IP Library › Granted Patent US 12,699,779
Granted Patent B1
US 12,699,779 · App. 19/043,063 · Granted Aug 4, 2026

Automated software vulnerability assessment using generative artificial intelligence

Inventors: Chao Liu (Xi'an, CN); Lan Luan (Xi'an, CN); Khaldoun Bouhsas (Walldorf, DE); Yong Li (Xi'an, CN); Jinming Lv (Xi'an, CN); Qiao-luan Xie (Xi'an, CN); Andreas Eisenmann (Walldorf, DE)
Assignee: SAP SE
G06F21/577G06F2221/033
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,699,779
App. No.
19/043,063
Filed
Jan 31, 2025
Granted
Aug 4, 2026
Kind
B1
Art Unit
2435
USPC
726/25
Abstract

A computer-implemented method can receive a vulnerability report for a software. The vulnerability report specifies a vulnerable library used by the software and a path of the vulnerable library within the software. The method can generate a summary of the vulnerability report using a generative artificial intelligence (AI) model, retrieve, from a bug report database, a set of relevant bug reports specifying the vulnerable library, generate a synopsis for the set of relevant bug reports using the generative AI model, generate multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and generate a final decision on validity of the vulnerability report based on the multiple preliminary decisions. Related systems and software for implementing the method are also disclosed.

Claims (61)

1 . A computing system comprising:

memory;

one or more hardware processors coupled to the memory; and

one or more computer readable storage media storing instructions that, when loaded into the memory, cause the one or more hardware processors to perform operations comprising:

receiving a vulnerability report for a selected software, wherein the vulnerability report specifies a vulnerable library used by the selected software and a path of the vulnerable library within the selected software;

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports; and

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.

2 . The computing system of claim 1 , wherein generating the summary of the vulnerability report comprises:

generating a vulnerability knowledge distillation prompt based on a first prompt template, wherein the first prompt template includes instructions for the generative AI model to extract, from the vulnerability report, vulnerability information of the vulnerability library used by the selected software; and

prompting the generative AI model with the vulnerability knowledge distillation prompt.

3 . The computing system of claim 1 , wherein the retrieving comprises:

searching the bug report database to identify a collection of bug reports for one or more historical software, wherein a bug report for a historical software specifies the vulnerability library used by the historical software and a path of the vulnerability library within the historical software; and

identifying, from the collection of bug reports, the set of relevant bug reports, wherein the identifying comprises comparing the path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software.

4 . The computing system of claim 3 , wherein the identifying further comprises:

adding the bug report for the historical software to the set of relevant bug reports if (i) the path of the vulnerability library within the historical software contains the path of the vulnerable library within the selected software, and (ii) a count of bug reports in the set of relevant bug reports is smaller than a predefined number; and

responsive to determining that the count of bug reports in the set of relevant bug reports is smaller than the predefined number after evaluating the collection of bug reports, iteratively comparing a sub-path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software, wherein the sub-path is derived by removing a prefix from the path of the vulnerable library within the selected software.

5 . The computing system of claim 1 , wherein generating the synopsis for the set of relevant bug reports comprises:

generating an expert knowledge distillation prompt based on a second prompt template, wherein the second prompt template includes instructions for the generative AI model to extract, from the set of relevant bug reports, summaries and validity classifications for the set of relevant bug reports; and

prompting the generative AI model with the expert knowledge distillation prompt.

6 . The computing system of claim 1 , wherein generating multiple preliminary decisions on validity of the vulnerability report comprises:

obtaining a plurality of muted prompts previously derived from a meta-prompt using the generative AI model based on a plurality of predefined thinking paradigms; and

separately prompting the generative AI model using the plurality of muted prompts, wherein prompting the generative AI model using a muted prompt is configured to generate one of the multiple preliminary decisions.

7 . The computing system of claim 6 , wherein the meta-prompt and the plurality of muted prompts include instructions for the generative AI model to (i) classify the vulnerability report as valid or invalid based on analysis of the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and (ii) generate a list of inference bugs which identify one or more relevant bug reports based on which the vulnerability report is classified as valid or invalid.

8 . The computing system of claim 6 , wherein generating the final decision on validity of the vulnerability report further comprises calculating a weighted sum of the multiple preliminary decisions.

9 . The computing system of claim 8 , wherein calculating the weighted sum comprises determining weights for the multiple preliminary decisions, wherein a weight for a preliminary decision is determined based on how many relevant bug reports, among the set of relevant bug reports, are found by the generative AI model to support the preliminary decision.

10 . The computing system of claim 8 , wherein the weighted sum is in a range divided into three non-overlapping sub-ranges, wherein the final decision indicates (i) the vulnerability report is valid, (ii) the vulnerability report is invalid, or (iii) validity of the vulnerability report is indeterministic, based on the sub-range into which the weighted sum falls.

11 . A computer-implemented method comprising:

receiving a vulnerability report for a selected software, wherein the vulnerability report specifies a vulnerable library used by the selected software and a path of the vulnerable library within the selected software;

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports; and

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.

12 . The computer-implemented method of claim 11 , wherein generating the summary of the vulnerability report comprises:

generating a vulnerability knowledge distillation prompt based on a first prompt template, wherein the first prompt template includes instructions for the generative AI model to extract, from the vulnerability report, vulnerability information of the vulnerability library used by the selected software; and

prompting the generative AI model with the vulnerability knowledge distillation prompt.

13 . The computer-implemented method of claim 11 , wherein the retrieving comprises:

searching the bug report database to identify a collection of bug reports for one or more historical software, wherein a bug report for a historical software specifies the vulnerability library used by the historical software and a path of the vulnerability library within the historical software; and

identifying, from the collection of bug reports, the set of relevant bug reports, wherein the identifying comprises comparing the path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software.

14 . The computer-implemented method of claim 13 , wherein the identifying further comprises:

adding the bug report for the historical software to the set of relevant bug reports if (i) the path of the vulnerability library within the historical software contains the path of the vulnerable library within the selected software, and (ii) a count of bug reports in the set of relevant bug reports is smaller than a predefined number; and

responsive to determining that the count of bug reports in the set of relevant bug reports is smaller than the predefined number after evaluating the collection of bug reports, iteratively comparing a sub-path of the vulnerable library within the selected software with the path of the vulnerability library within the historical software, wherein the sub-path is derived by removing a prefix from the path of the vulnerable library within the selected software.

15 . The computer-implemented method of claim 11 , wherein generating the synopsis for the set of relevant bug reports comprises:

generating an expert knowledge distillation prompt based on a second prompt template, wherein the second prompt template includes instructions for the generative AI model to extract, from the set of relevant bug reports, summaries and validity classifications for the set of relevant bug reports; and

prompting the generative AI model with the expert knowledge distillation prompt.

16 . The computer-implemented method of claim 11 , wherein generating multiple preliminary decisions on validity of the vulnerability report comprises:

obtaining a plurality of muted prompts previously derived from a meta-prompt using the generative AI model based on a plurality of predefined thinking paradigms; and

separately prompting the generative AI model using the plurality of muted prompts, wherein prompting the generative AI model using a muted prompt is configured to generate one of the multiple preliminary decisions.

17 . The computer-implemented method of claim 16 , wherein the meta-prompt and the plurality of muted prompts include instructions for the generative AI model to (i) classify the vulnerability report as valid or invalid based on analysis of the summary of the vulnerability report and the synopsis for the set of relevant bug reports, and (ii) generate a list of inference bugs which identify one or more relevant bug reports based on which the vulnerability report is classified as valid or invalid.

18 . The computer-implemented method of claim 16 , wherein generating the final decision on validity of the vulnerability report further comprises calculating a weighted sum of the multiple preliminary decisions.

19 . The computer-implemented method of claim 18 , wherein calculating the weighted sum comprises determining weights for the multiple preliminary decisions, wherein a weight for a preliminary decision is determined based on how many relevant bug reports, among the set of relevant bug reports, are found by the generative AI model to support the preliminary decision.

20 . One or more non-transitory computer-readable media having encoded thereon computer-executable instructions causing one or more processors to perform a method, the method comprising:

receiving a vulnerability report for a selected software, wherein the vulnerability report specifies a vulnerable library used by the selected software and a path of the vulnerable library within the selected software;

generating a summary of the vulnerability report using a generative artificial intelligence (AI) model;

retrieving, from a bug report database, a set of relevant bug reports specifying the vulnerable library;

generating a synopsis for the set of relevant bug reports using the generative AI model;

generating multiple preliminary decisions on validity of the vulnerability report using the generative AI model based on the summary of the vulnerability report and the synopsis for the set of relevant bug reports; and

generating a final decision on validity of the vulnerability report based on the multiple preliminary decisions.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 30, 2025
From: LIU, CHAO; LUAN, LAN; BOUHSAS, KHALDOUN; LI, YONG; LV, JINMING; XIE, QIAO-LUAN; EISENMANN, ANDREAS
To: SAP SE
Reel/Frame 070990/0093 →
References Cited (23)
US 10628764B1 · Kaplan · 2020 [cited by examiner]
US 20170357809A1 · Smith · 2017 [cited by examiner]
US 20220156383A1 · Schwarzbauer · 2022 [cited by examiner]
US 20230012722A1 · Del Rosario · 2023 [cited by examiner]
US 20230259705A1 · Tunstall-Pedoe · 2023 [cited by examiner]
US 20240330480A1 · Roytman · 2024 [cited by examiner]
US 20250356005A1 · Soliman · 2025 [cited by examiner]
US 20260100964A1 · Richard · 2026 [cited by examiner]
WO WO2023092511 · 2023 [cited by applicant]
Extended European Search Report, European Application No. 25225472.7, 9 pages, Mar. 9, 2026. [cited by applicant]
Mohajer et al., “SkipAnalyzer: An Embodied Agent for Code Analysis with Large Language Models,” ARXIV.org, arXiv:2310.18532v1, 5 pages, Oct. 27, 2023. [cited by applicant]
Black Duck Binary Analysis, https://www.blackduck.com/software-composition-analysis-tools/binary-analysis.html, 6 pages (downloaded Dec. 4, 2024). [cited by applicant]
NVD, “Understanding Vulnerability Detail Pages,” https://nvd.nist.gov/vuln, 2 pages (downloaded Dec. 4, 2024). [cited by applicant]
BlackDuck, “2024 Open Source Security and Risk Analysis Report, Your guide to securing your open source supply chain,” 18 pages, 2024. [cited by applicant]
Jo et al., “Vulcan: Automatic extraction and analysis of cyber threat intelligence from unstructured text,” [cited by applicant]
Haryono et al., “Automated Identification of Libraries from Vulnerability Data: Can We Do Better?,” [cited by applicant]
Ponta et al., “Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software,” [cited by applicant]
Lyu et al., “CHRONOS: Time-Aware Zero-Shot Identification of Libraries from Vulnerability Reports,” arXiv:2301.03944v4, 14 pages (downloaded Jul. 29, 2023). [cited by applicant]
Anwar et al., “Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses,” [cited by applicant]
Ponta et al., “Detection, assessment and mitigation of vulnerabilities in open source dependencies,” [cited by applicant]
Pearce et al., “Examining Zero-Shot Vulnerability Repair with Large Language Models,” arXiv:2112.02125v3, 18 pages (downloaded Aug. 15, 2022). [cited by applicant]
Chen et al., “Identifying Vulnerable Third-Party Java Libraries from Textual Descriptions of Vulnerabilities and Libraries,” [cited by applicant]
Fernando et al., Google DeepMind, “Promptbreeder: Self-Referential Self-Improvement Via Prompt Evolution,” arXiv:2309.16797v1, 64 pages (downloaded Sep. 28, 2023). [cited by applicant]