Code processing method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computers, and provides a code processing method and device, equipment and a storage medium. The method comprises the following steps: extracting association information representing a dependency relationship between code entities in a system engineering code; the code entity is a grammar component of a programming language corresponding to the system engineering code; obtaining a preset pruning granularity and a target entity type corresponding to the pruning granularity; based on the association information, determining correlation evaluation information between target code entities belonging to the target entity type in code entities included in the system engineering code; and performing pruning processing on each target code entity based on the correlation evaluation information and the data volume of the system engineering code to obtain a to-be-analyzed code, and performing security detection on the system engineering code by scanning the to-be-analyzed code. According to the method, the problems of low code scanning speed and high resource consumption in related technologies can be solved.

Description

Technical Field

[0001] The present application relates to the field of computer technology and provides a code processing method, apparatus, device and storage medium. Background Art

[0002] Code scanning is a static code analysis technique used to detect potential problems and security vulnerabilities in code. It automatically scans source code, configuration files, and other related files, identifies potential coding errors, vulnerabilities, security risks, and generates corresponding warnings or recommendations.

[0003] In related technologies, when performing code scanning on a system, the entire system engineering code is usually scanned, and information in the system engineering code is extracted before code analysis is performed to determine whether there are code security vulnerabilities.

[0004] However, the complexity of current systems is increasing, and the amount of corresponding system engineering code is also increasing. This also means that the system engineering code often contains a large amount of redundant code, resulting in the code scanning process taking longer and longer and consuming more and more resources.

[0005] So, how to optimize the code scanning process to increase scanning speed and reduce resource consumption is an urgent problem to be solved. Summary of the Invention

[0006] The embodiments of the present application provide a code processing method, apparatus, device, and storage medium to solve the problems of slow code scanning speed and high resource consumption in the related art.

[0007] In a first aspect, an embodiment of the present application provides a code processing method, including:

[0008] Extract association information representing the dependency relationship between each code entity in the system engineering code; the code entity is: the grammatical component of the programming language corresponding to the system engineering code; obtain a preset pruning granularity and a target entity type corresponding to the pruning granularity; the pruning granularity represents: the smallest code component structure deleted when the system engineering code is pruned; based on the association information, determine the correlation evaluation information between each target code entity belonging to the target entity type among each code entity included in the system engineering code; based on the correlation evaluation information and the data volume of the system engineering code, prune the each target code entity to obtain the code to be analyzed, and perform security detection on the system engineering code by scanning the code to be analyzed.

[0009] In a possible implementation, determining, based on the association information, correlation evaluation information between target code entities belonging to the target entity type in each code entity included in the system engineering code includes: for each target code entity, performing the following operations: based on the association information, determining, in each code entity, a set of subordinate code entities contained in the target code entity, and other entity types to which each subordinate code entity contained in the subordinate code entity set belongs; for each obtained entity type, performing the following operations: based on the association information, determining an initial correlation value between every two code entities belonging to one entity type; the one entity type is the target entity type or the other entity type; and determining, based on the obtained subordinate code entity sets and initial correlation values, in combination with preset weights of each entity type, correlation evaluation information between the target code entities.

[0010] In a possible implementation, the initial association value between each two code entities belonging to a type of entity is determined based on the association information, including: based on the association information, with each code entity belonging to the type of entity as a node and the dependency relationship between each code entity as an edge, determining a dependency graph corresponding to the type of entity; determining a dependency distance between each two code entities based on the shortest path between each two nodes in the dependency graph corresponding to the type of entity; determining the initial association value between each two code entities based on the dependency distance; the dependency distance is negatively correlated with the initial association value.

[0011] In one possible implementation, determining correlation evaluation information between the target code entities based on the obtained subordinate code entity sets and initial association values, in combination with preset weights for each entity type, includes: selecting a reference code entity from the target code entities, and using each subordinate code entity contained in the reference code entity as a reference subordinate code entity; determining, within each initial association value, a first reference association value between each target code entity and the reference code entity, and determining, within each other entity type, a second reference association value between each subordinate code entity and the reference subordinate code entity of the corresponding type; and performing the following operations for each target code entity other than the reference code entity: determining, based on the first reference association value of a target code entity and the second reference association value of each subordinate code entity contained in the target code entity, in combination with preset weights for each entity type, a correlation evaluation value between the other target code entity and the reference code entity; and using each obtained correlation evaluation value as correlation evaluation information.

[0012] In a possible implementation, the first reference association value between each target code entity and the reference code entity is determined respectively in each of the initial association values, and the second reference association value between each subordinate code entity and the corresponding reference subordinate code entity under each other entity type is determined respectively, including: for each target code entity other than the reference code entity, the following operations are performed respectively: in each of the initial association values ​​under the target entity type, the first reference association value between the target code entity and the reference code entity is determined; for each subordinate code entity other than the reference subordinate code entity, the following operations are performed respectively: in each of the initial association values ​​under the other entity types to which the subordinate code entity belongs, the second reference association value between the subordinate code entity and the reference subordinate code entity belonging to the same other entity type is determined.

[0013] In one possible implementation, pruning the target code entities based on the correlation evaluation information and the data volume of the system engineering code to obtain the code to be analyzed includes: determining the data volume to be pruned based on the total data volume of the system engineering code; performing correlation sorting on the target code entities other than the reference code entity based on the obtained correlation evaluation values; and pruning the target code entities based on the correlation sorting result and the data volume to be pruned to obtain the code to be analyzed.

[0014] In one possible implementation, determining the target pruning depth based on the data volume of the system engineering code includes: comparing the total data volume of the system engineering code with multiple data volume thresholds to determine the target data volume interval within which the total data volume of the system engineering code lies; wherein each two adjacent data volume thresholds determine a data volume interval; and determining the amount of data to be pruned corresponding to the target data volume interval based on a mapping relationship between a preset data volume interval and the pruned data volume.

[0015] In a second aspect, an embodiment of the present application further provides a code processing device, including:

[0016] A correlation information extraction unit is used to extract correlation information representing dependency relationships between code entities in the system engineering code; the code entity is: a grammatical component of a programming language corresponding to the system engineering code;

[0017] A pruning granularity acquisition unit is configured to acquire a preset pruning granularity and a target entity type corresponding to the pruning granularity; the pruning granularity represents: the smallest code component structure deleted when pruning the system engineering code;

[0018] A correlation evaluation unit, configured to determine, based on the association information, correlation evaluation information between target code entities belonging to the target entity type among the code entities included in the system engineering code;

[0019] A pruning processing unit is used to prune each target code entity based on the correlation evaluation information and the data volume of the system engineering code to obtain a code to be analyzed, and perform security detection on the system engineering code by scanning the code to be analyzed.

[0020] In one possible implementation, when the correlation evaluation unit determines, based on the association information, the correlation evaluation information between target code entities belonging to the target entity type among the code entities included in the system engineering code, the unit is configured to: for each target code entity, perform the following operations: based on the association information, determine, among the code entities, a set of subordinate code entities contained in the target code entity, and other entity types to which each subordinate code entity contained in the subordinate code entity set belongs; for each obtained entity type, perform the following operations: based on the association information, determine an initial correlation value between every two code entities belonging to one entity type; the one entity type is the target entity type or the other entity type; and based on the obtained subordinate code entity sets and the initial correlation values, in combination with preset weights of the entity types, determine the correlation evaluation information between the target code entities.

[0021] In one possible implementation, when the correlation evaluation unit determines the initial correlation value between each two code entities belonging to a certain entity type based on the correlation information, it is used to: determine a dependency graph corresponding to the certain entity type based on the correlation information, with each code entity belonging to the certain entity type as a node and the dependency relationship between each code entity as an edge; determine a dependency distance between each two code entities based on the shortest path between each two nodes in the dependency graph corresponding to the certain entity type; determine the initial correlation value between each two code entities based on the dependency distance; the dependency distance is negatively correlated with the initial correlation value.

[0022] In one possible implementation, when determining correlation evaluation information between the target code entities based on the obtained subordinate code entity sets and initial association values, in combination with preset weights for each entity type, the correlation evaluation unit is configured to: select a reference code entity from the target code entities, and use the subordinate code entities contained in the reference code entity as reference subordinate code entities; determine, within the initial association values, a first reference association value between each target code entity and the reference code entity, and determine, within each other entity type, a second reference association value between each subordinate code entity and the reference subordinate code entity of the corresponding type; and perform the following operations for each target code entity other than the reference code entity: determine, based on the first reference association value of a target code entity and the second reference association value of each subordinate code entity contained in the target code entity, in combination with preset weights for each entity type; and use the obtained correlation evaluation values ​​as correlation evaluation information.

[0023] In a possible implementation, the correlation evaluation unit is configured to: for each target code entity other than the reference code entity, respectively perform the following operations: determine, in each initial association value under the target entity type, the first reference association value between the target code entity and the reference code entity; and, for each subordinate code entity other than the reference subordinate code entity, respectively perform the following operations: determine, in each initial association value under the other entity type to which the subordinate code entity belongs, the second reference association value between the subordinate code entity and the reference subordinate code entity belonging to the same other entity type.

[0024] In one possible implementation, the pruning processing unit prunes each target code entity based on the correlation evaluation information and the data volume of the system engineering code. When obtaining the code to be analyzed, the pruning processing unit is configured to: determine the amount of data to be pruned based on the total data volume of the system engineering code; perform correlation sorting on each target code entity other than the reference code entity based on the obtained correlation evaluation values; and perform pruning on each target code entity based on the correlation sorting result and the data volume to be pruned to obtain the code to be analyzed.

[0025] In one possible implementation, when the pruning processing unit determines the target pruning depth based on the data volume of the system engineering code, it is used to: compare the total data volume of the system engineering code with multiple data volume thresholds respectively to determine the target data volume interval within which the total data volume of the system engineering code lies; wherein, a data volume interval is determined by every two adjacent data volume thresholds; and based on a mapping relationship between a preset data volume interval and the pruned data volume, determine the data volume to be pruned corresponding to the target data volume interval.

[0026] In a third aspect, an embodiment of the present application further provides a computer device comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of any one of the above-mentioned code processing methods.

[0027] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium comprising a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of any one of the above-mentioned code processing methods.

[0028] In a fifth aspect, an embodiment of the present application further provides a computer program product, comprising computer instructions, which are executed by a processor to perform the steps of any of the above-mentioned code processing methods.

[0029] The beneficial effects of this application are as follows:

[0030] The embodiments of the present application provide a code processing method, apparatus, device and storage medium, which can determine the correlation between target code entities through the association information between the code entities. Based on the correlation between the target code entities, the code with less impact on the core part in the system engineering code can be determined. By eliminating this part of the code, the amount of calculation when scanning the system engineering code can be reduced, thereby increasing the code scanning speed and reducing the consumed resources. In addition, since the pruning process is determined based on the correlation evaluation information and the data volume of the system engineering code, it is possible to avoid the situation where the code scanning result is biased due to the elimination of too many target code entities.

[0031] In addition, since the pruning process is determined based on the association information between each code entity, even if some target code entities are removed during code scanning, it will not affect the accuracy of security detection of system engineering code.

[0032] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 This is an optional schematic diagram of an application scenario in an embodiment of the present application;

[0035] Figure 2 Another optional schematic diagram of an application scenario provided in an embodiment of the present application;

[0036] Figure 3 A flowchart of a code processing method provided in an embodiment of the present application;

[0037] Figure 4 This is a flowchart of a method for determining relevance evaluation information provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of a subordinate code entity set provided in an embodiment of the present application;

[0039] Figure 6 An exemplary dependency diagram provided for an embodiment of the present application;

[0040] Figure 7 This is a flowchart of a method for determining relevance evaluation information provided in an embodiment of the present application;

[0041] Figure 8 An exemplary file dependency diagram provided for an embodiment of the present application;

[0042] Figure 9 An exemplary function dependency diagram provided for an embodiment of the present application;

[0043] Figure 10 A schematic diagram of the pruning process provided in an embodiment of the present application;

[0044] Figure 11 A schematic diagram of the structure of a code processing device provided in an embodiment of the present application;

[0045] Figure 12 A schematic diagram of the hardware structure of a computer device to which the embodiments of the present application are applied;

[0046] Figure 13 A schematic diagram of the hardware structure of another computer device to which an embodiment of the present application is applied. DETAILED DESCRIPTION

[0047] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of the technical solutions of this application, but not all of them. Based on the embodiments described in this application document, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the technical solutions of this application.

[0048] The following is a brief introduction to the design concept of the embodiment of this application:

[0049] Natural language processing (NLP) is a key area of ​​research in computer science and artificial intelligence. It studies the theories and methods that enable effective communication between humans and computers using natural language. Natural language processing involves natural language, the language we use daily, and is closely related to linguistics, while also involving computer science and mathematics. Natural language processing technologies typically include text processing, semantic understanding, machine translation, robotic question-answering, and knowledge graphs. Knowledge graph technology, in particular, introduces the concept of entities and techniques for extracting relationships between them.

[0050] Related technologies typically use code scanning to detect potential issues and security vulnerabilities in the system code. Specifically, code scanning typically involves extracting information from the entire system engineering code, including source code, configuration files, and other related files, and then performing code analysis to identify potential coding errors, vulnerabilities, security risks, and generate corresponding warnings or recommendations.

[0051] However, the complexity of current systems is increasing, and the amount of corresponding system engineering code is also increasing. This means that the system engineering code often contains a large amount of redundant code, resulting in the code scanning process taking longer and longer and consuming more and more resources.

[0052] In view of this, embodiments of the present application provide a code processing method, apparatus, device, and storage medium. In this method, based on the association information between code entities extracted from the system engineering code, correlation evaluation information is determined between target code entities belonging to the target entity type corresponding to the pruning granularity within each code entity. Based on the correlation evaluation information and the data volume of the system engineering code, each target code entity is pruned to obtain the code to be analyzed. The code to be analyzed is then scanned to perform security checks on the system engineering code.

[0053] Based on the above scheme, the correlation between each target code entity can be analyzed through the association information between each code entity, so as to determine the code included in the target code entity with weaker correlation in the system engineering code. This part of the code is the code that has less impact on the core part. By eliminating this part of the code, the amount of calculation when scanning the system engineering code can be reduced, thereby improving the code scanning speed and reducing the consumed resources.

[0054] In addition, since the pruning process is determined based on the association information between each code entity, even if some target code entities are removed during code scanning, it will not affect the accuracy of security detection of system engineering code.

[0055] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application can be combined with each other if there is no conflict.

[0056] See also Figure 1 An optional schematic diagram of an application scenario provided in an embodiment of the present application, such as Figure 1 As shown, the application scenario may include a physical terminal device 110 and a server 120 , and the physical terminal device 110 establishes a communication connection with the server 120 via a wired network or a wireless network.

[0057] The physical terminal device 110 can, in response to an operation by a relevant staff member, send an instruction to the server 120 to perform a code scanning operation on the system engineering code. After receiving the instruction, the server 120 can extract the association information representing the dependency relationship between each code entity in the system engineering code, and then obtain the preset pruning granularity and the target entity type corresponding to the pruning granularity. Then, based on the extracted association information, the server 120 can determine the correlation evaluation information between each target code entity belonging to the target entity type among each code entity included in the system engineering code. Finally, based on the correlation evaluation information and the data volume of the system engineering code, each target code entity can be pruned to obtain the code to be analyzed, and the system engineering code can be security tested by scanning the code to be analyzed.

[0058] In one possible implementation, the pruning granularity obtained by the server may be sent by the physical terminal device 110. Optionally, in response to a selection operation by a relevant staff member from among multiple preset pruning granularities, the physical terminal device 110 sends the selected pruning granularity to the server 120, so that the server 110 can prune the system engineering code based on the selected pruning granularity.

[0059] For example, if Figure 2As shown, assuming that the preset pruning granularity includes files and functions, the pruning granularity selection page 111 on the physical terminal device 110 may display a "File" option and a "Function" option. Assuming that the relevant staff member selects the pruning granularity as files, the physical terminal device 110 may, in response to a click operation on the "File" option, send information indicating that the pruning granularity is files to the server 120.

[0060] Among them, the physical terminal device 110 of the embodiment of the present application includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc.

[0061] The server 120 in the embodiment of the present application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. This application does not impose any restrictions on this.

[0062] See also Figure 3 This is an exemplary flow chart of a code processing method provided in an embodiment of the present application. This method can be applied to Figure 1 The server 120 shown specifically includes the following steps 301 to 304:

[0063] Step 301: extracting association information representing dependency relationships between code entities in the system engineering code.

[0064] Code entities are the grammatical components of the programming language corresponding to the system engineering code. Entity types of code entities include, but are not limited to, files, variables, functions, classes, objects, structures, and other grammatical components. Dependencies between code entities may include, but are not limited to, references, calls, and dependencies.

[0065] It should be noted that, in the embodiment of the present application, the file in the entity type represents the code file in the system engineering code, which will not be described in detail later.

[0066] In some embodiments, dependencies between entities of the same type can be references or calls, for example, references between files: file A references file B; calls between functions: function 1 calls function 2; global variable calls: both file A and file B call global variable c1, etc.

[0067] In some other embodiments, different entity types may be in a subordinate relationship. For example, the definition of functions in a file: function 1 and function 2 are defined in file A, then the dependency relationship between function 1 and function 2 and file A is a subordinate relationship; the initialization or definition of a class in a file: class b1 is defined in file B, then the dependency relationship between class b1 and file B is a subordinate relationship; the definition or use of a structure in a file: structure c1 is defined in file C, then the dependency relationship between structure c1 and file C is a subordinate relationship, and so on.

[0068] Furthermore, different programming languages ​​can have different grammatical components. For example, C is a procedural programming language that does not include the concepts of classes and objects. Therefore, if the system engineering code is written solely in C, the code itself will not include grammatical components such as classes and objects that are not part of C. Java, on the other hand, is an object-oriented programming language that does not include the concept of structures. Therefore, if the system engineering code is written solely in Java, the code itself will not include grammatical components such as structures that are not part of Java.

[0069] In a possible implementation, the system engineering code may be written in multiple programming languages. In this case, the code entities included in the system engineering code may include grammatical components corresponding to the multiple programming languages.

[0070] For example, assuming that the system engineering code is written in both C and JAVA, the code entities in the system engineering code may include grammatical components such as structures that are included in C but not in JAVA, and may also include grammatical components such as classes and objects that are included in JAVA but not in C.

[0071] Step 302: Obtain a preset pruning granularity and a target entity type corresponding to the pruning granularity.

[0072] The pruning granularity represents the smallest code structure deleted during the pruning process of the system engineering code. It should be noted that the deletion operation in the pruning process referred to in the embodiments of this application refers to skipping the deleted code entity during code scanning, and does not mean physically deleting the code entity from the system engineering code.

[0073] Optionally, the preset pruning granularity can be pre-configured in the server or can be set as Figure 2 The data is obtained from the physical terminal device. The pruning granularity can be function or file. When the pruning granularity is function, the target entity type is function. When the pruning granularity is file, the target entity type is file.

[0074] Step 303: Based on the association information, correlation evaluation information between target code entities belonging to the target entity type in the code entities included in the system engineering code is determined.

[0075] In a possible implementation, when the server executes step 303, it can Figure 4 The process shown executes:

[0076] Step 3031: For each target code entity, perform the following operations: Based on the association information, determine, in each code entity, the subordinate code entity set contained in the target code entity and other entity types to which at least one subordinate code entity contained in the subordinate code entity set belongs.

[0077] In one example, see Figure 5 Schematic diagram of subordinate code entity set provided by the embodiment of this application. Figure 5 As shown, take the target entity type as a file as an example: suppose the system engineering code includes file A and file B. Based on the association information, it can be determined that file A includes the following code entities: f1, f2, a1, a2; file B includes the following code entities: f3, f4. At this time, the subordinate code entity set contained in file A is the set composed of f1, f2, a1, a2, and the subordinate code entity set contained in file B is the set composed of f3 and f4. Among them, the other entity type to which f1, f2, f3, and f4 belong is function, and the other entity type to which a1 and a2 belong is class. Figure 5 In the figure, different entity types are represented by different graphics. Circles represent target entity types, i.e. files, triangles represent functions, and squares represent classes.

[0078] It should be noted that Figure 5 The situation shown is only exemplary. In the embodiment of the present application, other entity types may include various entity types except the target entity type, and the other entity types to which the subordinate code entities in each subordinate code entity set belong may be the same or different.

[0079] Step 3032: For each entity type obtained, perform the following operations: Based on the association information, determine the initial association value between every two code entities belonging to one entity type.

[0080] One entity type is a target entity type or another entity type.

[0081] Specifically, when determining the initial association value between each two code entities belonging to an entity type based on the association information, the server can determine the dependency graph corresponding to an entity type based on the association information, with each code entity belonging to an entity type as a node and the dependency relationship between each code entity as an edge. Then, the dependency distance between each two code entities can be determined based on the shortest path between each two nodes in the dependency graph corresponding to an entity type. Based on the dependency distance, the initial association value between each two code entities is determined. Among them, the dependency graph is a directed graph. For example, node A points to node B, which can represent A referencing B or A calling B in this application.

[0082] In some embodiments, the dependency distance and the initial correlation value may be negatively correlated. For example, the initial correlation value may be the inverse of the dependency distance. That is, assuming the dependency distance is x, the initial correlation value may be 1 / x. It should be noted that the relationship between the initial correlation value and the dependency distance may also be set based on actual conditions or experience. For example, if the dependency distance is x, the initial correlation value may be k / x, where k is a coefficient pre-configured based on actual conditions or experience, and this application does not limit this.

[0083] See also Figure 6 This is an exemplary dependency diagram provided in the embodiment of the present application. Assume that the dependency diagram is a dependency diagram corresponding to a file in a system engineering code. Figure 6 As shown, the system engineering code includes file AM. Among them, A references B, C, D, B references I, E, H, C references K, E, J, D references B, E references F, F references G, I references K, and J references M and L. The dependency distance between each two file nodes can be determined based on the number of edges included in the shortest path between the two file nodes. For example, there are two paths between A and K: A->C->K and A->B->I->K, where the shortest path is A->C->K, and this path includes two edges. Then the dependency distance between A and K is 2, and the initial association value between A and K is 1 / 2. The dependency distance between each two files can be calculated according to the above method.

[0084] because Figure 6 A in the system is not referenced by other files, so it can be considered that A is the core part of the system engineering code. Then, the relevance of other files in the system engineering code to A can be determined based on the dependency graph. Figure 6As shown, the dependency distances between files B, C, and D within the dotted ellipse and A are all 1. The dependency distances between files E, H, I, J, and K between the dotted ellipse and A are all 2. The dependency distances between files F, G, L, and M outside the dotted ellipse and A are all greater than 2, with the dependency distances between F, L, and M and A being 3, and the dependency distance between G and A being 4. Since a larger dependency distance indicates a lower correlation, it can be determined that in this system engineering code, B, C, and D have the highest correlation with A, followed by E, H, I, J, and K, then F, L, and M, with G having the lowest correlation with A.

[0085] Based on the above scheme, the dependency distance between code entities of the same entity type can be easily calculated through the dependency graph, thereby determining the correlation between code entities. This allows the removal of code entities with lower correlation during subsequent pruning, thus avoiding the situation where the accuracy of code scanning results is affected after the removal of more important code entities.

[0086] Step 3033: Based on the obtained subordinate code entity sets and initial association values, combined with the preset weights of each entity type, correlation evaluation information between each target code entity is determined.

[0087] In one possible implementation, see Figure 7 Schematic diagram of the flow of the method for determining the correlation evaluation information provided in the embodiment of the present application. Figure 7 Step 3033 shown can be executed as steps 701 to 704:

[0088] Step 701: Select a reference code entity from each target code entity, and use each subordinate code entity included in the reference code entity as a reference subordinate code entity.

[0089] For example, if the pruning granularity is file, then Figure 6 Each node in the dependency graph shown is the target code entity. Since file A is not called by any other file and is the core part of the system engineering code, file A can be selected as the reference code entity. Assume that the set of dependent code entities included in file A is as follows: Figure 5 As shown, f1, f2, a1, and a2 are reference subordinate code entities respectively.

[0090] It should be noted that the reference code entity may be pre-configured based on actual conditions or experience, and this application does not limit this.

[0091] Step 702: In each initial association value, determine a first reference association value between each target code entity and a reference code entity, and determine a second reference association value between each subordinate code entity and a reference subordinate code entity of the corresponding type under each other entity type.

[0092] Specifically, when determining the first reference association value between each target code entity and the reference code entity in each initial association value, the server can perform the following operations for each target code entity except the reference code entity: determine the first reference association value between the target code entity and the reference code entity in each initial association value under the target entity type.

[0093] For example, if the target code entities include A, B, C, and D, then the initial association values ​​include: AB, AC, AD, BC, BD, and CD. Assuming that A is selected as the reference code entity in step 701, the first reference association values ​​determined from the initial association values ​​include: AB, AC, and AD. It should be noted that AB represents the dependency distance between A and B, AC represents the dependency distance between A and C, and so on.

[0094] When determining the second reference association value between each subordinate code entity and the reference subordinate code entity of the corresponding type under each other entity type in each initial association value, the server may perform the following operations for each subordinate code entity except the reference subordinate code entity: determining the second reference association value between the subordinate code entity and the reference subordinate code entity belonging to the same other entity type in each initial association value under the other entity type to which the subordinate code entity belongs.

[0095] For example, assume that file A includes f1 and f2, file B includes f3, file C includes f4, and file D includes f5. The other entity types to which f1-f5 belong are all functions. Under this other entity type, the initial associated values ​​include f1f2, f1f3, f1f4, f1f5, f2f3, f2f4, f2f5, f3f4, f3f5, and f4f5. Since A is a reference code entity, and f1 and f2 are subordinate code entities, the determined second reference associated values ​​may include f1f3, f1f4, f1f5, f2f3, f2f4, and f2f5.

[0096] Step 703: For each target code entity except the reference code entity, perform the following operations: based on the first reference association value of the target code entity and the second reference association value of each subordinate code entity contained in the target code entity, combined with the preset weights of each entity type, determine a correlation evaluation value between the other target code entity and the reference code entity.

[0097] Specifically, when the pruning granularity is a file, the correlation evaluation value between another target code entity and the reference code entity can be determined according to the following formula (1):

[0098] Relevance evaluation value = (1 / file dependency distance) * file weight + (1 / function dependency distance) * function weight + (1 / class dependency distance) * class weight + (1 / structure dependency distance) * structure weight + ... Formula (1)

[0099] In the formula, (1 / file dependency distance) refers to the dependency distance between a target code entity and a reference code entity when the entity type is a file, that is, the first reference association value; the file weight is the preset weight of the file entity type. (1 / function dependency distance) refers to the reciprocal of the minimum value of the dependency distance between the subordinate code entity and the reference code entity contained in the target code entity when the entity type is a function, that is, the maximum value of each first reference association value under the function entity type; the function weight is the preset weight of the function entity type. The meanings of class dependency distance, class weight, structure dependency distance, and structure weight are similar to those of function dependency distance and function weight. Please refer to the relevant description above and will not be repeated here.

[0100] Similarly, when the pruning granularity is a function, the correlation evaluation value between another target code entity and the reference code entity can be determined according to the following formula (2):

[0101] Correlation evaluation value = (1 / function dependency distance) * function weight + (1 / class dependency distance) * class weight + (1 / structure dependency distance) * structure weight + ... Formula (2)

[0102] It should be noted that the number of items included in formula (1) and formula (2) can be determined according to the entity type of the code entity included in the system engineering code. For example, if the entity type also includes global variables, the item "(1 / global variable dependency distance)*global variable weight" can be added to formula (1) and formula (2).

[0103] It should be understood that the weight of each entity type can be set according to actual conditions and experience, for example, it can be 1, 2, 0.5, etc., and this application does not limit this.

[0104] In one example, see Figure 8 This is an exemplary file dependency diagram provided in the embodiment of the present application. Figure 8As shown, assuming that the system engineering code includes files A, B, C, and D, and the pruning granularity is file, then A, B, C, and D are target code entities, and A is selected as the reference code entity. Therefore, the first reference association value can include: AB, AC, AD, and AB=AC=AD=1.

[0105] See also Figure 9 This is an exemplary function dependency diagram provided in the embodiment of the present application. Figure 9 As shown, file A includes f1 and f2, file B includes f3, file C includes f4, and file D includes f5. Then f1 and f2 are reference subordinate code entities, and the second reference associated values ​​may include: f1f3, f1f4, f1f5, f2f3, f2f4, and f2f5. Figure 9 As shown, there is 1 edge between f1 and f3, so f1f3=1; there are 2 edges between f1 and f4, so f1f4=1 / 2; there are 3 paths between f1 and f5, among which the shortest path includes 2 edges, so f1f5=1 / 2; there is no path between f2 and f3, so f2f3=0; there is 1 edge between f2 and f4, so f2f4=1; there are 2 paths between f2 and f5, among which the shortest path includes 1 edge, so f2f5=1.

[0106] Assuming the file weight is 1 and the function weight is 2, then for file B, the second reference correlation value between A and B is f1f3 = 1, and the correlation evaluation value between A and B is 1*1 + 1*2 = 3. For file C, the second reference correlation values ​​between A and C include f1f4 and f2f4, where the maximum value is f2f4 = 1, and the correlation evaluation value between A and C is 1*1 + 1*2 = 3. For file D, the second reference correlation values ​​between A and D include f1f5 and f2f5, where the maximum value is f2f5 = 1, and the correlation evaluation value between A and D is 1*1 + 1*2 = 3.

[0107] Step 704: Use the obtained correlation evaluation values ​​as correlation evaluation information.

[0108] based on Figure 8 and Figure 9 In the illustrated embodiment, the correlation evaluation information may include that the correlation evaluation values ​​between A and B, A and C, and A and D are all 3.

[0109] Based on the above scheme, because the correlation evaluation information between target code entities is determined based on the subordinate code entities included in each target code entity, as well as the correlation between subordinate code entities of the same entity type, it is more accurate than determining the correlation evaluation information between target code entities based solely on the target code entities themselves. Based on this more accurate correlation evaluation information, the code can be processed more accurately and efficiently before code scanning, thereby improving the speed of subsequent code scanning and reducing the investment of related resources.

[0110] In another possible implementation, step 303 may also be performed by first determining a reference code entity within the target code entity, then, based on the association relationship, determining the set of subordinate code entities contained in each target code entity, and the other entity types to which at least one subordinate code entity contained in the subordinate code entity set belongs, and using each subordinate code entity contained in the reference code entity as a reference subordinate code entity. Then, based on the association relationship and the determined reference code entity and reference subordinate code entity, determining a first reference association value between each target code entity and the reference code entity, and determining a second reference association value between each subordinate code entity and the reference subordinate code entity of the corresponding type for each other entity type. Finally, performing the following operations for each target code entity other than the reference code entity, and using the resulting correlation evaluation values ​​as correlation evaluation information: determining a correlation evaluation value between another target code entity and the reference code entity based on the first reference association value of a target code entity and the second reference association value of each subordinate code entity contained in a target code entity, combined with preset weights for each entity type.

[0111] It should be noted that the specific calculation methods of the first reference correlation value, the second reference correlation value and the correlation evaluation value can all be referred to the relevant description in the above method embodiment, and will not be repeated here.

[0112] Based on the above scheme, since this scheme does not need to calculate the initial correlation value between every two code entities, but directly evaluates the correlation with the reference code entity or the reference subordinate code entity, it can reduce the amount of calculation and further reduce the investment of related resources.

[0113] Step 304: Based on the correlation evaluation information and the data volume of the system engineering code, prune each target code entity to obtain the code to be analyzed, and perform security detection on the system engineering code by scanning the code to be analyzed.

[0114] In one possible implementation, step 304 may specifically include determining the amount of data to be pruned based on the total amount of system engineering code data. Then, based on the obtained correlation evaluation values, each target code entity, excluding the reference code entity, is relevance-ranked. Combining the relevance ranking results with the amount of data to be pruned, each target code entity is pruned to obtain the code to be analyzed.

[0115] Optionally, the data volume of the system engineering code may refer to the size of all code files included in the system engineering code, such as 100M, 4.5G, etc. The data volume of the system engineering code may also refer to the number of all codes included in the system engineering code. This application does not limit this.

[0116] Optionally, the amount of data to be pruned can be expressed as a percentage, indicating that a corresponding percentage of target code entities are deleted, for example, the amount of data to be pruned is 50%. The amount of data to be pruned can also be expressed by a specific file size or a specific number of files, for example, the amount of data to be pruned is 10M or the amount of data to be pruned is 4 files, etc., which is not limited in this application.

[0117] In one example, see Figure 10 This is a schematic diagram of the pruning process provided in the embodiment of the present application. Figure 10 As shown, assuming that the dependency graph of the target code entity is as follows Figure 6 As shown, the obtained correlation evaluation information includes the correlation evaluation value of AB = 3, the correlation evaluation value of AC = 3, the correlation evaluation value of AD = 3, ..., the correlation evaluation value of AM = 1. Based on the correlation evaluation information, the target code entities other than A are sorted to obtain B, C, D, I, K, E, H, J, ..., G. Assuming that the amount of data to be pruned is 30%, that is, 30% of the number of target code entities included in the system engineering code can be removed. Then, based on the amount of data to be pruned, L, M, G, and F with a relatively low correlation ranking can be pruned to obtain the remaining target code entities: A, B, C, D, E, H, I, J, K, and all the codes included in the remaining target code entities are used as the codes to be analyzed for scanning and analysis.

[0118] In some embodiments, when determining the amount of data to be pruned based on the data volume of the system engineering code, the total data volume of the system engineering code is compared with multiple data volume thresholds to determine a target data volume interval within which the total data volume of the system engineering code falls. A data volume interval is defined by every two adjacent data volume thresholds. The amount of data to be pruned corresponding to the target data volume interval can then be determined based on a mapping relationship between a preset data volume interval and the amount of data to be pruned.

[0119] For example, multiple data volume thresholds may include 50M, 200M, and 500M. These three data volume thresholds can determine four data volume intervals: (0,50], (50,200], (200,500], and (500,∞). Assume that the mapping relationship between the preset data volume interval and the amount of pruned data is as follows: when the total data volume is in (0,50], no pruning is performed, that is, the amount of data to be pruned is 0; when the total data volume is in (50,200], the amount of data to be pruned is 30%; when the total data volume is in (200,500], the amount of data to be pruned is 50%; when the total data volume is in (500,∞), the amount of data to be pruned is 70%. Then, the amount of data to be pruned can be determined based on the target data volume interval in which the total data volume is located.

[0120] In one possible implementation, since the choice of pruning depth affects both the missed detection rate of the code scanning results and the code scanning speed, a deeper pruning depth will result in a slower scanning speed and a higher missed detection rate. Therefore, the shallowest pruning depth can be obtained in advance by scanning and counting a large number of projects. Then, according to the amount of data to be pruned, the dependency level of each remaining target code entity from the reference code entity is determined after deleting the target code entities at the back of the correlation sorting result, and the largest dependency level is used as the target pruning depth. The target pruning depth obtained can then be compared with the shallowest pruning depth. If the target pruning depth is less than the shallowest pruning depth, the pruning process is performed at the shallowest pruning depth; if the target pruning depth is greater than or equal to the shallowest pruning depth, the pruning process is performed at the target pruning depth.

[0121] For example, if Figure 10 As shown in Figure 2, after removing 30% of the target code entities, the maximum number of remaining dependency levels is 2, so the target pruning depth is 2. Assuming that the shallowest pruning depth is 3, the system engineering code is pruned according to the pruning depth of 3. Only file G is deleted, and the code included in the remaining target code entities is used as the code to be analyzed.

[0122] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides a code processing device. Figure 11 The code processing device 1100 shown may include: a correlation information extraction unit 1101, a pruning granularity acquisition unit 1102, a correlation evaluation unit 1103, and a pruning processing unit 1104.

[0123] The correlation information extraction unit 1101 is used to extract the correlation information representing the dependency relationship between each code entity in the system engineering code; the code entity is: the grammatical component of the programming language corresponding to the system engineering code;

[0124] The pruning granularity acquisition unit 1102 is used to obtain a preset pruning granularity and a target entity type corresponding to the pruning granularity; the pruning granularity represents: the smallest code component structure deleted when pruning the system engineering code;

[0125] The correlation evaluation unit 1103 is configured to determine, based on the association information, correlation evaluation information between target code entities belonging to the target entity type among the code entities included in the system engineering code;

[0126] The pruning processing unit 1104 is used to prune each target code entity based on the correlation evaluation information and the data volume of the system engineering code to obtain the code to be analyzed, and perform security detection on the system engineering code by scanning the code to be analyzed.

[0127] In one possible implementation, when the correlation evaluation unit 1103 determines, based on the association information, the correlation evaluation information between target code entities belonging to a target entity type among the code entities included in the system engineering code, the unit 1103 is configured to: for each target code entity, perform the following operations: based on the association information, determine, in each code entity, a set of subordinate code entities included in the target code entity, and other entity types to which each of at least one subordinate code entity included in the subordinate code entity set belongs; for each obtained entity type, perform the following operations: based on the association information, determine an initial correlation value between every two code entities belonging to one entity type; one entity type is the target entity type or another entity type; and based on the obtained subordinate code entity sets and the initial correlation values, in combination with preset weights for each entity type, determine the correlation evaluation information between the target code entities.

[0128] In one possible implementation, when the correlation evaluation unit 1103 determines the initial correlation value between each two code entities belonging to an entity type based on the correlation information, it is used to: determine a dependency graph corresponding to an entity type based on the correlation information, with each code entity belonging to an entity type as a node and the dependency relationship between each code entity as an edge; determine the dependency distance between each two code entities based on the shortest path between each two nodes in the dependency graph corresponding to the entity type; determine the initial correlation value between each two code entities based on the dependency distance; the dependency distance is negatively correlated with the initial correlation value.

[0129] In one possible implementation, the correlation evaluation unit 1103 determines correlation evaluation information between target code entities based on the obtained subordinate code entity sets and initial association values, in combination with preset weights for each entity type. The method includes: selecting a reference code entity from each target code entity, and using each subordinate code entity included in the reference code entity as a reference subordinate code entity; determining, within each initial association value, a first reference association value between each target code entity and the reference code entity, and determining, within each other entity type, a second reference association value between each subordinate code entity and the reference subordinate code entity of the corresponding type; and performing the following operations for each target code entity other than the reference code entity: determining, based on the first reference association value of a target code entity and the second reference association value of each subordinate code entity included in a target code entity, in combination with preset weights for each entity type, a correlation evaluation value between another target code entity and the reference code entity; and using each obtained correlation evaluation value as correlation evaluation information.

[0130] In one possible implementation, the correlation evaluation unit 1103 is configured to, when determining, in each initial association value, a first reference association value between each target code entity and a reference code entity, and, when determining, in each other entity type, a second reference association value between each subordinate code entity and a corresponding reference subordinate code entity, the following operations are performed for each target code entity other than the reference code entity: determining, in each initial association value under the target entity type, a first reference association value between the target code entity and the reference code entity; and, for each subordinate code entity other than the reference subordinate code entity, determining, in each initial association value under the other entity type to which the subordinate code entity belongs, a second reference association value between the subordinate code entity and a reference subordinate code entity belonging to the same other entity type.

[0131] In one possible implementation, the pruning processing unit 1104 performs pruning on each target code entity based on the correlation evaluation information and the data volume of the system engineering code. When the code to be analyzed is obtained, the pruning processing unit 1104 is used to: determine the amount of data to be pruned based on the total data volume of the system engineering code; perform correlation sorting on each target code entity except the reference code entity based on the obtained correlation evaluation values; and perform pruning on each target code entity based on the correlation sorting result and the data volume to be pruned to obtain the code to be analyzed.

[0132] In one possible implementation, when the pruning processing unit 1104 determines the target pruning depth based on the data volume of the system engineering code, it is used to: compare the total data volume of the system engineering code with multiple data volume thresholds respectively to determine the target data volume interval in which the total data volume of the system engineering code is located; wherein, every two adjacent data volume thresholds determine a data volume interval; based on the mapping relationship between the preset data volume interval and the pruned data volume, determine the data volume to be pruned corresponding to the target data volume interval.

[0133] For the convenience of description, the above parts are divided into each module (or unit) according to function and described separately. In the embodiment of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuit or memory) or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit that includes the module or unit function.

[0134] After introducing the code processing method and apparatus according to an exemplary embodiment of the present application, a computer device according to another exemplary embodiment of the present application is introduced next.

[0135] Those skilled in the art will appreciate that various aspects of the present application can be implemented as systems, methods, or program products. Therefore, various aspects of the present application can be specifically implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0136] Based on the same inventive concept as the above method embodiment, the present application embodiment also provides a computer device. In one embodiment, the computer device can be a server, such as Figure 1 In this embodiment, the structure of the computer device 1200 is as follows: Figure 12 As shown, it may include at least a memory 1201 , a communication module 1203 , and at least one processor 1202 .

[0137] Memory 1201 is used to store computer programs executed by processor 1202. Memory 1201 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and programs required for running instant messaging functions, while the data storage area may store various instant messaging messages and operating instruction sets.

[0138] Memory 1201 may be a volatile memory, such as random-access memory (RAM); a non-volatile memory, such as read-only memory, flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or any other medium capable of carrying or storing a desired computer program in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 1201 may be a combination of the aforementioned memories.

[0139] The processor 1202 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 1202 is configured to implement the above code processing method when calling the computer program stored in the memory 1201 .

[0140] The communication module 1203 is used to communicate with terminal devices and other servers.

[0141] The specific connection medium between the memory 1201, the communication module 1203 and the processor 1202 is not limited in the embodiment of the present application. Figure 12 In the embodiment, the memory 1201 and the processor 1202 are connected via a bus 1204. The bus 1204 is connected to the processor 1202 via a bus 1204. Figure 12 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus 1204 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 12 The diagram shows a single thick line, but this does not indicate that there is only one bus or one type of bus.

[0142] The memory 1201 stores a computer storage medium, which stores computer executable instructions. The computer executable instructions are used to implement the code processing method of the embodiment of the present application. The processor 1202 is used to execute the above code processing method, such as Figure 3 shown.

[0143] In another embodiment, the computer device may also be other computer devices, such as Figure 1 The physical terminal device 110 shown in FIG. In this embodiment, the structure of the computer device can be as follows Figure 13As shown, it includes: a communication component 1310, a memory 1320, a display unit 1330, a camera 1340, a sensor 1350, an audio circuit 1360, a Bluetooth module 1370, a processor 1380 and other components.

[0144] The communication component 1310 is used to communicate with the server. In some embodiments, it may include a wireless fidelity (WiFi) module. The WiFi module is a short-range wireless transmission technology. The electronic device can help the object send and receive information through the WiFi module.

[0145] The memory 1320 can be used to store software programs and data. The processor 1380 executes various functions and data processing of the physical terminal device 110 by running the software programs or data stored in the memory 1320. The memory 1320 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The memory 1320 stores an operating system that enables the physical terminal device 110 to run. In the present application, the memory 1320 can store the operating system and various application programs, and may also store a computer program that executes the code processing method of the embodiment of the present application.

[0146] The display unit 1330 can also be used to display information input by or provided to the subject, as well as a graphical user interface (GUI) of various menus of the physical terminal device 110. Specifically, the display unit 1330 may include a display screen 1332 disposed on the front of the physical terminal device 110. The display screen 1332 may be configured in the form of a liquid crystal display, a light-emitting diode, or the like.

[0147] The display unit 1330 can also be used to receive input digital or character information and generate signal input related to the object setting and function control of the physical terminal device 210. Specifically, the display unit 1330 may include a touch screen 1331 set on the front of the physical terminal device 110, which can collect touch operations of objects on or near it, such as clicking a button, dragging a scroll box, etc.

[0148] The touch screen 1331 can be covered on the display screen 1332, or the touch screen 1331 and the display screen 1332 can be integrated to realize the input and output functions of the physical terminal device 210. The integrated display screen can be simply referred to as a touch screen. In this application, the display unit 1330 can display applications and corresponding operation steps.

[0149] The camera 1340 can be used to capture static images, and the subject can publish the images captured by the camera 1340 through an application. The camera 1340 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, which is then transmitted to the processor 1380 for conversion into a digital image signal.

[0150] The physical terminal device may further include at least one sensor 1350, such as an accelerometer 1351, a distance sensor 1352, a fingerprint sensor 1353, and a temperature sensor 1354. The terminal device may also be equipped with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0151] The audio circuit 1360, speaker 1361, and microphone 1362 can provide an audio interface between the object and the physical terminal device 110. The audio circuit 1360 can transmit the electrical signal converted from the received audio data to the speaker 1361, which converts it into a sound signal for output. The physical terminal device 210 can also be equipped with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 1362 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1360 and converted into audio data. The audio data is then output to the communication component 1310 for transmission to, for example, another physical terminal device 210, or the audio data is output to the memory 1320 for further processing.

[0152] The Bluetooth module 1370 is used to exchange information with other Bluetooth devices having a Bluetooth module through the Bluetooth protocol. For example, a physical terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 1370 to exchange data.

[0153] The processor 1380 is the control center of the physical terminal device. It uses various interfaces and lines to connect the various parts of the entire terminal. By running or executing software programs stored in the memory 1320 and calling data stored in the memory 1320, it performs various functions of the terminal device and processes data. In some embodiments, the processor 1380 may include one or more processing units; the processor 1380 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 1380. In this application, the processor 1380 can run the operating system, application programs, user interface display and touch response, as well as the code processing method of the embodiment of the application. In addition, the processor 1380 is coupled to the display unit 1330.

[0154] In addition, it should be noted that in the specific implementation of this application, object data related to code processing, etc. is involved. When the above embodiments of this application are applied to specific products or technologies, it is necessary to obtain object permission or consent, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0155] In some possible implementations, various aspects of the code processing method provided in the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on a computer device, the computer program is used to cause the computer device to execute the steps of the code processing method according to various exemplary embodiments of the present application described above in this specification. For example, the computer device may execute the following steps: Figure 3 Follow the steps shown in .

[0156] The program product can use any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0157] The program product of the embodiment of the present application may be a portable compact disc read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with a command execution system, apparatus, or device.

[0158] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a readable computer program. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with a command execution system, apparatus, or device.

[0159] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0160] The computer program for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program can be executed entirely on the user's computer device, partially on the user's computer device, as a stand-alone software package, partially on the user's computer device and partially on a remote computer device, or entirely on the remote computer device. In the case of a remote computer device, the remote computer device can be connected to the user's computer device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer device (e.g., through the Internet using an Internet service provider).

[0161] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, depending on the embodiment of the application, the features and functions of two or more units described above can be embodied in a single unit. Conversely, the features and functions of a single unit described above can be further divided and embodied by multiple units.

[0162] Furthermore, although the operations of the method of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0163] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0164] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0165] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising a command device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0167] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0168] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A code processing method, characterized in that: include: Extract the association information representing the dependency relationship between code entities in the system engineering code; The code entity is: the grammatical component of the programming language corresponding to the system engineering code; Obtaining a preset pruning granularity and a target entity type corresponding to the pruning granularity; The pruning granularity represents: the smallest code component structure deleted when pruning the system engineering code; Determining, based on the association information, correlation evaluation information between target code entities belonging to the target entity type among the code entities included in the system engineering code; Based on the correlation evaluation information and the data volume of the system engineering code, each target code entity is pruned to obtain a code to be analyzed, and the system engineering code is security tested by scanning the code to be analyzed.

2. The method according to claim 1, characterized in that The determining, based on the association information, correlation evaluation information between target code entities belonging to the target entity type in the code entities included in the system engineering code includes: For each of the target code entities, the following operations are performed: based on the association information, in each of the code entities, determining a subordinate code entity set included in the target code entity, and other entity types to which at least one subordinate code entity included in the subordinate code entity set belongs; For each entity type obtained, performing the following operations: determining an initial association value between every two code entities belonging to one entity type based on the association information; the one entity type is the target entity type or the other entity type; Based on the obtained subordinate code entity sets and the initial association values, and in combination with the preset weights of the entity types, correlation evaluation information between the target code entities is determined.

3. The method according to claim 2, characterized in that The determining, based on the association information, an initial association value between every two code entities belonging to one entity type comprises: Based on the association information, determining a dependency graph corresponding to the entity type, with each code entity belonging to the entity type as a node and the dependency relationships between the code entities as an edge; Determining a dependency distance between every two code entities according to the shortest path between every two nodes in the dependency graph corresponding to the one entity type; Based on the dependency distance, the initial correlation value between every two code entities is determined; the dependency distance is negatively correlated with the initial correlation value.

4. The method according to claim 2 or 3, characterized in that The determining of correlation evaluation information between the target code entities based on the obtained subordinate code entity sets and the initial association values ​​in combination with preset weights of the entity types includes: Selecting a reference code entity from each target code entity, and using each subordinate code entity included in the reference code entity as a reference subordinate code entity; In each of the initial association values, a first reference association value is determined between each target code entity and the reference code entity, and a second reference association value is determined between each subordinate code entity and a reference subordinate code entity of the corresponding type under each other entity type; For each target code entity other than the reference code entity, performing the following operations: determining a correlation evaluation value between the other target code entity and the reference code entity based on a first reference association value of the target code entity and a second reference association value of each subordinate code entity contained in the target code entity, in combination with a preset weight of each entity type; Each obtained correlation evaluation value is used as correlation evaluation information.

5. The method according to claim 4, characterized in that The step of determining, in each of the initial association values, a first reference association value between each target code entity and the reference code entity, and determining, under each of the other entity types, a second reference association value between each subordinate code entity and the corresponding reference subordinate code entity, includes: For each target code entity except the reference code entity, the following operations are respectively performed: determining a first reference association value between the target code entity and the reference code entity in each initial association value under the target entity type; For each subordinate code entity except the reference subordinate code entity, the following operations are performed respectively: in each of the initial association values ​​under the other entity type to which the subordinate code entity belongs, a second reference association value between the subordinate code entity and the reference subordinate code entity belonging to the same other entity type is determined.

6. The method according to claim 4, characterized in that The step of pruning each target code entity based on the correlation evaluation information and the data volume of the system engineering code to obtain the code to be analyzed includes: Determining the amount of data to be pruned based on the total amount of data in the system engineering code; Based on the obtained correlation evaluation values, ranking the target code entities except the reference code entity in terms of correlation; Pruning is performed on each target code entity based on the relevance ranking result and the amount of data to be pruned to obtain a code to be analyzed.

7. The method according to claim 6, characterized in that The determining of a target pruning depth based on the data volume of the system engineering code includes: Comparing the total data volume of the system engineering code with a plurality of data volume thresholds respectively to determine a target data volume interval in which the total data volume of the system engineering code lies; wherein a data volume interval is determined by every two adjacent data volume thresholds; Based on a mapping relationship between a preset data volume interval and the pruned data volume, the to-be-pruned data volume corresponding to the target data volume interval is determined.

8. A code processing device, characterized in that: include: A correlation information extraction unit is used to extract correlation information representing the dependency relationship between various code entities in the system engineering code; The code entity is: the grammatical component of the programming language corresponding to the system engineering code; A pruning granularity acquisition unit, configured to acquire a preset pruning granularity and a target entity type corresponding to the pruning granularity; The pruning granularity represents: the smallest code component structure deleted when pruning the system engineering code; A correlation evaluation unit, configured to determine, based on the association information, correlation evaluation information between target code entities belonging to the target entity type among the code entities included in the system engineering code; A pruning processing unit is used to prune each target code entity based on the correlation evaluation information and the data volume of the system engineering code to obtain a code to be analyzed, and perform security detection on the system engineering code by scanning the code to be analyzed.

9. A computer device, characterized in that: The method comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The method comprises a program code, and when the program code is run on a computer device, the program code is used to enable the computer device to execute the steps of the method according to any one of claims 1 to 7.

Images