The invention discloses a
source code analysis-based
vulnerability risk positioning method and device and a storage medium, and the method comprises the steps: combining static
source code analysis and dynamic
source code analysis, carrying out the modeling of a
vulnerability code, fusing static features and dynamic features extracted from the
vulnerability code into a multi-
modal feature vector, and carrying out the modeling of the multi-
modal feature vector; then
deep learning model training is performed by using a multi-
modal feature vector, the model is continuously optimized, and finally, the vulnerability risk positioning method of AI
large model intelligent auxiliary analysis is used to solve the problem that
static analysis and dynamic analysis are mutually independent and cannot combine the advantages of the
static analysis and the dynamic analysis by fusing the advantages of the
static analysis and the dynamic analysis in the prior art. Meanwhile, the method is combined with AI
large model intelligent auxiliary analysis, the
false alarm rate is finally reduced (experiments show that the
false alarm rate can be reduced by 30% or above), intelligent repair suggestions are provided, in addition, the method is combined with
graphical display of the function call relation, the accuracy of vulnerability positioning is further improved, and clear repair guidance is provided for developers.