65 results about "Symbolic execution" patented technology

A symbolic neuroadaptive control system is disclosed for real-time arbitration, consent, and ethical modulation of artificial intelligence agents operating in wearable computing environments. The system integrates multimodal biometric telemetry—including high-resolution EEG signals—with a symbolic kernel that performs logic-driven arbitration over cognitive, emotional, and ethical states. Using Coq-verified invariants and zero-knowledge biometric consent tokens, the system constructs a deterministic symbolic execution graph, gating AI outputs based on internal user states such as trauma, stress, or intentionality. Unlike conventional black-box BCI models, the invention routes EEG-inferred affective-symbolic tokens through a formal ethics layer that enforces real-time interrupt control, utility bounding, and trust verification. The kernel enables AGI systems to defer or modify behavior based on user-state alignment, granting sovereign agency over all downstream actions. This neuro-symbolic architecture redefines the interface between human cognition and intelligent machines, enabling emotionally conscious, morally verifiable, and symbolically transparent AI governance in dynamic, high-stakes contexts.The present invention relates to artificial intelligence and neurotechnology, specifically to a real-time, neuro-symbolic operating system kernel that converts electroencephalography (EEG) signals into structured symbolic data for use in emotional cognition, ethical prioritization, autonomous agent dispatch, and real-time telecommunications routing. The invention bridges brain-computer interface (BCI) inputs with symbolic AI architectures to enable ethically aligned machine response during cognitively or emotionally intense events.

The invention provides a symbolic execution tree and LLM vector space heterogeneous fusion program defect detection method, relates to the technical field of program static analysis, and solves the problems of path explosion and overhigh constraint solution complexity in C / C + + program defect detection of traditional symbolic execution. The method comprises the steps that firstly, a symbolic execution tree of a target program to be detected is constructed, key feature information is extracted from the symbolic execution tree and converted into multi-dimensional feature representation, and corresponding symbolic execution feature vectors are formed; then constructing a mapping model, realizing a mapping process from the symbolic execution feature vector to an LLM vector space, and obtaining an LLM mapping result; symbolic execution analysis is achieved based on the symbolic execution tree, LLM analysis is achieved based on the LLM mapping result, and finally two kinds of analysis results are fused to obtain a program defect detection result. For optimization training of the mapping model, a comparative learning strategy is also adopted. According to the invention, accurate detection of complex program defects can be effectively realized, and the detection efficiency is improved.

The invention discloses an intelligent contract vulnerability detection method and system based on semantic comprehension and program path analysis, and belongs to the technical field of network security. The method comprises the following steps: firstly, analyzing an intelligent contract code by using a large language model, and reasoning to generate a structured security rule for defining a taint source, a taint sink and a purifier; secondly, guiding a taint analysis engine by using a security rule, and tracking on a data flow and a control flow diagram of a program so as to efficiently screen out a high-risk taint path; then, carrying out reachability verification on the high-risk path by adopting a symbolic execution technology; and finally, performing final context review on the verified vulnerability path by using the large language model again to generate a vulnerability report. According to the method, the semantic comprehension ability of the large language model and the preciseness of traditional program analysis are subjected to multi-stage cooperation, so that the detection precision and efficiency of the intelligent contract logic vulnerability can be remarkably improved, the interpretability of a report result is greatly enhanced, and the method has important application value.

The invention provides a multi-language-oriented source code automatic verification method and system, and relates to the technical field of computers.The method comprises the steps that multi-language source codes are obtained; compiling the multi-language source code through an LLVM compiler to generate an intermediate file; the intermediate file is optimized; analyzing the optimized intermediate file through an IR analyzer to generate a symbolic execution model; performing simulation execution operation on the symbolic execution model; and performing security verification on the symbolic execution model after simulation execution operation to obtain a verification report. Unified verification of multi-language source codes can be achieved, the verification environment building and development cost is greatly reduced, and the overall verification efficiency is improved; and the analysis capability of the intermediate file can be enhanced, the logic constraint relationship in the code can be accurately captured, the comprehensiveness and reliability of the verification work can be practically guaranteed, and diversified software security verification requirements can be met.

The invention provides a binary program vulnerability mining method, device and system based on symbolic execution and taint analysis and a medium, and the method comprises the steps: disassembling a target program, extracting a control flow graph (CFG) and a data flow graph (DFG), recording a node state through a hash table, and generating a feature representation through nonlinear transformation; performing simulation execution based on CFG, DFG and feature representation, recording variable symbol values to obtain path conditions, and recursively solving constraints to generate path mapping; marking input as taint data, recursively calculating a propagation path to generate a taint flow diagram, and determining a taint state after sensitive operation; checking whether the stains are subjected to sensitive operation or not, and if the influence of integral formula calculation exceeds a threshold value, judging that potential vulnerabilities generate a candidate set; and calculating grades through a risk assessment formula, and generating a report containing positions, types, grades and repair suggestions. The method combines symbolic execution and taint analysis, can comprehensively and accurately detect vulnerabilities, has remarkable precision and efficiency advantages, and is suitable for complex program security analysis.

The application relates to an automatic code auditing method and device, computer equipment and a storage medium, comprising the following steps: obtaining the syntax structure, control flow and data flow of a code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path and a large model reasoning method based on semantic understanding, and the weights of the methods; and identifying one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The method can improve the code auditing efficiency and process auditing codes of various vulnerability types.

The invention relates to the technical field of attack tracing, in particular to an attack tracing method and device based on a symbolic execution engine, and the method comprises the steps: recognizing a plurality of dependent explosion functions of a pre-constructed execution unit sequence, so as to construct an independent subprogram; constructing a system call control flow diagram of a historical event processing cycle by combining static and dynamic analysis; auditing logs containing parameter values are collected in the execution period of the target program so as to construct a thread-level traceability graph; and according to the system call control flow diagram, determining whether a node of dependent explosion exists in the thread-level traceability diagram, if so, reconstructing the independent subprogram by using the node of dependent explosion, and analyzing the reconstructed independent subprogram by using a symbolic execution engine to reconstruct an attack path. Therefore, the problem that a related tracing attack method needs to carry out instrumentation on a system, or depends on static analysis, or depends on an unreliable application log, or needs to use additional auxiliary hardware to realize tracking is solved.

This invention provides a method for generating complex functions on a low-code platform based on large model code interpretation and generation. By capturing and standardizing user input, a structured intent graph containing business entities, operational relationships, parameter constraints, and control flow topology is constructed as a unified semantic anchor. Combined with a pre-defined domain rule base, a semantic alignment validator is designed to achieve multi-dimensional semantic comparison and conflict detection between code and requirements. Code snippets are generated in parallel by multiple models and verified in real time, and semantic conflicts are resolved through local regeneration. By fusing the results of multiple models to construct a joint abstract syntax tree, lightweight symbolic execution is used to simulate the correctness of cross-model code, locate and correct core logical conflicts. This invention significantly improves the consistency, accuracy, and automatic correction capabilities of low-code platform code generation.

A malicious sample encryption process tracking method based on large language model guidance, potential encryption features in a binary malicious sample are extracted through static analysis technology, and the related function call relationship is identified, then, the large language model is used to automatically screen and reason the disassembled code, and the irrelevant execution path is eliminated, and the key function subset related to key generation and encryption operation is screened out. Then, the screened function subset is taken as input and is given to the angr symbolic execution framework for further analysis, through the marking of the key function parameters, dynamic taint analysis and path exploration are carried out, and important links in the encryption process are accurately identified. Finally, the automatic identification of the whole process of malicious sample encryption is realized, and the storage positions of the encryption key and sensitive data can be accurately located. The present application effectively solves the "path explosion" problem in the traditional symbolic execution method, and significantly improves the analysis efficiency of the complex encryption type of confrontation behavior.

The application relates to an ordered, enhanced and cacheable symbol execution static analysis method and system, wherein a program function is calculated through graph structure topology sorting, and the dependence order of an inspector is checked; each inspection step is sequentially performed; the inspection information of each dependence step is cached and searched; the inspection information of a current inspector is calculated by combining the information of the inspected inspectors; and the inspection information of a current function is calculated by combining the information of the inspected functions. According to the dependence order, the application is realized in a combined mode as interdependent inspectors, the reuse rate of the inspectors is increased, and repeated development is reduced; the dependence order among functions can solve the analysis dependence problem of cross-function calling; meanwhile, the analyzed results are cached, the analysis efficiency is effectively improved, and incremental analysis and cross-binary library analysis can be realized on the basis.

The invention relates to the field of intelligent analysis, and particularly discloses a binary code-oriented static taint analysis system and method, which introduces an on-demand micro-symbol execution mechanism on the basis of basic data flow analysis through binary lifting and control flow diagram construction, that is, aiming at memory ambiguous nodes in a data dependence diagram, a micro-symbol execution mechanism is introduced on the basis of the basic data flow analysis; refined alias analysis is achieved through reverse instruction slicing and constraint solution, then an enhanced data dependency graph is generated, and path-sensitive taint propagation iteration is conducted on the basis to generate a final taint state table. In this way, complex dynamic memory addressing can be effectively recognized, taint chain breakage and misinformation explosion caused by ambiguity ignoring or excessive approximation are avoided, and resource allocation of an analysis engine is remarkably optimized.

The invention provides a binary program static analysis method based on a comprehensive control flow diagram. According to the scheme, the method comprises preprocessing, a control flow diagram generation module, a reverse control flow diagram generation module, target address ambiguity instruction recognition and a specific basic block path. The control flow diagram generation module obtains binary program information through preprocessing and generates a control flow diagram by using a breadth-first search algorithm. The reverse control flow diagram generation module initializes a reverse control flow diagram and generates a reverse edge by traversing the control flow diagram. A target address ambiguity instruction analysis module identifies a target address ambiguity jump or call instruction in the basic block. The specific basic block path analysis module uses a path search algorithm to obtain all paths of a specific basic block, and analyzes execution conditions of the paths through a symbolic execution technology. According to the method, the binary program can be comprehensively analyzed, the analysis efficiency and accuracy are improved, and powerful support is provided for software security and quality improvement.

This invention relates to an automated vulnerability exploitation method for constructing state transition graphs, belonging to the field of software security technology. First, the binary program is disassembled to extract information such as protection mechanism types and high-risk functions, which serve as the starting node state information of the state transition graph. Then, based on the node state information, exploitation methods are selected from a vulnerability exploitation library to attempt to bypass protection mechanisms. Exploitation methods that can bypass protection mechanisms are used as edges in the state transition graph, and new nodes are created. This process is repeated to continuously create nodes until all protection mechanisms are bypassed. Based on the latest node state information, an exploitation method that can obtain a shell is selected, and a termination node is created. Finally, the state transition graph is traversed using the Depth-First Search (DFS) algorithm, and symbolic execution and constraint solving techniques are used to generate payloads. This invention addresses the problem that existing methods rely on fixed exploitation methods to generate payloads, making it difficult to cope with complex protection mechanisms. By constructing a state transition graph to gradually bypass multiple protection mechanisms, the success rate of automated vulnerability exploitation is improved.

This application discloses an artificial intelligence-based vulnerability verification code generation method and network protection method. The vulnerability verification code generation method includes: parsing acquired historical vulnerability data using deep learning algorithms and natural language processing techniques to extract key policy information and code structure information; inputting the key policy information and code structure information into a pre-trained code generation model and generating initial vulnerability verification code by combining it with a pre-constructed environmental feature knowledge graph; optimizing the initial vulnerability verification code using a sequence-to-sequence model and a large language model combined with the vulnerability knowledge graph; and verifying the optimized initial vulnerability verification code using sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. The vulnerability verification code generated using the method provided in this application has high accuracy, high efficiency, does not rely on manual verification, and has good versatility.

A malicious sample encryption process tracking method based on large language model guidance, potential encryption features in a binary malicious sample are extracted through static analysis technology, and the related function call relationship is identified, then, the large language model is used to automatically screen and reason the disassembled code, and the irrelevant execution path is eliminated, and the key function subset related to key generation and encryption operation is screened out. Then, the screened function subset is taken as input and is given to the angr symbolic execution framework for further analysis, through the marking of the key function parameters, dynamic taint analysis and path exploration are carried out, and important links in the encryption process are accurately identified. Finally, the automatic identification of the whole process of malicious sample encryption is realized, and the storage positions of the encryption key and sensitive data can be accurately located. The present application effectively solves the "path explosion" problem in the traditional symbolic execution method, and significantly improves the analysis efficiency of the complex encryption type of confrontation behavior.

The invention relates to the technical field of software testing, and provides an automatic system call specification generation method and system for kernel fuzz testing. The method comprises the following steps: a static analysis stage: compiling a Linux kernel source code to be tested into an LLVM byte code, and performing deep static analysis on the LLVM byte code to identify and reconstruct an interface and a parameter type called by a system; a symbol execution and specification generation stage: adopting a constraint extraction and solution algorithm to extract constraints under different paths, carrying out constraint solution, and generating an initialized calling specification template in combination with an interface called by the system, the parameter type and the constraints; a standard test and verification stage: constructing an evaluation system of a multi-dimensional index to verify the initialized calling standard template and generate corresponding error information; in the large language model auxiliary correction stage, the initialized calling standard template and the error information serve as input, and a high-quality calling standard template is obtained after a large model iteration repair algorithm is conducted.

The application discloses a kind of based on symbol execution's malicious code obfuscation technology static repair method, belong to software analysis technical field, main in solving the malicious software static escape problem when existing static analysis technique faces obfuscated malicious software.The main scheme includes the basic static analysis to the tested Android application to obtain the sensitive API list and original graph feature in the tested Android application;According to the sensitive API list obtained, write hook function to simulate sensitive API list function, generate function replacement table, use symbol execution technology to simulate running Android application, replace part of function according to function replacement table in this process, finally obtain the overall execution state information and the block information of basic block when Android application simulation executes;According to state information and block information, prune and reconstruct original graph feature to realize static repair, exclude static obfuscation information, and mine effective graph feature therein.

The application discloses a contract attack detection method and device based on symbolic execution and a graph neural network, comprising: obtaining deployment bytecode and runtime bytecode of a smart contract; performing symbolic execution on the runtime bytecode, extracting external calls and event information through depth-first search and taint tracking; constructing a contract call information graph and iteratively simplifying it; performing multi-dimensional feature coding on each node to generate a node feature vector; encoding on-chain metadata of a deployer into a deployer feature vector; constructing and training a graph embedding network and a classification network, the input of the graph embedding network being the simplified contract call information graph, the node feature vector and edge type information, and the output being a graph-level feature vector; the input of the classification network being a joint feature vector obtained by splicing the graph-level feature vector and the deployer feature vector, and the output being a contract classification result. The application can cover multiple attack types and realize attack contract identification with low false alarm rate by extracting contract execution logic structures for detection.

This application belongs to the field of industrial control protocols and discloses a method, device, and medium for constructing an industrial control protocol semantic feature library based on program behavior analysis, including: S1: constructing typical industrial control field tags to form a unified set of field semantic tags; S2: acquiring execution context data; S3: performing symbolic execution analysis of protocol message processing to extract symbolic expressions related to protocol field processing; S4: dividing protocol field boundaries and classifying symbolic expressions by field as the original dataset; S5: extracting field program behavior features; S6: filtering field semantic features to select the most distinguishable field semantics from the original features; S7: constructing a semantic feature library by statistically analyzing the filtered features of each field in the original dataset, selecting filtered features that appear more frequently than a preset frequency and combining them to form composite features that can describe field semantics, and forming a complete industrial control protocol semantic feature library by constructing composite features for all fields.

The invention discloses a deserialization utilization chain detection method based on static analysis and a large model. The deserialization utilization chain detection method comprises the following steps: obtaining a deserialization entry in a java application program to be detected; identifying all reachable paths from the deserialization entry to the dangerous function call point from the Java application program, and recording the reachable paths as utilization chains; analyzing the data dependence of the utilization chain, and constructing an AMethod data structure; deducing an object structure chart based on an AMethod data structure; lLM is used as a miniature JVM, and partial symbolic execution and semantic verification are performed on a utilization chain in combination with an inferred object structure diagram. According to the method, the Java deserialization utilization chain which is complete in structure and feasible in semantics can be accurately identified from massive codes, and the problems of path explosion and false report and missing report are effectively solved.

This invention relates to a method for verifying Lustre-to-C translation code based on symbolic execution, belonging to the field of embedded software development. Addressing the paradigm differences between Lustre programs and target C code, this invention first constructs formal semantic models of both at the time-step granularity. Then, the Lustre source program and the compiled C code are transformed into unified intermediate representations, and the execution trajectories of both are explored in parallel under the same input environment based on path-sensitive symbolic execution technology. During symbolic execution, combining Lustre's unique clock semantics and timing constraints, equivalence verification conditions covering variable states, clock enable, and output behavior are dynamically generated and automatically determined by the SMT solver. This invention effectively compensates for boundary scenarios that traditional testing struggles to cover, improving the reliability and certification efficiency of embedded control software.

The invention provides a code vulnerability detection method, which comprises the following steps of: preprocessing a source code to obtain a de-obfuscated source code and a dependency graph; according to the de-obfuscated source code and the dependency graph, establishing a syntax tree corresponding to the source code and carrying out taint analysis to obtain a plurality of static analysis vulnerabilities; analyzing the de-obfuscated source code and the syntax tree by adopting a symbolic execution strategy to obtain a plurality of dynamic analysis vulnerabilities; inputting the de-obfuscated source code and the dependency graph into a machine learning model to obtain a plurality of machine learning analysis vulnerabilities; inputting the static analysis vulnerability, the dynamic analysis vulnerability and the machine learning analysis vulnerability into a Bayesian decision network to determine occurrence probabilities corresponding to the static analysis vulnerability, the dynamic analysis vulnerability and the machine learning analysis vulnerability; and performing weighted summation on the occurrence probabilities corresponding to the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities to determine the risk probability of each vulnerability. According to the invention, the front-end code can be intelligently analyzed.

A cognitive symbolic execution system for hydrogen infrastructure is disclosed, enabling lawful, ethics-gated, and treaty-verifiable hydrogen generation, storage, and distribution. The system includes a symbolic cognition kernel, a consent-indexed actuator firewall, and a treaty DAG enforcing national, environmental, and humanitarian policy overlays. Every hydrogen molecule is tokenized with a post-quantum identity hash linked to oath-indexed usage intent and symbolic moral predicates. Human—AGI negotiation modules, EEG consent channels, and zero-knowledge arbitration protocols govern hydrogen flow, deferral, or rerouting. Hydrogen reactors, pipelines, and vehicles are granted activation only upon satisfaction of multi-party treaty conditions, emotional risk assessments, and symbolic affordance filters. A Merkle-secured narrative ledger records every action, enabling post-hoc audit, rollback, and jurisdictional override. Applications include battlefield treaty enforcement, civilian disaster routing, carbon-credit-bound storage, and AGI-governed global hydrogen exchange. This invention elevates hydrogen into a sovereign, symbolic agent substrate—capable of obeying ethics, negotiating policy, and executing only under verifiable, lawful cognition.

This application discloses a tensor program performance prediction method and system based on LLVM, relating to the field of computer system performance modeling and compiler optimization technology. This invention determines the instruction type of each instruction by semantic recognition of the tensor intermediate representation and transforms the instructions into task nodes with semantic tags. By calculating the symbolic execution count and corresponding execution cost of each instruction type tag within each basic block, the program load is quantified without executing the code. Furthermore, the basic blocks are scheduled and arranged under the physical resource constraints of the target hardware, achieving deep coupling between program logic semantics and hardware physical constraints. Finally, the total predicted execution time of the entire tensor program is obtained based on the predicted execution time of each basic block and the number of times each basic block appears. This enables accurate evaluation of the execution time of a high-performance tensor kernel without running on the target hardware platform.

This invention discloses an automated method and system for generating static vulnerability analysis and evaluation data for MPI programs, belonging to the field of software testing technology. Addressing the lack of high-quality evaluation datasets in existing MPI program static analysis tools, this invention employs a program mutation method driven by an MPI vulnerability pattern knowledge base. It constructs a formalized MPI vulnerability pattern description system, designs semantically preserved vulnerability injection operators, and combines lightweight symbolic execution technology for MPI programs to verify vulnerability reachability, thereby achieving automated generation and annotation of MPI vulnerability samples. The evaluation dataset generated by this invention features comprehensive vulnerability type coverage, accurate vulnerability annotation, high sample diversity, and strong traceability, providing crucial support for the testing, evaluation, and improvement of MPI program static analysis tools.

The invention belongs to the field of industrial control protocols, and discloses an industrial control protocol semantic feature library construction method and device based on program behavior analysis, and a medium, and the method comprises the steps: S1, constructing typical industrial control field tags, and forming a unified field semantic tag set; s2, executing context data acquisition; s3, performing symbolic execution analysis in a protocol message processing process, and extracting a symbolic expression related to protocol field processing; s4, dividing protocol field boundaries, classifying symbol expressions according to fields, and taking the symbol expressions as an original data set; s5, field program behavior feature extraction; s6, field semantic feature screening: screening out screening features which can distinguish field semantics most from the original features; and S7, constructing a semantic feature library, counting the screening features of each field in the original data set, selecting the screening features appearing at a frequency greater than a preset frequency, combining the screening features to form composite features capable of describing field semantics, and constructing the composite features for all fields to form a complete industrial control protocol semantic feature library.

The present application belongs to the field of path search method, especially the method for realizing path search depth self-adaptive adjustment based on abstract syntax tree, aiming at the problem that the existing contract with large number of code lines has deep function call and the symbolic execution cannot cover, the contract faced by the symbolic execution is basically the low version smart contract with not more than 200 lines, ignoring the problem that the symbolic execution is difficult to cover part of path in long / complex contract, the present application proposes the following scheme, which comprises the following steps: S1: input: the open source contract on EtherScan or the smart contract source code written by the developer is taken as the program input; S2: compilation: the smart contract is compiled through the Solidity compiler, the AST information and the smart contract bytecode generated in the compilation process are collected, the present application is based on the symbolic execution technology, combines the AST information which can reflect the semantics of the smart contract source code, and adaptively adjusts the path search depth in the symbolic execution process, so as to avoid the problem that the vulnerability position cannot be detected and the coverage is low in the long contract.

This invention relates to a symbolic execution vulnerability detection method based on the real runtime context of WebAssembly, belonging to the field of software technology. The method includes: 1) Real runtime context clustering and classification: based on multi-dimensional clustering dimensions and recursive similarity matching, massive amounts of real runtime states are classified and redundantly removed, retaining representative context samples; 2) Symbolic context generation: the representative clustered contexts are modeled and standardized using multi-type parameters to construct an initial symbolic context pool, providing input for symbolic execution; 3) Dynamic pruning of symbolic execution: based on path coverage-oriented context sorting and dynamic pruning strategies, symbolic execution and vulnerability detection are implemented on the WebAssembly binary code. This invention achieves accurate and efficient detection of WebAssembly program vulnerabilities by integrating the real runtime context of WebAssembly in a browser environment with a symbolic execution framework, solving the dual problems of distorted results caused by analyzing only WebAssembly code and low efficiency caused by analyzing the entire real context in traditional methods.

The embodiment of the application provides a kind of based on ROP chain and the method and device of obfuscation and anti-reverse protection of opaque predicate, this scheme proposes a kind of three-order obfuscation protection framework of combining ROP instruction dynamic reconstruction, opaque predicate protection, instruction semantic hiding, after the ordinary C / C++ source code is compiled into LLVM intermediate representation IR, dynamic extraction Gadget and opaque predicate combination based on user input state are used, the deep level semantic disturbance of key logic block, jump structure, constant field of program is realized. To completely break the control flow restoration chain, it is difficult for reverse personnel to analyze the obfuscation result, realize the controllable, verifiable, high-stability obfuscation protection of program, while maximizing resistance to symbolic execution and static analysis and other advanced analysis techniques.

This invention discloses an embedded system vulnerability detection method based on intelligent agent collaboration, aiming to address the shortcomings of existing technologies in vulnerability detection in complex embedded environments, including insufficient capability, lack of autonomy, and lack of adaptability. This invention establishes a structured representation of system state evolution by constructing a causal graph including code, hardware state, and physical feedback. It uses an autonomous hunting agent driven by a large language model as its core, autonomously generating a hunting plan based on the causal model and coordinating the use of various tools such as fuzz testing, symbolic execution, and static analysis for vulnerability discovery and verification. After discovering an initial vulnerability, it automatically infers and synthesizes a cross-domain exploit chain to assess the complete attack surface. Finally, it uses a reinforcement learning framework to enable the system to continuously learn from hunting experience and optimize its decision-making strategy. This invention upgrades vulnerability detection from passive pattern matching to an active exploration and reasoning process, achieving efficient and intelligent detection and exploit verification of unknown vulnerabilities in embedded systems.