13 results about "Code audit" patented technology

The invention provides a business code auditing method, belongs to the field of large model application, and can be used in the field of information security, the field of big data and the technical field of artificial intelligence. The method comprises the following steps: acquiring target business information and a target business code; performing preliminary scanning on the target business code to obtain a first analysis result; based on the first analysis result and the target service information, performing service logic analysis by using a service code auditing model to obtain a second analysis result; and verifying the first analysis result based on the second analysis result, and generating a business code auditing result based on the second analysis result and a verification result.

The invention discloses a segmentation method based on modification point context extraction. The segmentation method comprises the steps that a local code management tool code warehouse is pulled, cleaned and updated through a code management tool based on a remote code warehouse; based on the local incremental code, a target file is obtained through submission triggering analysis, splitting and merging, the target file comprises modification point data, the modification point data at least comprises modification types, modification information and code blocks, and the modification types at least comprise deletion, addition, modification and maintenance; based on the target file, obtaining an abstract syntax tree by identifying a language type; based on the abstract syntax tree, obtaining a simplified file set, data of the simplified file set and the modification points through segmentation and simplification, wherein the simplified file set is used for code auditing, code merging and code reviewing; and based on each sub-file of the simplified file set, deciding to write or merge the sub-files independently by judging the token.

The application relates to an automatic code auditing method and device, computer equipment and a storage medium, comprising the following steps: obtaining the syntax structure, control flow and data flow of a code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path and a large model reasoning method based on semantic understanding, and the weights of the methods; and identifying one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The method can improve the code auditing efficiency and process auditing codes of various vulnerability types.

The application discloses a code intelligent analysis and auditing system and method based on a large language model, and belongs to the technical field of software engineering and artificial intelligence. The system comprises a front-end display layer, a core business processing layer and a data persistence layer. The core business processing layer is provided with a multi-source project obtainer, an intelligent code auditing engine, a multi-model collaborative scheduling and fusion engine and a task scheduler. The method imports code through the multi-source project obtainer, utilizes the multi-model collaborative scheduling and fusion engine to schedule multiple large language models in parallel to analyze code units and fuse results, and stores the results after multi-dimensional auditing by the intelligent code auditing engine. The application solves the problems of insufficient semantic understanding of traditional tools and low accuracy of general large models in specific project analysis, effectively improves the accuracy, efficiency and automation level of code auditing, and supports the generation of professional auditing reports.

A code privacy-preserving inference method and apparatus based on model segmentation and random activation, wherein the method includes the following steps: Step 1, segmenting the original code audit model into an original client and a server; Step 2, expanding the feedforward neural network of the Transformer block inside the original client to generate a pseudo client; Step 3, establishing a key authentication mechanism on the pseudo client; if key authentication is successful, the expanded neuron part automatically does not participate in the processing of input data, and the pseudo client automatically transforms into a client; if key authentication fails, the pseudo client randomly activates the expanded neuron part according to a random activation strategy; Step 4, establishing an encrypted channel connection mechanism between the pseudo client and the server. This invention can greatly defend against member inference attacks and inversion reconstruction attacks, while not affecting the model performance during normal user use.

The invention provides a code vulnerability detection method and device, a storage medium and electronic equipment, and relates to the technical field of artificial intelligence, and the method comprises the steps: extracting corresponding input code data from code auditing input streams of all dimensions, and carrying out the preprocessing to generate a code attribute graph; performing vulnerability reasoning on the code attribute graph by adopting a double-engine dynamic routing mode, and dynamically selecting a first detection model or a second detection model to execute detection according to the confidence coefficient of a vulnerability reasoning result; automatically labeling the vulnerability detection result based on feedback information of a developer on the vulnerability detection result, and screening effective labeled data to form an incremental training candidate set; automatically synthesizing a sample with a vulnerability code and corresponding labeling information based on user configuration parameters, and supplementing the synthesized sample to a training sample library; and based on the incremental training candidate set and the supplemented training sample library, periodically updating model parameters of the first detection model and the second detection model by adopting an incremental fine tuning technology. The vulnerability detection precision can be improved.

The application relates to the technical field of blockchain code auditing, and discloses a code auditing system based on a blockchain. The system comprises three modules, namely, an auditing feature extraction module, a vulnerability feature disambiguation module and a risk path analysis module. When the storage capacity of a target code repository reaches a preset threshold, the auditing feature extraction module calls a blockchain node to obtain a version snapshot, and extracts a code structure and a security attribute feature set; the vulnerability feature disambiguation module separates a to-be-verified vulnerability feature sequence from the code structure feature set, searches a candidate item set according to a vulnerability knowledge base, inputs a multi-level semantic decoupling model to generate a disambiguation vulnerability feature set; and the risk path analysis module constructs an auditing risk vector according to the security attribute and the disambiguation vulnerability feature set, and labels conflict and consistent path feature partition tags. The system guarantees data reliability by means of a blockchain, optimizes an auditing process by means of multi-module cooperation, and provides strong support for software system security auditing.

This invention discloses a source code security analysis and vulnerability verification system based on an AI-powered automated detection engine, relating to the field of application security. The system includes a candidate vulnerability extraction module, a decompilation and path extraction module, an AI-powered judgment module, a sensitive data de-identification module, an interface reasoning module, a verification request construction module, an active detection module, and a multi-dimensional judgment module. These modules work collaboratively, relying on the AI-powered automated detection engine to construct a fully automated closed loop. The AI-powered judgment module uses a large language model with code understanding, semantic reasoning, and text generation capabilities as its core reasoning unit, deeply participating in the entire process of source code security analysis and vulnerability verification. Combined with functions such as JAR decompilation, path extraction, sensitive data de-identification, and multi-dimensional evidence constraints, it achieves automated verification from candidate risks to real vulnerabilities. This system solves the problems of high false positives, reliance on manual labor, and low automation in traditional code auditing. It possesses advantages such as high accuracy, high automation, wide applicability, and data security compliance, upgrading traditional code detection into a highly reliable and automated source code security analysis and vulnerability verification system, meeting the current technical needs of the source code security detection field. This invention also discloses the method and computer configuration applied to this system.

The application provides an Angular framework code auditing method, an electronic device, a storage medium and a program product, and relates to the technical field of security. The method divides source code into semantic code units with complete context by using Angular framework syntax features, which can effectively improve the understanding ability of a large language model for framework-specific logic and avoid missing detection of semantics such as decorators and dependency injection by general tools. Meanwhile, based on the dynamic retrieval of a rule knowledge base according to a user-specified auditing dimension label, accurate matching of auditing rules and auditing intentions is achieved, and then accurate auditing of code is performed by a large language model based on a target auditing rule set.

This invention discloses a cross-language source code auditing method based on deep learning, belonging to the interdisciplinary fields of software security and artificial intelligence. This invention standardizes variable definitions, sensitive operations, and data flow paths in multi-language source code to construct a unified abstract expression, and combines this with natural language templates to complete structured transcription, thereby eliminating language differences and achieving unified analysis of mixed C / C++, Java, and Python projects. The transcription results are integrated with a large language model, utilizing a multi-layered prompting mechanism to enhance the model's semantic understanding and contextual reasoning capabilities, improving the detection effect of complex vulnerabilities such as deep data flow dependencies and sensitive path propagation. Simultaneously, a semantic equivalence test set is used to verify the consistency of multi-language analysis results, and the template and prompting strategy are automatically optimized when the deviation exceeds a threshold, giving the system good stability and adaptability.

A system for continuous contextual policy-aware vulnerability mapping, security posture determination and attack planning and simulation, comprising an indexing service configured to create a dataset by processing and indexing source code of a project by a developer, perform a code audit on the indexed source code, store results from the code audit in the dataset, gather additional information relating to the provided project as intended and as operated, store the additional information in the dataset, and store the dataset into memory; and a monitoring service configured to continuously monitor the project for source code and operational changes and performance and make changes to the dataset as needed.

The application provides a code audit vulnerability knowledge graph construction and correlation analysis method, relates to the technical field of security vulnerability detection, S1: based on the device history, a dynamic normal knowledge graph is constructed, when the current behavior deviates, the first data is generated; S2: based on the global topology, a predictive attack path knowledge graph is constructed, including attack path probability, constituting the second data; S3: the first data and the second data are fused, and an indication signal is generated by calculating through a probability fusion model; S4: based on the indication signal exceeding the confirmation threshold, a control instruction is generated; S5: the instruction is executed, the attack probability of the second data is updated, and the prospective defense for the next target is executed; the abnormal behavior evidence and the attack intention context are fused by using the probability fusion model, so that the attack confirmation signal is generated, and the prospective defense action and the adaptive update of the knowledge graph are driven based on the attack confirmation signal.