IP Library › Granted Patent US 12699779

Granted Patent B1

US 12699779 · App. 19/043,063 · Granted Aug 4, 2026

Automated software vulnerability assessment using generative artificial intelligence

Inventors: Chao Liu (Xi'an, CN); Lan Luan (Xi'an, CN); Khaldoun Bouhsas (Walldorf, DE); Yong Li (Xi'an, CN); Jinming Lv (Xi'an, CN); Qiao-luan Xie (Xi'an, CN); Andreas Eisenmann (Walldorf, DE)

Assignee: SAP SE

G06F21/577 G06F2221/033

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12699779
App. No.: 19/043,063
Granted: Aug 4, 2026
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A computer-implemented method can receive a vulnerability report for a software. The vulnerability report specifies a vulnerable library used by the software and a path of the vulnerable library within the software. The method can generate a summary of the vulnerability report using a generative artificial intelligence (AI) model, retrieve, from a bug report database, a set of relevant bug reports specifying the vulnerable library, generate a synopsis for the set of relevant bug reports using the generative AI model, generate multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and generate a final decision on validity of the vulnerability report based on the multiple preliminary decisions. Related systems and software for implementing the method are also disclosed.

Claims (61)

1 . A computing system comprising:

memory;

one or more hardware processors coupled to the memory; and

one or more computer readable storage media storing instructions that, when loaded into the memory, cause the one or more hardware processors to perform operations comprising:

receiving a vulnerability report for a selected software, wherein the vulnerability report specifies a vulnerable library used by the selected software and a path of the vulnerable library within the selected software;

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports; and

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.

2 . The computing system of claim 1 , wherein generating the summary of the vulnerability report comprises:

generating a vulnerability knowledge distillation prompt based on a first prompt template, wherein the first prompt template includes instructions for the generative AI model to extract, from the vulnerability report, vulnerability information of the vulnerability library used by the selected software; and

prompting the generative AI model with the vulnerability knowledge distillation prompt.

3 . The computing system of claim 1 , wherein the retrieving comprises:

searching the bug report database to identify a collection of bug reports for one or more historical software, wherein a bug report for a historical software specifies the vulnerability library used by the historical software and a path of the vulnerability library within the historical software; and

identifying, from the collection of bug reports, the set of relevant bug reports, wherein the identifying comprises comparing the path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software.

4 . The computing system of claim 3 , wherein the identifying further comprises:

adding the bug report for the historical software to the set of relevant bug reports if (i) the path of the vulnerability library within the historical software contains the path of the vulnerable library within the selected software, and (ii) a count of bug reports in the set of relevant bug reports is smaller than a predefined number; and

responsive to determining that the count of bug reports in the set of relevant bug reports is smaller than the predefined number after evaluating the collection of bug reports, iteratively comparing a sub-path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software, wherein the sub-path is derived by removing a prefix from the path of the vulnerable library within the selected software.

5 . The computing system of claim 1 , wherein generating the synopsis for the set of relevant bug reports comprises:

generating an expert knowledge distillation prompt based on a second prompt template, wherein the second prompt template includes instructions for the generative AI model to extract, from the set of relevant bug reports, summaries and validity classifications for the set of relevant bug reports; and

prompting the generative AI model with the expert knowledge distillation prompt.

6 . The computing system of claim 1 , wherein generating multiple preliminary decisions on validity of the vulnerability report comprises:

obtaining a plurality of muted prompts previously derived from a meta-prompt using the generative AI model based on a plurality of predefined thinking paradigms; and

separately prompting the generative AI model using the plurality of muted prompts, wherein prompting the generative AI model using a muted prompt is configured to generate one of the multiple preliminary decisions.

7 . The computing system of claim 6 , wherein the meta-prompt and the plurality of muted prompts include instructions for the generative AI model to (i) classify the vulnerability report as valid or invalid based on analysis of the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and (ii) generate a list of inference bugs which identify one or more relevant bug reports based on which the vulnerability report is classified as valid or invalid.

8 . The computing system of claim 6 , wherein generating the final decision on validity of the vulnerability report further comprises calculating a weighted sum of the multiple preliminary decisions.

9 . The computing system of claim 8 , wherein calculating the weighted sum comprises determining weights for the multiple preliminary decisions, wherein a weight for a preliminary decision is determined based on how many relevant bug reports, among the set of relevant bug reports, are found by the generative AI model to support the preliminary decision.

10 . The computing system of claim 8 , wherein the weighted sum is in a range divided into three non-overlapping sub-ranges, wherein the final decision indicates (i) the vulnerability report is valid, (ii) the vulnerability report is invalid, or (iii) validity of the vulnerability report is indeterministic, based on the sub-range into which the weighted sum falls.

11 . A computer-implemented method comprising:

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.

12 . The computer-implemented method of claim 11 , wherein generating the summary of the vulnerability report comprises:

prompting the generative AI model with the vulnerability knowledge distillation prompt.

13 . The computer-implemented method of claim 11 , wherein the retrieving comprises:

14 . The computer-implemented method of claim 13 , wherein the identifying further comprises:

15 . The computer-implemented method of claim 11 , wherein generating the synopsis for the set of relevant bug reports comprises:

prompting the generative AI model with the expert knowledge distillation prompt.

16 . The computer-implemented method of claim 11 , wherein generating multiple preliminary decisions on validity of the vulnerability report comprises:

obtaining a plurality of muted prompts previously derived from a meta-prompt using the generative AI model based on a plurality of predefined thinking paradigms; and

17 . The computer-implemented method of claim 16 , wherein the meta-prompt and the plurality of muted prompts include instructions for the generative AI model to (i) classify the vulnerability report as valid or invalid based on analysis of the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and (ii) generate a list of inference bugs which identify one or more relevant bug reports based on which the vulnerability report is classified as valid or invalid.

18 . The computer-implemented method of claim 16 , wherein generating the final decision on validity of the vulnerability report further comprises calculating a weighted sum of the multiple preliminary decisions.

19 . The computer-implemented method of claim 18 , wherein calculating the weighted sum comprises determining weights for the multiple preliminary decisions, wherein a weight for a preliminary decision is determined based on how many relevant bug reports, among the set of relevant bug reports, are found by the generative AI model to support the preliminary decision.

20 . One or more non-transitory computer-readable media having encoded thereon computer-executable instructions causing one or more processors to perform a method, the method comprising:

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.