculate an audit result set, and generating an audit report based on the audit result set. By slicing the smart contract code into logical units and utilizing the powerful capabilities of the large language model, potential risks can be more accurately identified and analyzed, thereby improving the security and reliability of the smart contract; combined with the step-back prompt word technology, the audit efficiency and accuracy are significantly improved, providing comprehensive security protection for the development and application of smart contracts.

The embodiment of the application provides a kind of big model safety detection and code audit method, belong to big model technical field.The method includes: the safety specification data of electric power industry is collected, and the code data about electric power industry is collected, to build safety evaluation set and code specification constraint library, the safety evaluation set includes evaluation problem subset and corresponding standard answer subset and code problem subset;Obtain evaluation problem subset request and corresponding code request, and enter corresponding detection channel based on request type;According to evaluation problem subset request, the content of corresponding evaluation problem subset is sent into big model safety detection channel, obtains big model generation result subset, and evaluates generation result subset according to the standard answer subset obtained.The method can carry out text safety detection and code audit.

The application discloses a code intelligent analysis and auditing system and method based on a large language model, and belongs to the technical field of software engineering and artificial intelligence. The system comprises a front-end display layer, a core business processing layer and a data persistence layer. The core business processing layer is provided with a multi-source project obtainer, an intelligent code auditing engine, a multi-model collaborative scheduling and fusion engine and a task scheduler. The method imports code through the multi-source project obtainer, utilizes the multi-model collaborative scheduling and fusion engine to schedule multiple large language models in parallel to analyze code units and fuse results, and stores the results after multi-dimensional auditing by the intelligent code auditing engine. The application solves the problems of insufficient semantic understanding of traditional tools and low accuracy of general large models in specific project analysis, effectively improves the accuracy, efficiency and automation level of code auditing, and supports the generation of professional auditing reports.

The present invention discloses a code audit security enhancement method and system based on the assistance of an external camera, and relates to the field of network security technology. The code audit security enhancement method and system based on the assistance of an external camera obtains the developer's code audit video stream through an external camera, combines the target detection algorithm to identify the code area and extract the audit security features. At the same time, the historical modification records of the code and the developer's behavior are analyzed, the sensitivity and risk exposure of the code area are evaluated, and the code audit risk index is obtained. The system determines the risk level of the code area, and focuses on the review of the code segment through color marking and visual display. The method effectively improves the security of code audits, helps developers prioritize the identification and review of high-risk code segments, thereby enhancing code quality and network security.

The invention relates to a compliance code auditing method and device and computer equipment. The method comprises the following steps: receiving a code database and a scanning rule file; the code database is obtained based on a to-be-audited source code; the scanning rule file is obtained based on a general defect enumeration database; generating a configuration file based on the code database and the path of the scanning rule file; based on the configuration file, running a code auditing tool so as to utilize the scanning rule file to audit a vulnerability item corresponding to the code database, and outputting an auditing result; and generating a structured audit report based on the audit result, thereby solving the problems of low efficiency and non-standardization of traditional manual line-by-line audit, outputting a unified audit report based on a set of standardized process, automatically calling an automatic tool, efficiently detecting vulnerabilities, standardizing the vulnerability detection standard through a general defect enumeration database, and improving the audit efficiency. The coverage rate and authority of vulnerability detection are ensured, and the auditing speed and quality are greatly improved.

The application discloses a code submission method and device, electronic equipment and computer program product, and relates to the technical field of computers.The method comprises the following steps: in response to a code submission operation of a first branch, a first audit request is sent to a code audit system; a modification difference file of a first audit identifier is obtained according to the first audit identifier generated by the code audit system based on the first audit request; after the audit result of the first audit identifier returned by the code audit system is passed, code modification description information of the first audit identifier is obtained; and based on the code modification description information, the first audit identifier and branch information of the first branch, submission information of the first branch is generated; and at least one of the modification difference file and a target code file and the submission information of the first branch are submitted to the first branch in a code repository.The application solves the technical problem that redundant manual operation exists when a code file is submitted in the related art, resulting in low submission efficiency.

A code privacy-preserving inference method and apparatus based on model segmentation and random activation, wherein the method includes the following steps: Step 1, segmenting the original code audit model into an original client and a server; Step 2, expanding the feedforward neural network of the Transformer block inside the original client to generate a pseudo client; Step 3, establishing a key authentication mechanism on the pseudo client; if key authentication is successful, the expanded neuron part automatically does not participate in the processing of input data, and the pseudo client automatically transforms into a client; if key authentication fails, the pseudo client randomly activates the expanded neuron part according to a random activation strategy; Step 4, establishing an encrypted channel connection mechanism between the pseudo client and the server. This invention can greatly defend against member inference attacks and inversion reconstruction attacks, while not affecting the model performance during normal user use.

The invention discloses an application method of DevOps pipeline business code auditing, and belongs to the technical field of business code auditing, the application method comprises a code auditing system composed of a code warehouse unit, a design management unit, an LLM code auditing unit and an auditing auxiliary unit, and the design management unit is composed of a design management module and a rule engine. According to the method, combined application is carried out based on the LLM model and the rule engine in the code architecture process, the auditing code efficiency and auditing quality can be greatly improved, the auditing code efficiency and auditing quality can be improved through proxy auditing of the LLM auditing module in the auditing process, the auditing labor cost and the auditing time cost are greatly reduced, and the auditing efficiency and the auditing quality are improved. And the LLM code auditing unit is used for directly marking problems and modification suggestions of the codes to specific code lines or code blocks, developers can confirm the problems and the modification suggestions step by step one by one and complete problem correspondence by referring to the modification suggestions, and the problem solving efficiency is also greatly improved.

The application discloses an application method of DevOps pipeline business code auditing, belongs to the technical field of business code auditing, and comprises a code auditing system composed of a code warehouse unit, a design management unit, an LLM code auditing unit and an auditing auxiliary unit, wherein the design management unit is composed of a design management module and a rule engine. In the code architecture process, the application is combined based on the LLM model and the rule engine, the code auditing efficiency and the auditing quality can be greatly improved, in the auditing process, the auditing code efficiency and the auditing quality can be improved through the agent auditing of the LLM auditing module, the auditing labor cost and the time cost are greatly reduced, the problems and the modification suggestions of the code are directly marked on specific code lines or code blocks through the LLM code auditing unit, the developer can confirm and complete the problem corresponding to the modification suggestion by referring to the modification suggestion step by step, and the problem solving efficiency is greatly improved.

The invention relates to the technical field of code security, and particularly provides a code auditing method, a storage medium, electronic equipment and a product, and the method comprises the steps: auditing a source code in to-be-audited code information when it is confirmed that the to-be-audited code information submitted this time needs to be audited, and obtaining a first auditing result; the current revised version number in the code information to be audited is compared with a revised version corresponding to a preset revised version number, difference data is generated, and the difference data comprises a difference code containing the first audit result, a patch file and a routing address; obtaining a second audit result after the difference data is artificially audited; and generating a code auditing report of the to-be-audited code information at least based on the first auditing result and the second auditing result. Some embodiments of the application can improve the efficiency and quality of code auditing.

The invention discloses a code auditing security enhancement method and system based on assistance of an external camera, and relates to the technical field of network security. According to the code auditing security enhancement method and system based on the assistance of the plug-in camera, a code auditing video stream of a developer is obtained through the plug-in camera, and a code area is identified and auditing security features are extracted in combination with a target detection algorithm. Meanwhile, historical modification records of codes and developer behaviors are analyzed, the sensitivity and risk exposure of code areas are evaluated, and code audit risk indexes are obtained. And the system judges the risk level of the code area, and key review code segments are marked and visually displayed through colors. According to the method, the security of code auditing is effectively improved, and developers are helped to preferentially identify and review high-risk code segments, so that the code quality and the network security are enhanced.

The invention discloses a data circulation application management and control method for blocking a trusted data space based on code auditing and driving, relates to the technical field of data processing, and can improve the security of data circulation application management and control of the trusted data space. The method comprises the following steps: receiving a program source code submitted by a data user through a trusted data space client, performing automatic access code auditing, and recording an auditing log of the program source code passing the auditing; test data is extracted in advance for auditing, an operation list is formed for matching analysis with a contract rule, and processing logic is verified in real time through sampling data comparison in subsequent actual operation, so that violation behaviors are intercepted in time, full-process coverage from code auditing to management and control during operation is formed, and the efficiency is improved. And the security of data circulation application management and control of the trusted data space is improved.

The invention discloses an automatic code auditing method and system, and the method comprises the steps: determining a to-be-audited code, carrying out the data scanning operation of the to-be-audited code, and obtaining a data scanning result; wherein the data scanning result comprises a plurality of code data; analyzing the data scanning result to obtain a data analysis result; and based on a predetermined automatic auditing tool, executing a code auditing operation on the data analysis result to obtain a code auditing result corresponding to the to-be-audited code. It can be seen that automatic code auditing can be achieved, the intelligence and efficiency of code auditing can be improved, and the accuracy and reliability of code auditing can be further improved.

The invention provides a code vulnerability detection method and device, a storage medium and electronic equipment, and relates to the technical field of artificial intelligence, and the method comprises the steps: extracting corresponding input code data from code auditing input streams of all dimensions, and carrying out the preprocessing to generate a code attribute graph; performing vulnerability reasoning on the code attribute graph by adopting a double-engine dynamic routing mode, and dynamically selecting a first detection model or a second detection model to execute detection according to the confidence coefficient of a vulnerability reasoning result; automatically labeling the vulnerability detection result based on feedback information of a developer on the vulnerability detection result, and screening effective labeled data to form an incremental training candidate set; automatically synthesizing a sample with a vulnerability code and corresponding labeling information based on user configuration parameters, and supplementing the synthesized sample to a training sample library; and based on the incremental training candidate set and the supplemented training sample library, periodically updating model parameters of the first detection model and the second detection model by adopting an incremental fine tuning technology. The vulnerability detection precision can be improved.

The application relates to the technical field of blockchain code auditing, and discloses a code auditing system based on a blockchain. The system comprises three modules, namely, an auditing feature extraction module, a vulnerability feature disambiguation module and a risk path analysis module. When the storage capacity of a target code repository reaches a preset threshold, the auditing feature extraction module calls a blockchain node to obtain a version snapshot, and extracts a code structure and a security attribute feature set; the vulnerability feature disambiguation module separates a to-be-verified vulnerability feature sequence from the code structure feature set, searches a candidate item set according to a vulnerability knowledge base, inputs a multi-level semantic decoupling model to generate a disambiguation vulnerability feature set; and the risk path analysis module constructs an auditing risk vector according to the security attribute and the disambiguation vulnerability feature set, and labels conflict and consistent path feature partition tags. The system guarantees data reliability by means of a blockchain, optimizes an auditing process by means of multi-module cooperation, and provides strong support for software system security auditing.

In various embodiments, and apparatus may be configured to identify a software blueprint for creating a reproducible software build, wherein the software blueprint contains resource nodes that contain a manifest of named build steps and 1) a resource identifier, or 2) a single source of truth (SSOT) resource software locator; generate modeling information identifying a hierarchically controlled order or a topographically sorted order for the build steps; populate a project hierarchy based on the modeling information, wherein the project hierarchy comprises an SSOT for the reproducible software build; assemble the reproducible software build using the SSOT, including processing the build steps in the hierarchically controlled order or the topographically sorted order for the build steps. Other embodiments may be disclosed and / or claimed.

This invention discloses a source code security analysis and vulnerability verification system based on an AI-powered automated detection engine, relating to the field of application security. The system includes a candidate vulnerability extraction module, a decompilation and path extraction module, an AI-powered judgment module, a sensitive data de-identification module, an interface reasoning module, a verification request construction module, an active detection module, and a multi-dimensional judgment module. These modules work collaboratively, relying on the AI-powered automated detection engine to construct a fully automated closed loop. The AI-powered judgment module uses a large language model with code understanding, semantic reasoning, and text generation capabilities as its core reasoning unit, deeply participating in the entire process of source code security analysis and vulnerability verification. Combined with functions such as JAR decompilation, path extraction, sensitive data de-identification, and multi-dimensional evidence constraints, it achieves automated verification from candidate risks to real vulnerabilities. This system solves the problems of high false positives, reliance on manual labor, and low automation in traditional code auditing. It possesses advantages such as high accuracy, high automation, wide applicability, and data security compliance, upgrading traditional code detection into a highly reliable and automated source code security analysis and vulnerability verification system, meeting the current technical needs of the source code security detection field. This invention also discloses the method and computer configuration applied to this system.

The present invention belongs to the field of fuzz testing, and discloses a fuzz testing method and system for industrial control protocols based on large language models. The method includes: obtaining a protocol document, protocol code to be tested, and protocol samples; parsing the protocol document based on the large language model to obtain protocol parsing information; extracting vulnerabilities from protocol samples with vulnerability information based on the large language model to obtain multiple vulnerability documents; retrieving an external knowledge base using query statements and protocol parsing information based on the retrieval augmented generation framework to generate an enriched initial seed set; performing code auditing on the protocol code to be tested based on the large language model to obtain vulnerable point code of the protocol code, and instrumenting the vulnerable point code of the protocol code to obtain instrumented code; mutating the input seeds based on a preset seed energy allocation rule, and performing fuzz testing on the instrumented code based on the mutated input seeds. The present invention improves the probability and speed of generating anomalies in fuzz testing.