Log quality detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a log quality detection method and system, electronic equipment and a storage medium. The method comprises the following steps: acquiring a multi-modal input source; performing reverse anchoring operation in a dynamic analysis stage of the running log to establish direct mapping between the running log and the source code; compiling the abstract syntax tree based on the source code, establishing a grammar dependence graph according to the abstract syntax tree, and traversing the abstract syntax tree to construct a structured data set; based on the running log, obtaining a quality detection result through structured analysis, and generating a semantic detection result by using a large language model; performing cooperative operation on the structured data set and the grammar dependency graph to generate a code log coverage score, and performing arrangement according to a quality detection result and a semantic detection result to obtain an abnormal mode feature; and performing feedback adjustment based on the code log coverage score and the abnormal mode feature in combination with a preset correction rule. The method can efficiently and accurately realize log quality detection, and can be widely applied to the technical field of data processing.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly to a method, a system, an electronic device and a storage medium for log quality detection. Background Art

[0002] Logs play a core role in software operation and maintenance by recording the running status, supporting fault diagnosis and business analysis. However, traditional log printing highly depends on developers' manual writing, and its quality is limited by developers' experience and coding habits, with significant uncertainty and non-standardization. For example, developers may omit key variables (such as request ID, user identification) due to lack of unified specifications, or print redundant debugging information in the code, resulting in redundant or missing log content; at the same time, chaotic log formats (such as non-desensitized sensitive data, unstructured output) will increase the complexity of subsequent parsing and retrieval. More seriously, the misuse of log levels (such as abusing the DEBUG level in the production environment, not reasonably selecting INFO / WARN / ERROR levels according to business scenarios) will directly affect the availability of logs, making it difficult for operation and maintenance personnel to quickly locate problems.

[0003] Current mainstream methods mainly rely on manual code review or runtime log sampling inspection, both of which have obvious defects. Static analysis tools (such as code scanners) can only check the log statement formats in the source code, but cannot predict the effectiveness of the actual output during runtime; dynamic detection tools (such as log aggregation systems) can analyze log content, but it is difficult to trace back to design defects at the code level. In addition, existing methods lack a systematic evaluation criterion for log quality, neither verifying the context coverage of logs by combining code logic (such as variable dependency relationships) nor evaluating its traceability by integrating runtime log features (such as exception patterns), resulting in one-sided and lagging detection results. Summary of the Invention

[0004] The main objective of the embodiments of the present invention is to propose a method, a system, an electronic device and a storage medium for log quality detection, in order to solve at least one problem of the prior art. The present invention can accurately and efficiently implement log quality detection.

[0005] To achieve the above objective, on the one hand, an embodiment of the present invention proposes a method for log quality detection, the method including:

[0006] Obtain a multimodal input source; the multimodal input source includes source code and its running logs; implicit tags are pre-injected into the log output template of the source code; wherein, a reverse anchoring operation is performed based on the implicit tags during the dynamic parsing stage of the running logs to establish a direct mapping between the running logs and the source code;

[0007] Compile the abstract syntax tree based on the source code, establish a syntax dependency graph according to the abstract syntax tree, and traverse the abstract syntax tree to construct a structured data set;

[0008] Based on the running logs, obtain the quality detection results through structured parsing and use the large language model to generate semantic detection results;

[0009] Perform collaborative operations on the structured data set and the syntax dependency graph to generate a code log coverage score, and organize the abnormal pattern features based on the quality detection results and semantic detection results;

[0010] Based on the code log coverage score, abnormal pattern features, and combined with the preset correction rules, feedback and adjust the parsing steps of the source code and its running logs.

[0011] In some embodiments, establishing a syntax dependency graph according to the abstract syntax tree includes the following steps:

[0012] Based on the abstract syntax tree, parse and generate the complete syntax tree topology relationship through a preset interface, and then establish a syntax dependency graph between code elements according to the syntax tree topology relationship.

[0013] In some embodiments, traversing the abstract syntax tree to construct a structured data set includes the following steps:

[0014] Use the depth-first traversal algorithm to access all nodes of the abstract syntax tree, identify code blocks based on the results of all-node access and combined with the preset multi-level code block semantic feature library, and obtain a structured data set; the structured data set includes the code block type identifier, physical location coordinates, and regularization matching results of internal log statements of each code block in the source code.

[0015] In some embodiments, obtaining the quality detection results through structured parsing includes the following steps:

[0016] Use a multi-mode regular expression group to perform structured processing on the running logs and perform multi-level compensation on the running logs; multi-level compensation includes context inheritance compensation and semantic placeholder compensation;

[0017] Perform incremental clustering extraction on the running logs to obtain a standardized log pattern, and then construct a template encoding mapping;

[0018] Perform basic quality detection on the running logs based on a preset quality detection system; the quality detection system includes duplicate log detection, long log detection, and high-frequency log detection;

[0019] Construct an unsupervised quality detection model based on the isolation forest algorithm based on the results of the template encoding mapping, and fuse and make a decision on the output results of the unsupervised quality detection model and the results of the basic quality detection to obtain the quality detection results.

[0020] In some embodiments, generating semantic detection results using a large language model includes the following steps:

[0021] Based on the operation log, obtain the context information of the real-time output log line and its multiple previous logs through a sliding window;

[0022] Preprocess the context information to generate a natural query instruction;

[0023] Based on the natural query instruction, construct a context-related request containing historical log classification results using the dynamic prompt engineering method, and then call the large language model for semantic understanding and classification reasoning to obtain semantic detection results.

[0024] In some embodiments, implementing a reverse anchoring operation based on implicit tags in the dynamic parsing stage of the operation log to establish a direct mapping between the operation log and the source code includes the following steps:

[0025] Capture the implicit tags in the message field of the operation log through a regular expression group to establish a direct mapping between the operation log and the source code;

[0026] Perform a full-path match based on the module field of the operation log and the package structure of the source code, and then combine the preset directory hierarchy to achieve a coarse-grained association at the module granularity between the operation log and the source code.

[0027] In some embodiments, performing collaborative operations on the structured data set and the syntax dependency graph to generate a code log coverage score includes the following steps:

[0028] Based on the structured data set, correct the score of the code block with uncovered logs in the source code through a weighted attenuation algorithm according to the preset log coverage weight coefficient; the log coverage status of the code block is determined based on implicit tag association;

[0029] Based on the syntax dependency graph, use the abstract syntax tree to establish a semantic parsing context environment to capture the target reference relationship nodes, and then perform dynamic score adjustment on the log coverage completeness based on the variable dependency path through cross-file definition node tracking combined with the reverse path retrieval algorithm; the log coverage completeness is determined based on the log coverage status of each code block in the variable dependency path;

[0030] Generate a code log coverage score according to the results of score correction and dynamic score adjustment.

[0031] To achieve the above object, another aspect of the embodiments of the present invention proposes a log quality detection system, which includes:

[0032] A data input layer for obtaining multi-modal input sources; the multi-modal input sources include source code and its running logs; implicit tags are pre-injected into the log output template of the source code; wherein, during the dynamic parsing stage of the running logs, reverse anchoring operations are performed based on the implicit tags to establish a direct mapping between the running logs and the source code.

[0033] A core analysis layer for compiling an abstract syntax tree based on the source code, establishing a syntax dependency graph according to the abstract syntax tree, and traversing the abstract syntax tree to construct a structured data set.

[0034] And, based on the running logs, obtaining a quality detection result through structured parsing and generating a semantic detection result using a large language model.

[0035] A knowledge fusion layer for performing collaborative operations on the structured data set and the syntax dependency graph to generate a code log coverage score, and sorting out abnormal pattern features according to the quality detection result and the semantic detection result.

[0036] An intelligent enhancement layer for feedback adjustment of the parsing steps of the source code and its running logs based on the code log coverage score, abnormal pattern features, and a preset correction rule.

[0037] To achieve the above object, on the other hand, an embodiment of the present invention proposes an electronic device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the above method is implemented.

[0038] To achieve the above object, on the other hand, an embodiment of the present invention proposes a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0039] The embodiments of the present invention at least include the following beneficial effects: The present invention provides a log quality detection method, system, electronic device, and storage medium. This solution obtains multi-modal input sources; the multi-modal input sources include source code and its running logs; implicit tags are pre-injected into the log output template of the source code; among them, during the dynamic parsing stage of the running logs, a reverse anchoring operation is implemented based on the implicit tags to establish a direct mapping between the running logs and the source code; an abstract syntax tree is compiled based on the source code, a syntax dependency graph is established according to the abstract syntax tree, and a structured data set is constructed by traversing the abstract syntax tree; based on the running logs, a quality detection result is obtained through structured parsing, and a semantic detection result is generated using a large language model; a collaborative operation is performed on the structured data set and the syntax dependency graph to generate a code log coverage score, and an abnormal pattern feature is sorted out according to the quality detection result and the semantic detection result; based on the code log coverage score, the abnormal pattern feature, and a preset correction rule, the parsing steps of the source code and its running logs are feedback-adjusted. Through pre-injecting implicit tags and reverse anchoring operations, the present invention establishes a direct mapping relationship between the running logs and the source code, realizes the precise association between the execution path and the code structure, and provides a reliable data basis for quality assessment; moreover, the present invention combines the syntax dependency graph and the structured data set to achieve a comprehensive parsing of the static characteristics of the code, and through the double verification of the quality detection result and the semantic detection result, the defect recognition accuracy is improved. Through the innovative multi-modal fusion analysis and intelligent feedback mechanism, the present invention realizes the technical leap of code quality detection from one-sided to comprehensive, from passive to active, and from descriptive to guiding, and provides a brand-new quality guarantee solution for the software engineering field. The present invention can efficiently and accurately implement log quality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is a flowchart of the log quality detection method provided by the embodiments of the present invention;

[0041] Figure 2 is a schematic diagram of an overall process architecture example of the log quality detection method provided by the embodiments of the present invention;

[0042] Figure 3 is a schematic structural diagram of the log quality detection system provided by the embodiments of the present invention;

[0043] Figure 4 is a schematic hardware structure diagram of the electronic device provided by the embodiments of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0044] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are only examples of systems and methods consistent with some aspects of the embodiments of the present invention as detailed in the appended claims.

[0045] It can be understood that the terms "first", "second", etc. used in the present invention can be used in the present invention to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present invention, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the words "if", "when" as used herein can be interpreted as "when...", "while...", or "in response to determining".

[0046] The terms "at least one", "a plurality of", "each", "any one", etc. used in the present invention, at least one includes one, two or more than two, a plurality includes two or more than two, each refers to each of the corresponding plurality, and any one refers to any one of the plurality.

[0047] Unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs. The terms used in the present invention are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0048] The log quality detection method provided by the embodiments of the present invention relates to the technical field of data processing. The log quality detection method provided by the embodiments of the present invention can be applied to a terminal, can also be applied to a server, or can be software running on a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a vehicle terminal, etc., but is not limited thereto; the server side can be configured as an independent physical server, can also be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the log quality detection method, etc., but is not limited to the above forms.

[0049] The present invention can be used in numerous general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in a distributed computing environment where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0050] Figure 1 is an optional flowchart of the log quality detection method provided by an embodiment of the present invention. Figure 1 The method in may include but is not limited to steps S100 to S500.

[0051] S100. Obtain a multi-modal input source;

[0052] Among them, the multi-modal input source includes source code and its running log; implicit tags are pre-injected into the log output template of the source code; a direct mapping between the running log and the source code is established by performing a reverse anchoring operation based on the implicit tags during the dynamic parsing stage of the running log.

[0053] It should be noted that in some embodiments, establishing a direct mapping between the running log and the source code by performing a reverse anchoring operation based on the implicit tags during the dynamic parsing stage of the running log may include the following steps: capturing the implicit tags in the message field of the running log through a regular expression group to establish a direct mapping between the running log and the source code; performing a full-path match based on the module field of the running log and the package structure of the source code, and then combining the preset directory hierarchy output to achieve a coarse-grained association at the module granularity between the running log and the source code.

[0054] Exemplarily, in some specific embodiments, injecting implicit tags: compile-time macro variables (such as __FILE__, FUNCTION) can be inserted into the log output template to dynamically generate visual tags carrying the source code location (such as "[@AbilityRuntime::RegisterSystemAbility:123]"); specifically, the runtime application context enhancement mechanism is applied, and the system performs a reverse anchoring operation during the dynamic parsing stage of the log:

[0055] Field-level feature extraction: Capture implicit tags in the log message field through a regular expression group, and establish a direct mapping with the source code coordinates;

[0056] Module topology matching: Based on the module / submodule fields of the log, perform full-path matching with the package structure of the source code, and combine the directory hierarchy tree of the code repository to achieve coarse-grained association at the module level.

[0057] S200. Compile the abstract syntax tree based on the source code, establish a syntax dependency graph according to the abstract syntax tree, and traverse the abstract syntax tree to construct a structured data set;

[0058] Exemplarily, in some specific embodiments, an AST (abstract syntax tree) structure can be constructed based on the Clang compiler front end.

[0059] It should be noted that in some embodiments, establishing a syntax dependency graph according to the abstract syntax tree may include the following steps: Based on the abstract syntax tree, parse through a preset interface to generate a complete syntax tree topology relationship, and then establish a syntax dependency graph between code elements according to the syntax tree topology relationship.

[0060] Exemplarily, in some specific embodiments, the libclang interface can be used to parse the source code to generate a complete syntax tree topology relationship and establish a syntax dependency graph between code elements.

[0061] It should be noted that in some embodiments, traversing the abstract syntax tree to construct a structured data set may include the following steps: Use the depth-first traversal algorithm to access all nodes of the abstract syntax tree, identify code blocks based on the results of all-node access in combination with a preset multi-level code block semantic feature library to obtain a structured data set; the structured data set includes the code block type identifier, physical location coordinates, and regularized matching results of internal log statements in the source code.

[0062] Exemplarily, in some specific embodiments, the depth-first traversal algorithm is used to implement full-node access to the AST, and precise code block identification is implemented in combination with a multi-level code block semantic feature library: Based on the CursorKind enumeration type, determine the semantic category of the node (such as FUNCTION_DECL corresponding to the function declaration node), call the cursor.extent method to obtain the physical span range of the code, and perform logical expression boundary optimization processing for special syntax structures such as conditional statements, and finally output a structured data set including the code block type identifier, physical location coordinates, and regular matching results of internal log statements.

[0063] S300. Based on the running log, obtain the quality detection result through structured parsing and generate the semantic detection result using a large language model;

[0064] It should be noted that in some embodiments, obtaining the quality detection result through structured parsing may include the following steps: performing structured processing on the operation log by using a multi-mode regular expression group, and performing multi-level compensation on the operation log; the multi-level compensation includes context inheritance compensation and semantic placeholder compensation; performing incremental clustering extraction on the operation log to obtain a standardized log pattern, and then constructing a template encoding mapping; performing basic quality detection on the operation log based on a preset quality detection system; the quality detection system includes duplicate log detection, long log detection, and high-frequency log detection; constructing an unsupervised quality detection model based on the isolation forest algorithm based on the result of the template encoding mapping, and making a fusion decision on the output result of the unsupervised quality detection model and the result of the basic quality detection to obtain the quality detection result.

[0065] Exemplarily, in some specific embodiments, by executing a log structured parsing engine, a multi-mode regular expression group can be used to perform structured processing on the original log stream: accurately extract 7 core fields such as timestamp, process ID (pid), thread ID (tid), error level (level), function module (module), sub-module (submodule), and message body (message), and establish a fault-tolerant parsing mechanism to implement null value marking for logs with abnormal formats.

[0066] At the same time, to reduce the impact of null values on subsequent analysis, the system implements a two-level compensation strategy: Context inheritance compensation: For logs missing the module / submodule fields, establish a cache queue for the nearest valid values, and extract the nearest valid module information with the same pid / tid through a two-way sliding window (for example, 3 forward windows and 2 backward windows); Semantic placeholder compensation: For entries with parsing failures in the message field, retain the original text and add a <PARSE_ERR> mark to reduce the impact on subsequent analysis processes.

[0067] In addition, log template extraction can also be implemented based on the Drain3 incremental clustering algorithm, and a standardized log pattern (such as "Connection to *timed out") is output through a parameterized template generation engine to construct a template encoding mapping. The parameter settings of the Drain3 incremental clustering algorithm are determined based on statistical analysis of log features:

[0068] Similarity threshold: Calculate the Levenshtein distance distribution of the first 1000 logs, and take the 75th percentile as the initial threshold (typical value 0.6 - 0.8);

[0069] Clustering depth: Set the tree depth according to the average number of parameters of the log template (empirical formula depth = log2(N_param + 2));

[0070] Maximum number of child nodes: Dynamically set according to the log length distribution (set to 10 when the length ≤ 50, 20 when 50 - 100, and 50 when > 100).

[0071] Meanwhile, implement a three - level basic quality detection system:

[0072] Duplicate log detection: Use the MD5 hash algorithm to generate 128 - bit log fingerprints, construct an inverted index dictionary of <hash value, log position>, and design a sliding time window mechanism to achieve real - time detection and marking of local duplicate logs.

[0073] Long log detection: Set the upper limit of character length based on a dynamic threshold configuration mechanism, perform length statistics on log entries through a real - time character counter, and mark abnormal logs that exceed the threshold.

[0074] High - frequency log detection: Construct a mapping matrix of <template hash, temporal position>, adopt a template interval statistical algorithm within a sliding window, calculate the average time interval of logs with the same template through a time density model, and trigger an abnormal mark when the interval value is lower than the preset threshold.

[0075] Finally, construct an unsupervised quality detection model based on the Isolation Forest algorithm. The feature engineering includes:

[0076] ① Four - dimensional basic features: Template encoding (discrete), template occurrence frequency (continuous), error level encoding (discrete), error level distribution frequency (continuous);

[0077] ② Context features: Use a bidirectional sliding time window to extract template sequence features and error level transition probability matrices of the 5 pre - and post - logs, and process missing values at the window boundaries through a combination strategy of forward filling (ffill) and backward filling (bfill).

[0078] Based on the above features, the embodiments of the present invention use LabelEncoder to implement the vectorization conversion of classification features. After standardization by StandardScaler, a dynamic threshold adaptive algorithm is used to determine quality anomaly points. Finally, the model output is fused with the previous three - level detection results through a logical OR operator for decision - making.

[0079] It should be noted that in some embodiments, using a large - language model to generate semantic detection results may include the following steps: Based on the running log, obtain the real - time output log line and the context information of multiple previous logs through a sliding window; pre - process the context information to generate a natural query instruction; construct a context - related request containing historical log classification results using the dynamic prompting engineering method based on the natural query instruction, and then call the large - language model for semantic understanding and classification reasoning to obtain the semantic detection result.

[0080] Exemplarily, in some specific embodiments, in this special and important aspect of log level quality detection, the embodiments of the present invention also introduce a large language model for semantic-level anomaly detection. This module performs multi-dimensional analysis on log entries by constructing a context-aware large language model interaction mechanism. In a specific implementation, the system obtains the context information of the current log line and its previous three logs through a sliding window, and generates a natural language query instruction after preprocessing the log level marking and clearing. The dynamic prompt engineering method is used to construct a context-related request containing the historical log classification results, and interact with the locally deployed large language model through an API interface to trigger the model's semantic understanding and classification reasoning of the current log.

[0081] S400. Coordinate the operation of the structured data set and the syntax dependency graph to generate a code log coverage score, and organize the abnormal pattern features according to the quality detection result and the semantic detection result;

[0082] It should be noted that in some embodiments, coordinating the operation of the structured data set and the syntax dependency graph to generate a code log coverage score may include the following steps: Based on the structured data set, correct the score of the code block without covered logs through a weighted decay algorithm according to the preset log coverage weight coefficient; The log coverage status of the code block is determined based on implicit marker association; Based on the syntax dependency graph, use the abstract syntax tree to establish a semantic parsing context environment to capture the target reference relationship nodes, and then dynamically adjust the score based on the log coverage completeness of the variable dependency path through cross-file definition node tracking combined with the reverse path retrieval algorithm; The log coverage completeness is determined based on the log coverage status of each code block in the variable dependency path; Generate a code log coverage score according to the results of score correction and dynamic score adjustment.

[0083] Exemplarily, in some specific embodiments, first establish a code block type weight assignment matrix, preset different log coverage weight coefficients for control flow key nodes (such as conditional statement true / false branches, loop body entry nodes, etc.), and correct the score of the code block without covered logs through a weighted decay algorithm. The calculation formula is: Score = Σ(Weight_i × Coverage_i), where Coverage_i ∈ {0,1} represents the log coverage status.

[0084] Furthermore, a cross-file variable dependency analysis system is constructed. A semantic parsing context environment is established based on the Clang AST. A current_path stack data structure is designed to dynamically maintain the current semantic context path, accurately capturing 14 types of cross-context reference relationship nodes, such as TYPE_REF (type reference) and MEMBER_REF (member reference). The cross-file definition node tracking is realized through the cursor.referenced interface. Combining with the reverse path retrieval algorithm, the context relationships such as namespaces and class member functions are traced back along the current_path. At the same time, the entry / exit points of the variable scope are marked, and the dynamic score adjustment is performed based on the log coverage completeness of the variable dependency path. To ensure the accuracy of the current_path stack in multi-threaded and asynchronous calls, an independent copy of the current_path stack is created for each thread, and physical isolation is achieved through the Python standard library threading.local(). At the same time, the push / pop operations of the stack are atomically encapsulated to avoid instruction interleaving.

[0085] Finally, through the collaborative operation of the code block weight evaluation module and the variable dependency analysis module, a comprehensive quality score for the source code log coverage is generated and the multi-dimensional evaluation metrics are persistently stored for subsequent quality traceability.

[0086] S500. Based on the code log coverage score and the abnormal pattern features, the parsing steps of the source code and its running log are feedback-adjusted in combination with the preset correction rules.

[0087] Exemplarily, in some specific embodiments, the embodiments of the present invention implement parameter dynamic tuning through a two-way correction mechanism for the static code rule weights and the dynamic detection thresholds, and form a self-iterative log quality optimization system through cross-modal feature association (such as the coupling relationship between the code block risk level and the log error frequency).

[0088] To explain the principle of the technical solution of the present invention in detail, the overall process of the present invention will be described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0089] First of all, it should be noted that the log data generated during the operation of modern software systems is the core basis for developers to understand the system behavior and locate runtime exceptions. However, with the wide application of distributed architectures and microservices technologies, the exponential growth of system complexity has made the generation, analysis, and maintenance of logs face multiple technical challenges.

[0090] During the log generation phase, developers often need to manually insert log statements into the code to record key states. This process highly depends on personal experience. Especially when determining the log level, for example, there is a lack of objective criteria for distinguishing the boundary between warnings (warn) and errors (error). An overly high log level may lead to false alarms of critical failures, while an overly low level will cause important information to be submerged in a vast amount of low-value logs. At the same time, the correlation between log statements and the source code logic is insufficient. For example, it is difficult to trace the dynamic relationship between variable execution paths and log parameters, further increasing the difficulty of post-event analysis.

[0091] In the field of software engineering, log management technology has long faced efficiency bottlenecks in the entire "generation - analysis - maintenance" link. Existing solutions mainly focus on three directions: static code analysis, dynamic log collection, and rule engines.

[0092] Static code analysis tools, represented by Clang and SonarQube, have a core process that starts with parsing the source code. The tool constructs an Abstract Syntax Tree (AST) through lexical and syntactic analysis to identify log statements embedded in the code (such as function calls like LOG.debug() or Logger.error()). Subsequently, based on a predefined rule library, it conducts structural verification on log-related code, for example, checking whether log resources are correctly released in code branches or verifying whether the parameter types of log functions conform to the syntax specifications. Finally, it outputs the detection results, marking basic problems such as unclosed log handles and incorrect parameter types.

[0093] Dynamic log detection solutions are implemented based on the ELK (Elasticsearch, Logstash, Kibana) technology stack, and the workflow covers the log collection, processing, and analysis phases. The system uses a lightweight agent (such as Filebeat) to collect raw log files from distributed nodes in real time and transfer them to Logstash for pipeline processing. Logstash uses regular expressions to parse and filter the log content, extracts structured fields such as timestamps, log levels, and message bodies, and matches predefined exception patterns (such as log lines containing keywords like "error" or "exception"). The processed log data is stored in Elasticsearch, and finally, through the visualization interface of Kibana, it provides functions such as log aggregation query, time series statistics, and dashboard display.

[0094] Taking the Log4j 2.x framework as an example, rule-driven logging systems rely on predefined configuration files for operation. Developers need to declare logging level filtering policies (such as logging only WARN and above-level logs), output format templates (such as defining fields like time format, thread identifier, log content, etc.), and output destinations (such as files, consoles, or remote servers) in XML or YAML files. The system loads these configurations at startup to initialize loggers, filters, and output channels. During program execution, the logging framework dynamically filters log events according to the configured rules and outputs the qualified content to the specified destination in the preset format. For example, detailed debug logs are output in the development environment, while only critical error information is retained in the production environment.

[0095] However, the content in the above three directions has the following disadvantages:

[0096] Static code analysis solutions: Tools represented by Clang and SonarQube detect code defects by parsing the Abstract Syntax Tree (AST). Some extension plugins can identify basic problems such as unclosed logging statements (such as not calling LOG.close()). Although such solutions can locate syntax errors at the code level, they lack the ability to deeply reason about log semantics. For example, they cannot judge the matching degree between the logging level and the risk level of the code block, or identify log parameter ambiguities caused by missing variable dependencies (such as not verifying whether userId is empty in LOG.info("Processing user:"+userId)).

[0097] Dynamic log detection solutions: The technology stack based on ELK (Elasticsearch, Logstash, Kibana) realizes anomaly detection by collecting and parsing log data in real time. Its core relies on regular expressions to match predefined error patterns (such as / error|exception / i). However, in complex scenarios such as multi-threaded cross-logging and distributed transaction chain tracing, the fixed regular rule library is difficult to adapt to the dynamically changing log characteristics. For example, when microservice instances are scaled out, the logs generated by new nodes may contain unknown identifiers, causing the original rules to fail.

[0098] Rule-driven logging systems: Enterprise-level logging frameworks (such as Log4j 2.x) allow developers to configure logging level filtering policies and support defining output formats through XML / YAML files. Such solutions hard-code log rules in configuration files. Although they can achieve basic filtering, rule updates require manual intervention and cannot be automatically optimized according to the runtime context. For example, when the system switches from the development environment to the production environment, the fixed DEBUG-level filtering policy may lose key diagnostic information.

[0099] In view of this, the core problem solved by the present invention is: how to establish a detection mechanism to achieve a deep association between code logic and post-run logs. At the static level, key code blocks and variable dependencies need to be identified from the source code, and it is necessary to verify whether the log printing code covers the necessary context; at the dynamic level, the information integrity and level rationality of the log content need to be analyzed and matched with the static rules. At the same time, a collaborative feedback mechanism for static and dynamic analysis results needs to be constructed, optimizing the static rule weights through dynamic detection results, and introducing a large language model (LLM) to achieve scenario-based intelligent determination of log levels and generation of correction suggestions. As Figure 2 shown, the technical solution of the present invention consists of four parts, namely the data input layer, the core analysis layer, the knowledge fusion layer, and the intelligent enhancement layer. Specifically, taking the Figure 2 process architecture shown as an example, the present invention can be implemented through the following process:

[0100] 1. The data input layer receives a bimodal input source, including a source code library set for detecting the quality of log marking and the original log output stream generated during the program operation, and establishes a dual-track data processing channel for static analysis of the source code and dynamic analysis of the running logs.

[0101] In some specific application scenarios, to achieve an accurate mapping between the running logs and the source code, the present invention constructs a multi-dimensional feature anchoring system and establishes a two-way traceability channel through the following secondary association strategy:

[0102] (1) Structured metadata embedding mechanism: In the source code preprocessing stage, the system automatically captures the context metadata of the log statements through AST parsing. For each log output statement (such as the TAG_LOGE / log.info call node), the system performs the following operations:

[0103] Extract the code physical coordinates: Obtain the file name, start line number, and column number information through cursor.extent;

[0104] Generate a semantic signature: Construct a hierarchical identifier based on the function call chain, in the format of [class name]::[method name]#[code block type]_[nested level];

[0105] Inject implicit markers: Insert compile-time macro variables (such as __FILE__, FUNCTION) into the log output template to dynamically generate a visual marker carrying the source code location (such as "[@AbilityRuntime::RegisterSystemAbility:123]").

[0106] (2) Runtime context enhancement mechanism: The system performs reverse anchoring operations during the dynamic log parsing stage:

[0107] Field-level feature extraction: Capture implicit tags in the log message field through a regular expression group, and establish a direct mapping with the source code coordinates;

[0108] Module topology matching: Based on the module / submodule fields of the log, perform full-path matching with the package structure of the source code, and combine the directory hierarchy tree of the code repository to achieve coarse-grained association at the module level.

[0109] 2. The core analysis layer implements a dual-path collaborative analysis mechanism, and performs special processing on the source code data and the running log data respectively:

[0110] The analysis process for the source code data is as follows:

[0111] (1) Build an AST (Abstract Syntax Tree) structure based on the Clang compiler front end, parse the source code through the libclang interface to generate the complete topological relationship of the syntax tree, and establish a syntax dependency graph between code elements.

[0112] (2) Use the depth-first traversal algorithm to implement full access to AST nodes, and combine the multi-level code block semantic feature library to implement accurate code block recognition: Based on the CursorKind enumeration type, determine the semantic category of the node (such as FUNCTION_DECL corresponding to the function declaration node), call the cursor.extent method to obtain the physical span range of the code, and perform logical expression boundary optimization processing for special syntax structures such as conditional statements. Finally, output a structured data set containing the code block type identifier, physical location coordinates, and regular matching results of internal log statements.

[0113] In some specific application scenarios, during the static analysis process, the system realizes a strong association between the code location and the log output through the following technologies:

[0114] Establish a spatial index for log statements: When traversing the AST and identifying a log output node, immediately record the syntax structure context where it is located: the type of the parent node (such as function body, conditional branch, loop structure), and the control flow criticality: Calculate the log coverage priority of the current position based on the code block weight matrix.

[0115] In some specific application scenarios, during dynamic log parsing, the system realizes reverse positioning through the following steps: Parse the __FILE__ and __LINE__ tags injected during compilation from the log message, capture implicit tags in the log message field through a regular expression group (such as "[@AbilityRuntime::RegisterSystemAbility:123]"), and for log entries lacking location information, use a fuzzy matching algorithm: Match candidate log statements in the code based on the log template similarity.

[0116] (3) Establish a weight assignment matrix for code block types. Preset differentiated log coverage weight coefficients for control flow critical nodes (such as the true / false branches of conditional statements, the entry nodes of loop bodies, etc.). Implement score correction for code blocks with uncovered logs through a weighted decay algorithm. The calculation formula is: Score = Σ(Weight_i × Coverage_i), where Coverage_i ∈ {0, 1} represents the log coverage status.

[0117] (4) Build a cross-file variable dependency analysis system. Establish a semantic parsing context environment based on Clang AST. Design a current_path stack data structure to dynamically maintain the current semantic context path, and accurately capture 14 types of cross-context reference relationship nodes including TYPE_REF (type reference), MEMBER_REF (member reference), etc. Implement cross-file definition node tracking through the cursor.referenced interface. Combine the reverse path retrieval algorithm to trace the context relationships such as namespaces and class member functions along the current_path. At the same time, mark the entry / exit points of variable scopes, and perform dynamic score adjustment based on the log coverage completeness of the variable dependency path. To ensure the accuracy of the current_path stack in multi-threaded and asynchronous calls, create an independent copy of the current_path stack for each thread, implement physical isolation through the Python standard library threading.local(), and at the same time atomically encapsulate the push / pop operations of the stack to avoid instruction interleaving.

[0118] (5) Through the collaborative operation of the code block weight evaluation module and the variable dependency analysis module, generate a comprehensive quality score for the source code log coverage, and persistently store multi-dimensional evaluation metrics for subsequent quality traceability.

[0119] 3. The processing flow of the core analysis layer for the running log data is as follows:

[0120] (1) The execution log structured parsing engine uses a multi-mode regular expression group to perform structured processing on the original log stream: accurately extract 7 core fields, namely timestamp, process ID (pid), thread ID (tid), error level (level), function module (module), sub-module (submodule), and message body (message), and establish a fault-tolerant parsing mechanism to mark null values for logs with abnormal formats. To reduce the impact of null values on subsequent analysis, the system implements a two-level compensation strategy: Context inheritance compensation: For logs missing the module / submodule fields, establish a cache queue of the most recent valid values, and extract the nearest valid module information with the same pid / tid through a two-way sliding window (3 entries in the forward window and 2 entries in the backward window); Semantic placeholder compensation: For entries where the message field parsing fails, retain the original text and add the <PARSE_ERR> mark to reduce the impact on subsequent analysis processes.

[0121] (2) Implement log template extraction based on the Drain3 incremental clustering algorithm. Generate a standardized log pattern (such as "Connection to*timed out") through a parameterized template generation engine, and construct a template encoding mapping. The parameter settings of the Drain3 incremental clustering algorithm are determined based on statistical analysis of log features:

[0122] Similarity threshold: Calculate the Levenshtein distance distribution of the first 1000 logs, and take the 75th percentile as the initial threshold (typical value 0.6 - 0.8);

[0123] Clustering depth: Set the tree depth according to the average number of parameters of the log template (empirical formula depth = log2(N_param + 2));

[0124] Maximum number of child nodes: Dynamically set according to the log length distribution (set to 10 when the length ≤ 50, 20 when 50 - 100, and 50 when > 100).

[0125] (3) Implement a three-level basic quality detection system:

[0126] Duplicate log detection: Use the MD5 hash algorithm to generate 128-bit log fingerprints, construct an inverted index dictionary of <hash value, log position>, and design a sliding time window mechanism to achieve real-time detection and marking of local duplicate logs.

[0127] Long log detection: Set the upper limit of the character length based on a dynamic threshold configuration mechanism, count the length of log entries through a real-time character counter, and mark abnormal logs that exceed the threshold.

[0128] High-frequency log detection: Construct a <template hash, temporal position> mapping matrix, adopt the template interval statistical algorithm within a sliding window, calculate the average time interval of logs with the same template through a time density model, and trigger an anomaly flag when the interval value is lower than a preset threshold.

[0129] (4) Construct an unsupervised quality detection model based on the Isolation Forest algorithm. Feature engineering includes:

[0130] ① Four-dimensional basic features: template encoding (discrete), template occurrence frequency (continuous), error level encoding (discrete), error level distribution frequency (continuous);

[0131] ② Context features: Extract the template sequence features and error level transition probability matrix of the first 5 and last 5 logs before and after using a bidirectional sliding time window, and process the missing values at the window boundaries through a combination strategy of forward filling (ffill) and backward filling (bfill).

[0132] Based on the above features, in this part, LabelEncoder is used to realize the vectorization conversion of classification features. After standardization processing by StandardScaler, a dynamic threshold adaptive algorithm is used to determine quality anomaly points. Finally, the model output is fused with the previous three-level detection results through a logical OR operator for decision-making.

[0133] (5) Additionally, in this special and important aspect of log level quality detection, this system introduces a large language model for semantic-level anomaly detection. This module analyzes log entries in multiple dimensions by constructing a context-aware large language model interaction mechanism. In specific implementation, the system obtains the context information of the current log line and its previous three logs through a sliding window, and generates a natural language query instruction after preprocessing to remove the log level label. The dynamic prompt engineering method is used to construct a context-related request containing the historical log classification results, and interact with the locally deployed large language model through an API interface to trigger the model's semantic understanding and classification reasoning of the current log.

[0134] The system establishes a double verification mechanism to process the model output. First, extract the standardized log type keywords through regular expressions, and use a forced mapping strategy to convert complete words into standard level encodings (I / E / W). Set an anomaly flag bit to dynamically compare the model output level with the original log level, and automatically trigger an anomaly flag when a level inconsistency is detected. For the unstructured output returned by the model, the system establishes a cleaning and fault tolerance mechanism, and retains the original semantic information through newline character replacement and space compression operations to form a traceable output field.

[0135] In some specific application scenarios, the intelligent enhancement layer of the present invention realizes the dynamic optimization of detection parameters by constructing a closed-loop feedback system, and its core process includes the following stages:

[0136] (1) Cross-modal feature association stage: The system first establishes a deep association model between the static features of the code and the dynamic features of the logs. By aligning the functional semantics of the code modules with the context features of the runtime logs, the coupling relationship between the abnormal pattern of code block weight distribution and the corresponding log abnormal features (such as high-frequency errors, level offsets) is extracted.

[0137] (2) Parameter optimization decision stage: The large language model receives the cross-modal association features as input, combines the historical parameter configurations and manual correction records, and generates a multi-dimensional parameter adjustment strategy. The model judges the log coverage requirements of key control flow nodes by parsing the code semantic context, and dynamically corrects the weight distribution coefficient; at the same time, it analyzes the distribution law of the log abnormal patterns, and optimizes the abnormal judgment threshold of the isolation forest and the tolerance upper limit of the log length / frequency. For the log level calibration requirement, the model reconstructs the confidence threshold of the level mapping by integrating the semantic understanding results and the original level annotations.

[0138] The solution of the present invention uses the open-source openharmony source code in the experimental data, and performs dual-track analysis on the source code and runtime logs in the ability_runtime code library therein. Specifically:

[0139] Dynamic detection results of runtime logs:

[0140] Through the collaborative work of multiple-level analysis modules, the present invention identifies log quality problems that conform to the anti-pattern classification framework in the runtime logs, and the detection results are as follows:

[0141] (1) Detection of redundant and overly long logs: Log entries containing full-scale parameter outputs are detected in the core function modules. Each log contains more than 70 numerical parameter outputs, triggering the length warning mechanism of the dynamic threshold module. In addition, log outputs containing system internal information are found in the database operation module, and complete JSON structure logs are output by the module Distributed_Device_Profile; 3 types of sensitive information leaks are found in the module Rdb, including database Schema structure declarations.

[0142] (2) Misuse of log levels: Deviation of level identifiers is detected in the fault event logs in the key function modules. Through the semantic context verification of the large language model, the system confirms that its level annotation does not match the severity of the event: there are log entries with misused level identifiers in the regular business processes; the sensor control failure event is marked as the INFO level; the ordinary service call logs occupy the WARNING channel; the dynamic library loading operation is mislabeled as the ERROR level.

[0143] (3) High-frequency repeated detection: The system detected that the constructor / destructor function logs repeated 80 times within a 1ms time window in the Distributed_Device_Profile module. The abnormal time density was identified through the <template hash, timing position> mapping matrix, triggering a flow control alarm. At the same time, it was detected that the non-error status log "current hap isnot overlayed hap" in the BundleMgrService module appeared 4 times within 200ms, and the frequency also exceeded the preset threshold.

[0144] Static detection results of the source code:

[0145] Through the code block weight allocation and syntax tree traversal algorithm, the following log position defects were identified in the openharmony / ability_runtime code library. Taking the final analysis result of the sa_mgr_client.cpp source code file as an example:

[0146] (1) Missing logs at the core method entry: In the method declaration of sa_mgr_client.cpp (RegisterSystemAbility method declaration block), as the core entry method for system service registration, its declaration node does not contain any log statements.

[0147] (2) Unbalanced log coverage across conditional branches: Inside the nested conditional structure of sa_mgr_client.cpp (IF_STMT[] → IF_STMT[] → IF_STMT[]), in the three-layer conditional nesting, the logs only cover the innermost exception path, and no log statements are added at the entrance of the outer conditional judgment (and the intermediate layer object initialization path).

[0148] (3) Missing log points in the loop structure: In the loop block of sa_mgr_client.cpp (DO_STMT[] structure, context chain depth 4), in the loop logic involving the update of the servicesMap_ status, no loop counter or iteration status logs were detected. After verification by syntax tree traversal, there are 3 variable modification operations inside this loop body, but there are no corresponding variable change logs.

[0149] In summary, the specific technical solutions of the present invention are as follows:

[0150] 1. Dual-track detection mechanism of dynamic and static coordination:

[0151] Through the collaborative verification of static code semantic analysis (AST parsing, variable dependency tracking) and dynamic log feature mining (structured parsing, abnormal pattern recognition), the limitations of traditional single-dimensional detection are broken through, and cross-modal quality assessment of code logic and runtime logs is achieved.

[0152] 2. Semantic understanding system enabled by large language model:

[0153] Build an LLM-based log level intelligent judgment module to solve the problem of insufficient generalization ability of traditional rule base for unseen log patterns through context-aware semantic reasoning (such as analysis of the matching degree between log content and code intent).

[0154] 3. Adaptive optimization system driven by closed-loop feedback:

[0155] A two-way correction mechanism for code static rule weights and dynamic detection thresholds is established, and dynamic parameter tuning is achieved through cross-modal feature association (such as the coupling relationship between code block risk level and log error frequency), forming a self-iterative log quality optimization system.

[0156] 4. Multi-level quality assessment model:

[0157] It includes a three-level evaluation architecture consisting of a code coverage scoring model (based on AST node weight distribution), basic log quality detection (duplicate / long logs / high-frequency anomalies), and unsupervised anomaly detection (isolation forest algorithm), to achieve full-dimensional quality monitoring from syntax to semantics.

[0158] Compared with the prior art, the present invention has at least the following beneficial effects:

[0159] (1) Breakthrough in detection dimensions and collaborative verification to improve confidence:

[0160] In the prior art, static analysis tools (such as Clang) and dynamic log systems (such as ELK) run independently, resulting in a separation between code specification checking and runtime log quality. This invention pioneered a dynamic and static dual-track collaborative analysis mechanism, which significantly improves the credibility of detection results through cross-validation of code coverage scoring models (based on AST node weights) and log dynamic abnormal patterns (such as high-frequency errors, level offsets).

[0161] (2) Semantic understanding capability: large language models enable unknown scenarios:

[0162] Traditional solutions rely on artificial rule bases (such as fixed configuration of Log4j) and regular expression matching, which may fail when faced with unseen log templates dynamically generated in microservice architecture. This paper introduces a large language model (LLM) to achieve intelligent classification and level calibration of unknown log templates through context-aware semantic reasoning (such as parsing the relevance of log messages and code control flow intent).

[0163] (3) Rule adaptability, closed-loop feedback-driven dynamic tuning:

[0164] The prior art requires manual maintenance of multiple sets of rule libraries (such as the static detection rules of SonarQube and the regular expression library of ELK). Especially when switching system environments (such as from development to production environment), it is necessary to manually adjust the thresholds. Through the construction of cross-modal feature associations and the utilization of large language models, the present invention couples and analyzes the risk level (static) of code blocks with the error frequency of logs (dynamic), and combines historical parameters and manual correction records to achieve autonomous optimization of detection thresholds and weight coefficients.

[0165] On the other hand, as Figure 3 shown, an embodiment of the present invention also provides a log quality detection system 900, which may include:

[0166] A data input layer 901 for obtaining multimodal input sources; the multimodal input sources include source code and its running logs; implicit tags are pre-injected into the log output template of the source code; wherein, during the dynamic parsing stage of the running logs, reverse anchoring operations are performed based on the implicit tags to establish a direct mapping between the running logs and the source code.

[0167] A core analysis layer 902 for compiling an abstract syntax tree based on the source code, establishing a syntax dependency graph according to the abstract syntax tree, and traversing the abstract syntax tree to construct a structured data set;

[0168] And, based on the running logs, obtaining a quality detection result through structured parsing and generating a semantic detection result using a large language model;

[0169] A knowledge fusion layer 903 for performing collaborative operations on the structured data set and the syntax dependency graph to generate a code-log coverage score, and sorting out abnormal pattern features based on the quality detection result and the semantic detection result;

[0170] An intelligent enhancement layer 904 for performing feedback adjustment on the parsing steps of the source code and its running logs based on the code-log coverage score, abnormal pattern features, and a preset correction rule.

[0171] The content of the method embodiments of the present invention is applicable to the system embodiments of the present invention. The functions specifically implemented by the system embodiments of the present invention are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above methods.

[0172] An embodiment of the present invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the above log quality detection method is implemented. The electronic device can be any intelligent terminal including a tablet computer, an in-vehicle computer, etc.

[0173] It can be understood that the content in the above method embodiments is applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0174] Please refer to Figure 4 , Figure 4 which schematically shows the hardware structure of an electronic device 1000 according to another embodiment. The electronic device 1000 includes:

[0175] A processor 1001, which can be implemented in ways such as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present invention;

[0176] A memory 1002, which can be implemented in forms such as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1002 and are called by the processor 1001 to execute the log quality detection method of the embodiments of the present invention;

[0177] An input / output interface 1003, which is used to implement information input and output;

[0178] A communication interface 1004, which is used to implement communication and interaction between the present device and other devices, and can achieve communication through a wired method (such as USB, network cable, etc.) or through a wireless method (such as a mobile network, WIFI, Bluetooth, etc.);

[0179] A bus 1005, which transmits information between various components of the device (such as the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004);

[0180] Among them, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are communicatively connected to each other inside the device through the bus 1005.

[0181] An embodiment of the present invention also provides a computer-readable storage medium storing a computer program, which when executed by a processor implements the above-mentioned log quality detection method.

[0182] It can be understood that the content in the above method embodiments is applicable to this storage medium embodiment. The functions specifically implemented by this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those in the above method embodiments.

[0183] As a non-transitory computer-readable storage medium, a memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above networks include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0184] The log quality detection method, log quality detection system, electronic device, and storage medium provided by the embodiments of the present invention obtain a multimodal input source; the multimodal input source includes source code and its running logs; implicit tags are pre-injected into the log output template of the source code; wherein, during the dynamic parsing stage of the running logs, a reverse anchoring operation is performed based on the implicit tags to establish a direct mapping between the running logs and the source code; based on the source code compilation abstract syntax tree, a syntax dependency graph is established according to the abstract syntax tree, and the abstract syntax tree is traversed to construct a structured data set; based on the running logs, a quality detection result is obtained through structured parsing, and a semantic detection result is generated using a large language model; a collaborative operation is performed on the structured data set and the syntax dependency graph to generate a code log coverage score, and an abnormal pattern feature is sorted out according to the quality detection result and the semantic detection result; based on the code log coverage score, the abnormal pattern feature, and a preset correction rule, feedback adjustment is performed on the parsing steps of the source code and its running logs. The present invention establishes a direct mapping relationship between the running logs and the source code through pre-injected implicit tags and reverse anchoring operations, realizing an accurate association between the execution path and the code structure, providing a reliable data basis for quality evaluation; moreover, the present invention combines the syntax dependency graph and the structured data set to achieve a comprehensive parsing of the static characteristics of the code, and through double verification of the quality detection result and the semantic detection result, the defect recognition accuracy is improved. The present invention realizes a technical leap from one-sided to comprehensive, from passive to active, and from descriptive to guiding in code quality detection through an innovative multimodal fusion analysis and intelligent feedback mechanism, providing a new quality assurance solution for the software engineering field. The present invention can efficiently and accurately implement log quality detection.

[0185] The embodiments described in the embodiments of the present invention are for more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As can be known to those skilled in the art, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.

[0186] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than those shown in the figures, or combine certain steps, or different steps.

[0187] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0188] Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations.

[0189] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units does not have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0190] It should be understood that in the present invention, "at least one (item)" means one or more, and "a plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that there can be three relationships. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist at the same time. Among them, A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one (item) of the following" or its similar expression refers to any combination of these items, including any combination of single item (s) or plural items (s). For example, at least one (item) of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0191] In several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the above-mentioned division of units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of systems or units can be in electrical, mechanical or other forms.

[0192] The units described above as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0193] In addition, each functional unit in various embodiments of the present invention can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0194] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: various media that can store programs, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs.

[0195] The preferred embodiments of the embodiments of the present invention have been described above with reference to the accompanying drawings. However, this does not limit the scope of the rights of the embodiments of the present invention. Any modifications, equivalent replacements, and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present invention shall fall within the scope of the rights of the embodiments of the present invention.

Claims

1. A log quality detection method, characterized in that, The method includes the following steps: Obtain a multimodal input source; the multimodal input source includes source code and its running logs; implicit tags are pre-injected into the log output template of the source code; a direct mapping between the running logs and the source code is established by performing a reverse anchoring operation based on the implicit tags during the dynamic parsing stage of the running logs. Compile an abstract syntax tree based on the source code, establish a syntax dependency graph according to the abstract syntax tree, and traverse the abstract syntax tree to construct a structured dataset. Based on the running logs, obtain a quality detection result through structured parsing and generate a semantic detection result using a large language model. Perform collaborative operations on the structured dataset and the syntax dependency graph to generate a code log coverage score, and organize abnormal pattern features based on the quality detection result and the semantic detection result. Based on the code log coverage score, the abnormal pattern features, and a preset correction rule, feedback and adjustment are performed on the parsing steps of the source code and its running logs.

2. The log quality detection method according to claim 1, wherein The establishment of the syntax dependency graph according to the abstract syntax tree includes the following steps: Based on the abstract syntax tree, parse and generate a complete syntax tree topological relationship through a preset interface, and then establish the syntax dependency graph between code elements according to the syntax tree topological relationship.

3. The log quality detection method according to claim 1, wherein The traversal of the abstract syntax tree to construct a structured dataset includes the following steps: Use the depth-first traversal algorithm to access all nodes of the abstract syntax tree, identify code blocks based on the results of the all-node access in combination with a preset multi-level code block semantic feature library to obtain the structured dataset; the structured dataset includes the code block type identifier, physical location coordinates, and regularized matching results of internal log statements of each code block in the source code.

4. The log quality detection method according to claim 1, wherein The obtaining of the quality detection result through structured parsing includes the following steps: Perform structured processing on the running logs using a multi-mode regular expression group and perform multi-level compensation on the running logs; the multi-level compensation includes context inheritance compensation and semantic placeholder compensation. Perform incremental clustering extraction on the running logs to obtain a standardized log pattern, and then construct a template coding mapping. Perform basic quality detection on the running logs based on a preset quality detection system; the quality detection system includes duplicate log detection, long log detection, and high-frequency log detection. Construct an unsupervised quality detection model based on the isolated forest algorithm based on the results of the template coding mapping, and fuse and make a decision on the output results of the unsupervised quality detection model and the results of the basic quality detection to obtain the quality detection result.

5. The log quality detection method according to claim 1, wherein The generation of the semantic detection result using a large language model includes the following steps: Based on the running logs, obtain the context information of the real-time output log line and its multiple previous logs through a sliding window. Preprocess the context information to generate a natural query instruction. Based on the natural query instruction, use the dynamic prompting engineering method to construct a context-related request including historical log classification results, and then call the large language model for semantic understanding and classification reasoning to obtain the semantic detection result.

6. The log quality detection method according to claim 1, characterized in that, Performing reverse anchoring operations based on the implicit tags during the dynamic parsing phase of the running log to establish a direct mapping between the running log and the source code includes the following steps: Capturing the implicit tags in the message field of the running log through a set of regular expressions to establish a direct mapping between the running log and the source code; Performing full-path matching based on the module field of the running log and the package structure of the source code, and then combining with the preset directory hierarchy to achieve a coarse-grained association at the module granularity between the running log and the source code.

7. The log quality detection method according to claim 1, characterized in that, Performing collaborative operations on the structured data set and the syntax dependency graph to generate a code log coverage score, including the following steps: Based on the structured data set, correcting the scores of the code blocks in the source code that are not covered by the log through a weighted decay algorithm according to the preset log coverage weight coefficient; the log coverage status of the code block is determined based on the association of the implicit tags. Based on the syntax dependency graph, using the abstract syntax tree to establish a semantic parsing context environment to capture target reference relationship nodes, and then dynamically adjusting the score based on the log coverage completeness of the variable dependency path through cross-file definition node tracking combined with the reverse path retrieval algorithm; the log coverage completeness is determined based on the log coverage status of each code block in the variable dependency path. Generating the code log coverage score according to the results of the score correction and the dynamic score adjustment.

8. A log quality detection system, characterized in that, The system includes: A data input layer for obtaining multi-modal input sources; the multi-modal input sources include the source code and its running log; implicit tags are pre-injected into the log output template of the source code; wherein, during the dynamic parsing phase of the running log, reverse anchoring operations are performed based on the implicit tags to establish a direct mapping between the running log and the source code; A core analysis layer for compiling an abstract syntax tree based on the source code, establishing a syntax dependency graph according to the abstract syntax tree, and traversing the abstract syntax tree to construct a structured data set; And, based on the running log, obtaining a quality detection result through structured parsing and generating a semantic detection result using a large language model; A knowledge fusion layer for performing collaborative operations on the structured data set and the syntax dependency graph to generate a code log coverage score, and sorting out abnormal pattern features according to the quality detection result and the semantic detection result; An intelligent enhancement layer for feedback adjustment of the parsing steps of the source code and its running log based on the code log coverage score, the abnormal pattern features, and the preset correction rules.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.

Images