Code auditing method and data preprocessing method and device

Abstract

This specification provides one or more embodiments of a code auditing method, a data preprocessing method, and an apparatus. The code auditing method obtains a first skill file matching a code file to be audited, and audits the code file based on the first skill file. The first skill file includes code feature information corresponding to a first historical code file, and the first historical code file is of the same type as the application corresponding to the code file to be audited. The first skill file provides context information for the code file to be audited. Multiple historical code files corresponding to different applications can be pre-analyzed to obtain multiple skill files. During code auditing, the first skill file matching the code file to be audited can be retrieved from the multiple skill files obtained through preprocessing. Furthermore, the first skill file can be updated and optimized based on the dynamic test results of the code file to be audited.

Description

Technical Field

[0001] This specification relates to the field of computer software technology, and in particular to a code auditing method, a data preprocessing method, and an apparatus. Background Technology

[0002] With the continuous development of internet technology, information technology has been integrated into all aspects of people's lives, and more and more enterprises need to develop their own applications to meet their development needs.

[0003] Code auditing is a crucial part of the application development process. Its core objective is to identify program errors, security vulnerabilities, and violations of coding conventions. Code audits are typically performed by professionals with extensive coding and security experience. Through a comprehensive examination of the source code and software architecture, they assess its security and reliability, helping the development team to proactively identify and remediate risks.

[0004] Related technologies typically utilize Static Application Security Testing (SAST) tools and customized rules to automate code auditing. However, the coding styles, architectures, and functional logic of various applications differ, making it difficult for static analysis tools based on general rules to accurately identify logical vulnerabilities in each application, resulting in high false positive and false negative rates. Customized rules also suffer from poor universality and high maintenance costs. Therefore, existing code auditing methods are characterized by low accuracy and efficiency, making them ill-suited for the rapid iteration of applications. Summary of the Invention

[0005] This specification provides one or more embodiments of a code auditing method, a data preprocessing method, and an apparatus to improve the efficiency and accuracy of code auditing.

[0006] In a first aspect, one or more embodiments of this specification provide a code auditing method, comprising: obtaining a code file to be audited; obtaining a first skill file matching the code file to be audited, wherein the first skill file includes code feature information corresponding to a first historical code file, and the first historical code file is of the same type as the application corresponding to the code file to be audited; auditing the code file to be audited according to the first skill file to obtain the current audit result corresponding to the code file to be audited.

[0007] In the above technical solution, since the applications corresponding to the first historical code file and the code file to be audited are of the same type, the code characteristics of the first historical code file and the code file to be audited may have certain similarities. Furthermore, since the first technical file contains the code characteristic information of the first historical code file, the first technical file can be used as an auxiliary file for code auditing of the code file to be audited. The code characteristic information contained therein can serve as the context information of the code file to be audited, enabling the relevant devices or processors performing code auditing to quickly obtain the relevant characteristic information of the code file to be audited, thereby assisting in the auditing of the code file to be audited and improving auditing efficiency and accuracy.

[0008] In one possible implementation, the aforementioned code feature information includes at least one of application architecture information, authentication logic information, and data flow information. Based on this, the audit of the code file to be audited according to the first skill file includes at least one of the following: determining the application architecture of the code file to be audited based on the application architecture information; identifying authentication key classes in the code file to be audited based on the authentication logic information, and performing security control analysis based on the authentication key classes; and identifying key data flow nodes in the code file to be audited based on the data flow information, and performing data flow analysis based on the key data flow nodes.

[0009] In the above technical solution, the first skill file enables context enhancement of the code file to be audited. That is, during the auditing process of the code file to be audited, the relevant information recorded in the first skill file can be reused to quickly and accurately determine the application architecture, verification logic, class inheritance chain or call chain information corresponding to the code file to be audited. This allows for the rapid location of key classes and methods required for auditing, and a complete analysis and verification of the authentication process and data flow implemented in the code file to be audited. This eliminates the need for professional security auditors and the need to traverse the code file to be audited, thereby improving the accuracy and efficiency of auditing.

[0010] In one possible implementation, the code auditing method described above may further include a preprocessing step, namely, performing feature analysis on multiple historical code files to obtain corresponding skill files. Accordingly, the first historical code file, which corresponds to the application type of the code file to be audited, may be one of the multiple historical code files analyzed in the preprocessing step; the first skill file matching the code file to be audited may be one of the multiple skill files generated through the preprocessing step.

[0011] In the above technical solution, by performing feature analysis on historical code files, they are transformed into reusable knowledge, i.e., generating corresponding skill files. In the process of iteratively upgrading the applications corresponding to these historical code files, these skill files can be reused to audit the new version of the code files. This allows for the rapid and accurate discovery of vulnerabilities in the new version of the code files, reducing the time and manpower costs caused by code auditing and meeting the rapid iteration needs of applications.

[0012] In one possible implementation, feature analysis is performed on multiple historical code files. Specifically, this may include: inputting the historical code files and preset prompts into a first large model application, so that the first large model application performs feature analysis on the historical code files based on the preset prompts to obtain the skill files corresponding to the historical code files.

[0013] In one possible implementation, feature analysis is performed on multiple historical code files. Specifically, this may include: inputting the historical code files, preset prompts, and historical analysis results into a first major model application, so that the first major model application performs feature analysis on the historical code files based on the preset prompts and historical analysis results to obtain the skill files corresponding to the historical code files. The historical analysis results can be analysis results obtained based on a preset analysis method, which may include at least one of several analysis methods such as data flow analysis, control flow analysis, and symbolic execution analysis.

[0014] In the above technical solution, when performing feature analysis on historical code files using the first large model application, not only can preset prompts (equivalent to system prompts) instruct the first large model application on the analysis steps of historical code files, but the historical analysis results corresponding to the historical code files can also be used as reference files for the feature analysis process. This allows the first large model application to "learn" the historical analysis results and perform self-optimization, realizing the integration of intelligent analysis technology based on large models with various traditional static analysis technologies. This improves the depth and accuracy of the analysis of historical code files, thereby improving the accuracy of the generated skill files and ensuring the accuracy of subsequent code audit results based on the skill files.

[0015] In one possible implementation, the code auditing method described above may further include: storing the skill files obtained from the above preprocessing steps in correspondence with the application identifiers of the corresponding historical code files.

[0016] In the above technical solution, each skill file is stored based on the mapping relationship between skill files and application identifiers. Thus, during the code auditing phase, the corresponding skill files can be retrieved based on the application identifiers, thereby achieving automated identification and retrieval of the skill files required for each code audit and improving code auditing efficiency.

[0017] In one possible implementation, the above code auditing method may further include: after obtaining the current audit result, obtaining the dynamic test result corresponding to the code file to be audited, and comparing it with the current audit result of the code file to be audited; if the current audit result of the code file to be audited is inconsistent with the dynamic test result, updating the first skill file according to the dynamic test result.

[0018] In the above technical solution, since the audit results are based on the first skill file, which in turn are based on the first historical code file, while the dynamic test results are obtained by directly running the code in the code file to be audited, the audit results are more prone to deviation compared to the dynamic test results. Therefore, if the audit results and the dynamic test results are inconsistent, it indicates that the code feature information recorded in the first skill file may not be accurate enough, and it is necessary to update and optimize it so that when the matching code file is audited again based on the first skill file, more accurate audit results can be obtained.

[0019] Secondly, after obtaining the audit results, the accuracy of the skill files used in this code audit is verified by combining the dynamic test results. This enables feedback and optimization of the skill files generated in the preprocessing steps, forming a closed loop between preprocessing, code auditing, and feedback optimization. As a result, the skill files can be continuously optimized, thereby continuously improving the accuracy of code auditing and adapting to the rapid iteration of applications.

[0020] In one possible implementation, the above-mentioned acquisition of the code file to be audited may include: acquiring the code file to be audited in response to a preset trigger instruction; wherein the preset trigger instruction includes at least one of the following: a first trigger instruction generated based on a preset user operation; and a second trigger instruction generated based on a preset software development pipeline.

[0021] The above technical solution allows for different triggering methods for the code audit process, meaning it can be triggered at any time based on user needs or automatically based on the software development process, thus meeting the code auditing needs of different application scenarios.

[0022] In one possible implementation, the above code auditing method may further include: obtaining the audit prompt word, wherein the audit prompt word includes at least one preset vulnerability to be detected in the code audit; based on this, auditing the code file to be audited according to the first skill file may include: inputting the code file to be audited, the first skill file, and the audit prompt word into a second large model application, so that the second large model application analyzes the code file to be audited according to the first skill file to determine whether the code file to be audited has the preset vulnerability mentioned in the audit prompt word.

[0023] In the above technical solution, code auditing based on large model applications can improve auditing efficiency and continuously improve the accuracy of code auditing by leveraging the learning ability of large models.

[0024] Secondly, since the cost of using a large model is related to the amount of tokens in its input and output data, the above technical solution can identify and locate the corresponding key nodes or key classes by reusing the relevant information recorded in the first skill file without traversing the code file to be audited. This eliminates the need to input the entire code file to be audited into the large model, thereby reducing token consumption, lowering the cost of using the large model, achieving cost-controllable automated security auditing, and providing an economical and feasible solution for large-scale applications.

[0025] Secondly, one or more embodiments of this specification provide a data preprocessing method, comprising: performing feature analysis on historical code files to obtain code feature information of the historical code files; generating a skill file corresponding to the historical code files based on the code feature information; wherein the skill file can be used as context information of a target code file and applied to a preset stage in the lifecycle of the target code file; the application corresponding to the target code file belongs to the same type as the application corresponding to the historical code file; the preset stage includes at least one of a design stage, a code audit stage, and an operation and maintenance stage.

[0026] In the above technical solution, by preprocessing one or more existing historical code files, one or more skill files that record the code feature information of the historical code files are generated. This is equivalent to converting the historical code files into unified and reusable knowledge, providing reference information for one or more stages in the software development life cycle corresponding to the same type of target code files. This avoids the repeated analysis of historical code files, improves the development efficiency of the same type of code files, and improves the iteration efficiency of the corresponding application.

[0027] Thirdly, one or more embodiments of this specification also provide a code auditing apparatus, including: The acquisition module is used to acquire the code file to be audited, that is, the first skill file that matches the code file to be audited. The first skill file includes code feature information corresponding to the first historical code file. The first historical code file and the application type corresponding to the code file to be audited are the same. The audit module is used to audit the code file to be audited based on the first skill file and obtain the audit results corresponding to the code file to be audited.

[0028] Fourthly, one or more embodiments of this specification also provide a data preprocessing apparatus, comprising: The feature analysis module is used to perform feature analysis on historical code files to obtain code feature information of historical code files; The file generation module is used to generate skill files corresponding to historical code files based on code feature information.

[0029] Fifthly, one or more embodiments of this specification also provide an electronic device, which includes a memory and a processor; the memory is used to store a computer program product; the processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, it implements the method of the first or second aspect described above.

[0030] Sixthly, one or more embodiments of this specification also provide a computer-readable storage medium storing computer program instructions that, when executed, implement the methods of the first or second aspect described above.

[0031] Based on the implementation methods provided above, the embodiments of this application can be further combined to provide more implementation methods.

[0032] It is understood that the solutions provided in the third to sixth aspects correspond to the solutions provided in the first or second aspects. Therefore, the beneficial effects of the third to sixth aspects can be referred to the beneficial effects of the first or second aspects, and repeated descriptions will not be repeated. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of one or more embodiments of this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of one or more embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart illustrating a code auditing method provided for one or more embodiments of this specification; Figure 2 A schematic diagram illustrating the principle of a code auditing method provided in one or more embodiments of this specification; Figure 3 A flowchart illustrating a code auditing method provided for one or more embodiments of this specification; Figure 4 A flowchart illustrating a code auditing method provided for one or more embodiments of this specification; Figure 5AA schematic diagram illustrating the structure of a skill file involved in a code auditing method provided for one or more embodiments of this specification; Figure 5B A flowchart illustrating the generation of skill files in a code auditing method provided in one or more embodiments of this specification; Figure 5C A schematic diagram of the storage structure of skill files involved in a code auditing method provided in one or more embodiments of this specification; Figure 6 A structural block diagram of a code auditing device provided for one or more embodiments of this specification; Figure 7 A structural block diagram of a data preprocessing apparatus provided for one or more embodiments of this specification; Figure 8 This is a structural block diagram of an electronic device provided for one or more embodiments of this specification. Detailed Implementation

[0035] The present specification provides one or more embodiments in further detail below with reference to the accompanying drawings and examples. Through these descriptions, the features and advantages of one or more embodiments of the present specification will become clearer and more apparent.

[0036] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments. Although various aspects of embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless specifically indicated otherwise.

[0037] Furthermore, the technical features described below in one or more embodiments of this specification may be combined with each other as long as they do not conflict with each other.

[0038] To facilitate understanding, the technical terms and application scenarios involved in the technical solutions provided in one or more embodiments of this specification will be explained below.

[0039] Code auditing is the process of conducting a systematic security check on the source code and architecture of an application. It not only needs to check whether the source code has common technical vulnerabilities (such as SQL injection, cross-site scripting (XSS) attacks, etc.), but also needs to fully explore whether the code follows safe programming standards and whether there are logical vulnerabilities (such as unauthorized access, architectural design flaws, etc.) so that developers can fully understand the threats faced by the application and thus reduce its risks before the application is released.

[0040] White-box auditing: a static security analysis technique based on source code, which discovers security vulnerabilities by analyzing the internal structure of source code, and is a common method of code auditing.

[0041] Data flow tracing: Tracks the complete propagation path of data in an application from the input source (Source) to the dangerous point of operation (Sink), that is, "where the data comes from, where it goes, and what it passes through in between", so as to accurately identify vulnerabilities or locate faults.

[0042] Template class execution: This programming model uses abstract template classes to uniformly handle service processes (such as order processing, data import, report generation, etc.). It is commonly used in enterprise application development. The template class defines the algorithm skeleton in the service process, while some specific steps are defined in subclasses. This allows certain specific steps in the service process to be redefined by modifying the subclasses without changing the overall structure of the algorithm.

[0043] In the field of artificial intelligence, an agent refers to software or systems that, centered around large language models (LLMs), are capable of perceiving their environment, making inferences and decisions, and autonomously taking actions to achieve specific goals; they are often called intelligent agents. Some agents can be used for intelligent code analysis, including automatically scanning source code and identifying key classes and methods.

[0044] Agent Skills: A modular way to extend the capabilities of an agent. By encapsulating task-specific expertise, operational procedures, and tool scripts into independent skill files, or SKILLs, large models can load relevant SKILLs on demand, like installing plugins, and stably execute complex tasks, thereby extending the capabilities of the agent.

[0045] With the continuous development of Internet technology, more and more enterprises need to develop their own applications to meet their development needs. Correspondingly, code auditing of applications is also an important part of the application development process, which is related to whether the application can be successfully released and run stably.

[0046] Code auditing includes manual auditing and automated auditing. Manual auditing requires professional security personnel to analyze the source code, which is inefficient and costly. Automated auditing can be performed automatically based on general rules, customized rules, machine learning, etc., but it is difficult to find logical vulnerabilities.

[0047] Logical vulnerabilities exploit design flaws or abnormal paths in the service flow of an application. They often manifest as illegal combinations of legitimate requests or operations that conform to syntax but violate the service intent, rather than syntax errors in the code or known attack characteristics.

[0048] Taking the logical vulnerability of unauthorized access as an example, suppose user A's order ID is 1001. Under normal circumstances, when user A views their order details, the corresponding Uniform Resource Locator (URL) can be "GET / api / order?id=1001". If user A is an attacker, they might change the ID in the URL to 1002 (user B's order ID), thus stealing user B's order information. During this attack, user A is in a normal logged-in state, their access request is a standard HTTP GET request, and the order query port they access is also legitimate. However, traditional rule engines based on general rules are stateless, meaning the rule engine does not "know" which user owns the requested resource (i.e., order ID=1002), nor does it "know" the ownership relationship between the current requester (i.e., user A) and various resources. Therefore, the rule engine cannot detect the aforementioned unauthorized access vulnerability (user A accessing user B's order information).

[0049] In the above example, the ownership relationship between users and resources is related to specific service logic and cannot be defined by unified general rules. Therefore, vulnerabilities related to service logic cannot be discovered based on general rules.

[0050] In real-world applications, different types of applications have vastly different coding styles, and enterprise applications often use template classes extensively, resulting in complex logic that may introduce vulnerabilities that only exist under the current logic. This makes it difficult for static analysis methods based on general rules to accurately identify these logical vulnerabilities.

[0051] If code auditing is based on customized rules, relevant personnel need to write corresponding detection rules for each application, which is inefficient and difficult to adapt to the rapid iteration of applications.

[0052] In addition, machine learning-based code auditing methods require training the relevant models with a large amount of labeled data based on different vulnerability types. Such models have insufficient generalization ability, and need to be retrained when new attack patterns emerge.

[0053] It is evident that current methods of code auditing for applications are insufficient to guarantee the accuracy and efficiency of the audit.

[0054] In view of this, in order to improve the accuracy and efficiency of code auditing, one or more embodiments of this application provide a code auditing method and a data preprocessing method based on the code auditing method, which will be described in detail below.

[0055] Figure 1A flowchart illustrating a code auditing method provided by one or more embodiments of this specification is shown. (Refer to...) Figure 1 The code auditing method includes the following steps.

[0056] Step 102: Obtain the code file to be audited.

[0057] Step 104: Obtain a first skill file that matches the code file to be audited, wherein the first skill file includes code feature information corresponding to a first historical code file, and the first historical code file is of the same type as the application corresponding to the code file to be audited.

[0058] Step 106: Audit the code file to be audited according to the first skill document to obtain the audit result corresponding to the code file to be audited.

[0059] The aforementioned code file to be audited is the same code file to be audited in this instance, which contains the source code of the corresponding application.

[0060] For example, the first skill file mentioned above can be a skill file generated based on static test results, code audit results, or dynamic test results of the first historical code file. The code audit results of the first historical code file can be obtained by auditing the first historical code file through one or more code auditing methods, such as the manual auditing method described above, or the automated auditing method based on general rules, customized rules, machine learning, etc., or the code auditing method provided in any embodiment of this specification.

[0061] For example, skill files can be pre-generated based on various historical code files. Based on this, when code auditing is required, a first skill file matching the code file to be audited can be selected from the pre-generated skill files. The code characteristic information recorded in this first skill file can be used as context information for the code file to be audited during the auditing process.

[0062] In the above embodiments, since the applications corresponding to the first historical code file and the code file to be audited are of the same type, the code features of the first historical code file and the code file to be audited may have certain similarities. Furthermore, since the first skill file records the code feature information of the first historical code file, the first skill file can be used as an auxiliary file for code auditing of the code file to be audited. The code feature information recorded therein can serve as the context information of the code file to be audited, enabling the device or processor performing the code audit to quickly obtain the relevant features of the code file to be audited, thereby providing assistance for the audit of the code file to be audited and improving audit efficiency and accuracy.

[0063] For example, the audit results mentioned above may include an audit report, which may include various information such as the number of vulnerabilities, vulnerability types, vulnerability locations, vulnerability risk levels, and vulnerability remediation recommendations.

[0064] In some embodiments, the code feature information recorded in the first skill file may include application architecture information.

[0065] The aforementioned application architecture information may specifically include information such as the layered architecture and development framework used in the corresponding code.

[0066] Layered architecture is an application design pattern that divides an application into multiple horizontal layers according to its responsibilities. Each layer has its own clearly defined responsibilities and provides services to the upper layer while depending on the services provided by the lower layer. For example, the layered architecture of an application can adopt a three-tier architecture consisting of a controller layer, a service layer, and a data access object (DAO), or it can adopt other architecture types such as hexagonal architecture.

[0067] A development framework refers to a general, reusable software infrastructure, such as the Spring framework and the Swing framework. By encapsulating a large number of basic functional modules (such as database connection and logging modules) and providing predefined code libraries, interfaces, tools and design specifications, it enables developers to focus more on the implementation of the application's service logic rather than writing specific code, thereby improving development efficiency and enhancing the robustness and maintainability of the application.

[0068] Because different layered architectures and development frameworks may lead to different security control mechanisms and dependencies between modules in applications, in addition to code-level vulnerabilities, design-level vulnerabilities may also be introduced. Furthermore, the classes involved in the same vulnerability and their locations in the code may differ. Therefore, different auditing strategies may be required for applications based on different layered architectures or development frameworks.

[0069] Based on this, in some embodiments, the audit of the code file to be audited in step 106 above, according to the first skill file, may specifically include: determining the application architecture of the code file to be audited based on the application architecture information corresponding to the first historical code file recorded in the first skill file.

[0070] In the above embodiments, since the application types corresponding to the code file to be audited and the first historical file are the same, the application architecture information of the first historical code file recorded in the first historical file can be reused during the auditing process of the code file to be audited to quickly determine the application architecture (including layered architecture, development framework, etc.) corresponding to the code file to be audited. In this way, the corresponding audit strategy can be determined. This eliminates the need for professional security auditors and the need to traverse the code file to be audited, thereby improving the audit accuracy. Furthermore, based on the application architecture of the code file to be audited, the key classes and methods to be detected in this audit can be quickly located, improving the audit efficiency.

[0071] In some embodiments, the code feature information recorded in the first skill file may include authentication logic information.

[0072] The aforementioned authentication logic information refers to the relevant information in the corresponding code that implements authentication methods such as horizontal authentication and vertical authentication, including but not limited to: which authentication key classes are used, the location of each authentication key class in the corresponding code file, and the calling process of each authentication key class during the authentication process.

[0073] For example, in some embodiments, a multi-level authentication process is typically adopted, such as "Filter→Interceptor→Aspect". That is, the entire authentication process includes three levels: The first level uses the Filter to perform a global basic verification on the original request (such as verifying the existence of the token, verifying based on IP whitelists / blacklists, etc.). If the verification is successful, it enters the second level, which uses the Interceptor to obtain the controller information involved in the request and perform path-level authorization. If the authorization is successful, it enters the third level, which uses the Aspect to further obtain the method parameters involved in the request and perform method-level (or data-level) authorization. The three levels are executed sequentially. If the authentication fails at any level, the response to the request can be interrupted, forming a defense-in-depth system.

[0074] Based on this, in some embodiments, the audit of the code file to be audited in step 106 above, according to the first skill file, may specifically include: identifying the authentication key class in the code file to be audited based on the authentication logic information corresponding to the first historical code file recorded in the first skill file, and performing security control analysis based on the identified authentication key class.

[0075] Based on the above multi-level authentication process, it is known that for different types of applications, the authentication logic at each level, the key authentication classes involved, and the location of the key authentication classes in the code may all be different. This information can be used as authentication logic information, obtained through preprocessing of historical code files, and recorded in the corresponding skill file. Thus, when auditing the code file to be audited, the key authentication classes used at each authentication level in the current code file to be audited can be quickly identified and located based on the authentication logic information recorded in the corresponding first skill file, as well as the order in which these key authentication classes are called during the authentication process. This allows verification of whether there are defects in the authentication logic of the code file to be audited.

[0076] In the above embodiments, since the application type corresponding to the first historical code file and the code file to be audited is the same, the authentication logic information recorded in the first historical code file can be reused in the auditing process of the code file to be audited. Therefore, it is not necessary to traverse the code file to be audited to quickly identify and locate the key classes used for authentication in the code file to be audited and their execution order, thereby improving auditing efficiency.

[0077] Furthermore, based on the authentication logic information recorded in the first skill file, without the need for professional security auditors, the device or processor performing code auditing can accurately and deeply understand the complete authentication logic of the code file to be audited. This breaks through the bottleneck of traditional automated auditing methods in detecting logical vulnerabilities, improves the detection rate of logical vulnerabilities, and improves the accuracy of code auditing.

[0078] In some embodiments, the code feature information recorded in the first skill file may include data flow information.

[0079] The aforementioned data flow information refers to the complete path and state changes of data within an application, from the entry point (Source), through processing and propagation, to the final point of use (Sink). In the fields of code auditing and security, Data Flow Analysis (DFA) is a core technology for discovering vulnerabilities. Most security vulnerabilities (such as SQL injection, XSS, command injection, deserialization, etc.) are essentially "untrusted data" that has not been properly cleaned or verified before flowing to a "dangerous Sink point."

[0080] For example, the data flow information mentioned above can be represented based on the layered architecture of the application. For instance, it can include the names of functions (including clean functions and dangerous functions) into which data flows in at different architectural levels such as Controller, Service, and DAO, as well as the breakpoint locations.

[0081] In some embodiments, the auditing of the code file to be audited in step 106 above, based on the first skill file, may specifically include: identifying key data flow nodes in the code file to be audited based on the data flow information corresponding to the first historical code file recorded in the first skill file, and performing data flow analysis based on the identified key data flow nodes.

[0082] In practical applications, data flow breaks often occur due to indirect calls, cross-class calls, and extensive use of template classes, posing significant challenges to data flow analysis. Therefore, in the above embodiment, since the first historical code file and the audited code file correspond to the same application type, the data flow information of the first historical code file recorded in the first skill file can be reused as a data flow template. This provides a reference for data flow analysis of the audited code file, helping to quickly determine the complete class inheritance chain and call chain information in the audited code file. Even if there are data flow breakpoints in the audited code file caused by template class execution, the next node associated with the current breakpoint can be determined based on the data flow information recorded in the first skill file, thereby obtaining the complete data flow of the audited code file. This eliminates data flow breakpoint problems caused by cross-class calls and other factors, thereby improving the accuracy of risk analysis for complex data flows and increasing the efficiency and accuracy of code auditing.

[0083] As can be seen, the code auditing method provided in the above embodiments uses a skill file pre-generated based on historical code files as a standardized knowledge representation to achieve customization of application-level audit knowledge. This allows it to be reused in the auditing process of code files corresponding to the same type of application. This enables accurate understanding of the service logic of the corresponding type of application during the auditing process and the adoption of appropriate auditing strategies, solving the problem that auditing based on general rules in related technologies cannot adapt to diverse application architectures. Secondly, multiple code files corresponding to the same type of application can be audited based on the same skill file, ensuring consistency in the accuracy of auditing different code files and reducing the cost of manual intervention.

[0084] In some embodiments, obtaining the code file to be audited in step 102 above may specifically include: obtaining the code file to be audited in response to a preset trigger instruction.

[0085] In other words, the execution of the above code auditing method can be triggered by a preset trigger command. In different embodiments, the specific form of the preset trigger command may vary.

[0086] For example, in some embodiments, the preset trigger instruction can be a first trigger instruction generated based on a preset user operation.

[0087] In other words, relevant users (such as application developers, testers, etc.) can trigger the execution of the code auditing method described in any of the above embodiments according to their own needs. For example, relevant users can perform preset user operations through the first user interface; correspondingly, the device or processor used to execute the above code auditing method can generate the above first trigger instruction after receiving the preset user operation through the first user interface, thereby triggering the execution of the above code auditing method.

[0088] For example, in some embodiments, the aforementioned preset trigger instruction may be a second trigger instruction generated based on a preset software development pipeline.

[0089] In other words, the code auditing method described in any of the above embodiments can be automatically triggered during the development of the corresponding application, thereby achieving full automation of the entire development and auditing process.

[0090] For example, a function to generate a second trigger instruction can be embedded at a preset node in a pre-defined software development pipeline. This allows the second trigger instruction to be automatically generated when the development process reaches that preset node, thereby enabling automated auditing of the corresponding code files using the aforementioned code auditing method.

[0091] For example, based on a CI / CD (Continuous Integration / Continuous Delivery or Deployment) pipeline, a generation function for a second trigger instruction can be embedded before the delivery or deployment node. This allows the execution of the aforementioned code auditing method to be triggered before code file delivery or deployment, thereby achieving automated auditing of the corresponding code files.

[0092] In the above embodiments, different triggering methods for the code audit process can be configured to meet the code auditing needs of different application scenarios.

[0093] Figure 2 This is a schematic diagram illustrating the principle of a code auditing method provided in one or more embodiments of this application. Figure 3 This is a flowchart illustrating a code auditing method provided for one or more embodiments of this application.

[0094] In some embodiments, refer to Figure 2 and Figure 3 ,exist Figure 1 Based on the method flow shown, the above code auditing method may further include: step 108, obtaining the audit prompt words for this audit, wherein the audit prompt words include at least one preset vulnerability to be detected in this code audit.

[0095] Based on step 108 above, Figure 1 Step 106 in the process shown, which involves auditing the code file to be audited based on the first skill document, can specifically be: Step 106': Input the code file to be audited, the first skill file, and the audit prompt words into the second large model application, so that the second large model application can analyze the code file to be audited based on the first skill file and determine whether the code file to be audited contains the preset vulnerabilities mentioned in the audit prompt words.

[0096] The aforementioned audit prompt is a user prompt, specifically a prompt received from relevant personnel via a second user interface. This audit prompt allows relevant personnel to specify one or more pre-defined vulnerabilities to be detected during this code audit.

[0097] For example, the code auditing method provided in one or more embodiments of this application can be executed by applying the second large model 220, such as... Figure 2 As shown, the second major model application 220 may include a second agent 221 and a second preset model 222. The second preset model 222 may be a general LLM or a specialized model obtained by fine-tuning and training based on an LLM through code analysis domain-specific methods; the second agent 221 is the agent with the second preset model 222 as its core.

[0098] Reference Figure 2 The second intelligent agent 221 can obtain the audit prompt word based on the second user interface (i.e., execute step 108), and obtain the audit code file based on another user interface, or receive the audit code file output by the preset software development pipeline based on the relevant interface (i.e., execute step 102); the second intelligent agent 221 can also obtain the first skill file that matches the received audit code file (i.e., execute step 104).

[0099] Furthermore, the second intelligent agent 221 can integrate the acquired audit prompt words, the code file to be audited, and the first skill file into second input data, and input it into the second preset model 222. The second preset model 222 then analyzes the code file to be audited based on the first skill file to obtain second output data. The second output data includes at least the following information: whether the code file to be audited contains the preset vulnerability mentioned in the audit prompt words. Then, the second intelligent agent 221 can generate and output the audit result based on the second output data fed back by the second preset model 222 (i.e., execute step 106').

[0100] For example, the format and information type of the audit results output by the second intelligent agent 221 can be configured in advance as needed, and this embodiment does not limit this.

[0101] For example, a system prompt can also be configured for the second model application 220 mentioned above. This system prompt can also be used as second input data to the second preset model 222 to instruct the second preset model 222 on the specific steps when analyzing the code file to be audited.

[0102] For example, the second intelligent agent 221 can analyze the original data such as the audit prompt words and the code file to be audited based on a third-party code processing tool (such as Claude Code and other proxy encoding tools), generate a task execution plan, and call the second preset model 222 according to the task execution plan (which can be divided into multiple calls) to complete the code audit task.

[0103] In the above embodiments, code auditing based on large model applications can improve auditing efficiency and leverage the learning capabilities of large models to continuously improve the accuracy of code auditing.

[0104] Secondly, since the cost of using a large model is related to the amount of its input and output data (usually measured in tokens, where a token is the basic unit for data processing in a large model), the relevant information recorded in the first skill file can be reused in the above embodiments. This eliminates the need to traverse the code file to be audited to identify and locate the corresponding key nodes or key classes. Consequently, it is not necessary to input the entire code file to be audited into the large model, thereby reducing token consumption, lowering the cost of using the large model, and achieving cost-controllable automated security auditing. This provides an economical and feasible solution for large-scale applications.

[0105] In some embodiments, relevant personnel only need to indicate the type of vulnerability to be audited using the design prompts. They can then utilize the second major model application and the code auditing method provided in the above embodiments to perform batch auditing. That is, through the second major model application, multiple code files to be audited can be obtained, and the skill files corresponding to each code file to be audited can be obtained (since the application types corresponding to different code files to be audited may be the same or different, their corresponding skill files may also be the same or different). Then, batch auditing can be performed on each corresponding code file to be audited based on each skill file, thereby improving the efficiency and accuracy of code auditing and reducing labor costs.

[0106] In some embodiments, the above code auditing methods, in addition to Figure 1 , Figure 3The audit phase S1 process shown may also include a preprocessing phase S3, in which skill documents required for subsequent audit phases can be generated. (See reference...) Figure 4 The preprocessing stage of the above code auditing method may include the following steps: Step 302: Perform feature analysis on multiple historical code files to obtain the corresponding skill files.

[0107] For example, a skill file can be obtained based on the feature analysis results of a historical code file, or it can be obtained based on the feature analysis results of multiple historical code files corresponding to the same type of application.

[0108] For example, the first historical code file, which is of the same application type as the code file to be audited, can be one of the multiple historical code files analyzed in the preprocessing stage S3; correspondingly, the first skill file obtained in step 104 of the auditing stage S1 can be one of the multiple skill files generated through step 302 of the preprocessing stage S3.

[0109] Based on the above embodiments, in practical application scenarios, multiple applications can be managed uniformly (e.g., enterprise users can manage all applications developed or used by their enterprise uniformly). By performing feature analysis on their historical code files, they can be transformed into reusable knowledge, i.e., generating corresponding skill files. Based on this, during the iterative upgrade process of these applications, these skill files can be used, based on the code auditing methods described above, to audit the new version code files of the applications. This allows for the rapid and accurate discovery of vulnerabilities in the new version code files, reducing the time and manpower costs associated with code auditing and meeting the rapid iteration needs of applications.

[0110] In some embodiments, the feature analysis of multiple historical code files in step 302 above may specifically include: inputting the historical code files and preset prompt words into a first large model application, so that the first large model application performs feature analysis on the historical code files based on the preset prompt words to obtain the skill files corresponding to the historical code files.

[0111] For example, the aforementioned preset prompt can be a system prompt configured in the first large model application, which can be used to instruct the first large model application on the analysis steps, output format, and other information of the historical code file, so that the first large model application can generate skill files that meet the requirements.

[0112] Reference Figure 2 The schematic diagram shown allows for feature analysis of historical code files using the first major model application 210.

[0113] For example, the first large model application 210 may include a first agent 211 and a first preset model 212. The first preset model 212 may be a general LLM or a specialized model obtained by fine-tuning and training based on an LLM with code analysis domain-related requirements; the first agent 211 is the agent with the first preset model 212 as its core.

[0114] Reference Figure 2 In the first big model application 210, the first intelligent agent 211 can obtain preset prompt words and historical code files, integrate them into the first input data, and input them into the first preset model 212. The first preset model 212 performs feature analysis on the historical code files based on the analysis steps and output format indicated in the preset prompt words, and generates the first output data. Then, the first intelligent agent 211 can generate skill files with content and format that meet the requirements based on the first output data output by the first preset model 212.

[0115] For example, the first intelligent agent 211 can automatically and in batches obtain historical code files from relevant code repositories (such as Git, SVN and other code version control systems), realize batch analysis of historical code files, and obtain corresponding skill files. While improving the efficiency of skill file generation, it ensures the uniformity of the content and format of skill files, which helps to ensure the uniformity of subsequent code audit results.

[0116] For example, the first intelligent agent 211 can also obtain the current analysis prompt word input by the user through a relevant user interface, and integrate the current analysis prompt word into the first input data and input it into the first preset model 212. The current analysis prompt word may include relevant information of historical code files, such as the application architecture and key functions corresponding to the historical code files, which can be used as a user prompt word to indicate the feature analysis process of the first preset model 212.

[0117] In other words, in practical application scenarios, users can input any relevant information of their known historical code files into the first major model application 210 through the relevant user interface. This information can then be used as user prompts to input into the first preset model 212, which helps improve the accuracy of feature analysis, makes the obtained skill files more accurate, and thus improves the accuracy of code audit results based on the skill files.

[0118] In some embodiments, the feature analysis of multiple historical code files in step 302 above may specifically include: inputting the historical code files, preset prompt words, and historical analysis results into the first large model application, so that the first large model application performs feature analysis on the historical code files based on the preset prompt words and historical analysis results to obtain the skill files corresponding to the historical code files.

[0119] The historical analysis result can be the analysis result obtained by analyzing historical code files based on a preset analysis method. The preset analysis method can include at least one of a variety of analysis methods such as data flow analysis, control flow analysis, and symbolic execution analysis.

[0120] In the above embodiments, in the embodiment where the first large model application 210 performs feature analysis on historical code files, not only can the preset prompts indicate the analysis steps of the first large model application 210 on the historical code files, but the historical analysis results corresponding to the historical code files can also be used as reference files for the feature analysis process. This allows the first large model application 210 to "learn" the historical analysis results and perform self-optimization, thereby achieving the integration of intelligent analysis technology based on large models with various traditional static analysis technologies. This improves the depth and accuracy of the analysis of historical code files, thereby improving the accuracy of the generated skill files and ensuring the accuracy of subsequent code audits based on the skill files.

[0121] For example, a skill file corresponding to the same skill may include one or more sub-files; multiple sub-files corresponding to the same skill work together to support the implementation of the corresponding skill.

[0122] Figure 5A This is a schematic diagram of the file structure of a skill file provided for one or more embodiments of this application.

[0123] For example, the aforementioned skill files (including the aforementioned first skill file) can be Agent Skills-based files (SKILL files for short), such as... Figure 5A As shown, each skill can correspond to a SKILL folder; the SKILL folder can contain multiple sub-files corresponding to that skill, including but not limited to script files, description files, etc.

[0124] For example, multiple sub-files corresponding to the same skill are stored in the form of a SKILL folder. This SKILL folder can be named based on application identifiers, purposes, etc., to facilitate the retrieval and calling of each sub-file in the SKILL folder during subsequent code auditing. Figure 5AIn the SKILL folder name “{appname}-audit” shown, “appname (application name)” is the application identifier corresponding to the SKILL file, and “audit (audit)” is the purpose of the SKILL file.

[0125] For example, the above description file can be a file with the extension .md, .yaml, etc., such as Figure 5A The file named "SKILL.md" shown is the core configuration file for the corresponding skill. It typically includes metadata fields, input / output specifications for the corresponding skill, and usage examples of the skill. It is used to instruct the relevant device or processor "what this skill is," "how this skill is triggered," and "how this skill responds." For example, this description file can record the aforementioned application architecture information, authentication logic information, data flow information, and other code characteristic information.

[0126] For example, the script file mentioned above can be a file with an extension such as .py or .js. Figure 5A The file named "xxx.py" shown is an executable script that supports the implementation of the corresponding skill. For example, this script file can be used to call third-party services, operate on databases, etc., thereby realizing the skill triggering method and skill execution flow described in the description file above.

[0127] For example, the skill folder may also include resource files such as template files and sample files to provide output templates, process examples and other resources for the corresponding skills to ensure the implementation of the corresponding skills.

[0128] Figure 5B This is a flowchart illustrating the feature analysis of historical code files (i.e., step 302) in a code auditing method provided in one or more embodiments of this application.

[0129] Reference Figure 5B In step 302, the historical code files are subjected to feature analysis through the first large model application 210, which may include the following steps 302a~302d.

[0130] In step 302a, the code structure can be analyzed; specifically, this may include sub-steps such as identifying the application type and framework, parsing the directory structure, and locating configuration files, so as to provide a reference for subsequent code auditing processes such as architecture identification and key class location.

[0131] In step 302b, authentication components can be identified; specifically, this may include sub-steps such as analyzing the Filter layer, analyzing the Interceptor layer, and analyzing the Aspect layer, that is, identifying authentication components at different levels in sequence, so as to provide a reference for authentication logic analysis in the subsequent code audit process.

[0132] In step 302c, template execution can be identified; specifically, this may include sub-steps such as locating the template class, analyzing XML orchestration, and identifying data flow breakpoints, thereby clarifying the dependencies between various classes / methods in the historical code files, so as to provide a reference for data flow analysis in the subsequent code audit process.

[0133] In step 302d, skill files can be generated and stored based on the analysis results of the aforementioned steps 302a to 302c.

[0134] The format and storage method of the skill files can be configured as needed. For example, the skill file format can be configured as the SKILL file described above.

[0135] For example, in combination Figure 2 The schematic diagram is shown. Figure 5B The process of feature analysis of historical code files and the format of skill files shown can all be configured in preset prompts, thereby instructing the first large model application 210 to complete the feature analysis task of historical code files and obtain skill files that meet the requirements.

[0136] For ease of understanding, the contents of the description file of the above SKILL file are illustrated below as an example.

[0137] like Figure 5A As shown, the filename and extension of the description file can be SKILL.md, and it is stored together with script files in the SKILL folder named "{appname}-audit". This description file and the SKILL folder can be based on... Figure 5B The process shown is used to obtain the result. The contents of this description file are as follows:

【 • File location: {appname}-audit / SKILL.md • YAML Frontmatter (required): --- • name: {appname}-audit • Description: This skill is used for code auditing of the {appname} application. It specifies the configuration for vertical and horizontal permission checks, including interceptors. It includes API call chain analysis, template class execution logic tracing, and identification of key security control points. Use this skill when you need to analyze the {appname} code chain, identify security risks, and conduct code auditing.

[0138] # Example Code Audit Skill ## Overview This skill provides comprehensive information on the security architecture, authentication mechanisms, and RPC data flow patterns of the example codebase for security auditing purposes.

[0139] ## Code Structure - [Related Structure Description] ## Authentication Architecture ### 1. Horizontal Authentication (Role-Based Access Control) - [Details of Horizontal Authentication Implementation] ### 2. Vertical Authentication (API Level Access Control) - [Details of Vertical Authentication Implementation] ## Calling Logic ### AbstractRpcService → Operation Mode **Key Classes**: - [List of Key Classes] ### Operation Discovery Mechanism **Annotation-based registration**: - [Registration Mechanism Description] **Example Process**: - [Process Example] ## Security Control ### 1. Login Verification - [Login verification mechanism] ### 2. Content Security Verification - [Content verification mechanism] ### 3. Data Access Control - [Data Access Control Mechanism] ### 4. Session Management - [Session Management Mechanism] ## Security Testing Audit Points - [List of Audit Points] ## Key Security Analysis Documents ### Authentication and Authorization - [List of related files] ### Operation Implementation Mode - [Implementation Pattern Description] ### Data Access Control Example - [Control Example] - Check user authorization verification in lines 179-182 ## Security Audit Use When auditing this application: 1. [Audit Step 1] 2. [Audit Step 2] ## Data Stream Tracing ### 1. Entry Point: Service Layer **Data Flow**: - [Data Flow Description] ### 2. Operation Analysis: OperationFactory **Key Methods**: - [List of Key Methods] **Data Flow**: - [Data Flow Description] ### 3. Operation Execution: AbstractOperation Template - [Template Execution Description] ## Data Stream Tracing Example ### Example 1: Query Operation **Operation Name**: `[Operation Name]` **Complete Process**: 1. **Entry Point**: [Entry Point Description] 2. **Analysis:** [Analysis Process] 3. **Certification**: [Certification Process] 4. **Preprocessing**: [Preprocessing Operations] 5. **Service Logic**: [Service Logic Description] - [Specific service steps] 6. **Post-processing**: `postExecute()` (empty in this example) 7. **Response**: Returns an `InvoiceResp` containing the result code and data. **Key Security Points**: - [List of Safe Points] 】 For example, in step 106 or step 106' of the code audit phase, the second agent 221 in the second large model application 220 can obtain the above description file as needed and input it into the second preset model 222. Thus, the second preset model 222 does not need to traverse and analyze the code file to be audited. Based on the information related to the application architecture, such as "code structure" and "call logic" recorded in the above description file, it can quickly understand the dependencies between its different functional modules, providing a foundation for quickly locating the key classes and key methods required for subsequent audit steps.

[0140] For example, based on the authentication logic-related information such as "authentication architecture" and "security audit usage" recorded in the above description file, the second preset model 222 can quickly locate the key authentication classes and methods without traversing the code file to be audited, and thus accurately determine whether there are vulnerabilities in the permission verification points involved in the authentication process.

[0141] For example, based on the data flow-related information such as "data flow tracing" and "data flow tracing example" recorded in the above description file, the second preset model 222 can realize complete data flow tracing of the code file to be audited, solve the data flow tracing problems caused by template class execution, XML orchestration mode, etc., and improve the accuracy of data flow analysis and vulnerability detection.

[0142] Therefore, in the above embodiments, each skill file can record information such as the architecture, calling logic, key class list, auditing steps, data flow tracing process and examples, and key security points corresponding to the corresponding historical code file (i.e., the corresponding application). The relevant software or hardware devices that perform code auditing can reuse this information as context information for the code file to be audited, quickly and accurately "understand" the service logic of the code file to be audited and perform code analysis, effectively detect logical vulnerabilities in the code file to be audited, and improve the efficiency and accuracy of code auditing.

[0143] In some embodiments, continue to refer to Figure 4 In the preprocessing stage S3 of the above code auditing method, after generating the skill file through step 302, it may further include: Step 304: Store each skill file and its corresponding application identifier in the corresponding historical code file.

[0144] For example, a pre-set database can be used to uniformly store skill files corresponding to different applications (i.e., different historical code files); in this pre-set database, each skill file is stored based on the mapping relationship between skill files and application identifiers.

[0145] Based on this, during the code auditing phase, the corresponding skill files can be retrieved based on the application identifier, enabling automated identification and retrieval of the skill files required for each code audit. For example, obtaining the first skill file matching the code file to be audited in step 104 above can specifically include: determining the target application identifier corresponding to the code file to be audited, and searching a preset database for one or more skill files whose application identifier is the target application identifier, as the first skill file matching the code file to be audited.

[0146] Figure 5C This is a schematic diagram of a storage structure for storing skill files, provided for one or more embodiments of this application.

[0147] like Figure 5C As shown, the aforementioned preset database can be named "skill-repository". In this preset database, skill files can be categorized and indexed based on the application dimension. For example, different application identifiers such as app1 and app2 correspond to different applications, and different index branches can be formed. The skill file "skill.json" is located at the next level of the index branch of the corresponding application.

[0148] In the above embodiments, skill files corresponding to different applications (such as multiple different applications developed or used by the same enterprise) can be stored uniformly and retrieved based on application identifiers in different application scenarios (e.g., during code auditing, the first skill file matching the code file to be audited can be automatically retrieved), realizing the sharing and reuse of skill files in different scenarios. In addition, the unified storage of multiple skill files can also help build a code security knowledge graph, enabling the continuous accumulation and reuse of knowledge.

[0149] In some embodiments, the code auditing method described above may further include a feedback optimization phase S5 after obtaining the audit result through the code auditing phase S1. The feedback optimization phase S5 may include the following steps: Step 502: Obtain the dynamic test results corresponding to the code file to be audited, and compare them with the current audit results of the code file to be audited; Step 504: If the audit results of the code file to be audited are inconsistent with the dynamic test results, update the first skill file according to the dynamic test results.

[0150] The code auditing phase S1 described above actually discovers potential vulnerabilities by performing static analysis on the code file to be audited, without actually running the code; the dynamic test results described above are obtained by performing dynamic tests on the code file to be audited, that is, by running the code in the code file to be audited and judging whether vulnerabilities exist based on the running results.

[0151] Because the audit results are based on the first skill file, which in turn are based on the first historical code file, while the dynamic test results are obtained by directly running the code in the code file to be audited, the audit results are more prone to bias compared to the dynamic test results. In other words, if the audit results and the dynamic test results are inconsistent (e.g., a data flow path L is not a risk path in the audit results, but is a risk path in the dynamic test results), it indicates that the code feature information recorded in the first skill file may not be accurate enough. It is necessary to update and optimize it so that subsequent audits of matching code files based on the first skill file can yield more accurate audit results.

[0152] In some embodiments, the above step 504, which updates the first skill file based on the dynamic test results, can be implemented using the above first large model application 210.

[0153] For example, in step 504 above, if it is determined that the current audit result of the code file to be audited is inconsistent with the dynamic test result, the dynamic test result and the code file to be audited can be input into the first large model application 210, so that the first large model application 210 can perform feature analysis on the code file to be audited based on the dynamic test result to obtain a second skill file, and update the first skill file according to the second skill file.

[0154] For example, the above-mentioned updating of the first skill file based on the second skill file may specifically include: directly replacing the first skill file stored in the preset database with the second skill file, or modifying, deleting or adding content in the first skill file based on the second skill file.

[0155] In the above embodiments, after obtaining the audit results, the accuracy of the skill files used in the code audit is verified by combining the dynamic test results. This enables feedback and optimization of the skill files generated in the preprocessing stage S3, forming a closed loop between the preprocessing stage S3, the audit stage S1, and the feedback optimization stage S5. As a result, the skill files can be continuously optimized, thereby continuously improving the accuracy of code auditing and adapting to the rapid iteration of the application.

[0156] Based on the same inventive concept, one or more embodiments of this specification also provide a data preprocessing method. This data preprocessing method may include the following steps: Perform feature analysis on historical code files to obtain their code feature information; Based on the code feature information, generate the skill file corresponding to the historical code file; The skill file can serve as context information for the target code file and be applied to preset stages in the target code file's lifecycle; the application corresponding to the target code file is of the same type as the application corresponding to the aforementioned historical code file; the preset stages include at least one of the following: design stage, code audit stage, and operation and maintenance stage.

[0157] The lifecycle of target code files, also known as the software development lifecycle, includes, but is not limited to, multiple stages such as requirements analysis, design, coding, testing, auditing, deployment, operation, and maintenance.

[0158] For example, based on the code auditing method embodiment described above, the skill file obtained through the above data preprocessing method can be applied to the code auditing process of the target code file, thereby improving auditing efficiency and accuracy.

[0159] For example, the aforementioned skill files can also be applied to other stages of the target code file's lifecycle. For instance, in the design stage, the application architecture information recorded in the skill files can be used to quickly determine the application architecture of the target code file, improving design efficiency; in the coding stage, information such as key classes recorded in the skill files can be used to quickly determine the classes required to implement each service logic, improving coding efficiency.

[0160] In the above embodiments, by preprocessing one or more existing historical code files, one or more skill files that record the code feature information of the historical code files are generated. This is equivalent to converting the historical code files into unified and reusable knowledge, providing reference information for one or more stages in the software development life cycle corresponding to the same type of target code files. This avoids the repeated analysis of historical code files, improves the development efficiency of the same type of code files, and improves the iteration efficiency of the corresponding application.

[0161] It should be noted that the specific implementation of the above data preprocessing method can be referred to the relevant description of the preprocessing stage S3 in the previous embodiment, and will not be repeated here.

[0162] It is understood that the above embodiments are merely examples, and modifications can be made to the above embodiments in actual implementation. Those skilled in the art will understand that any modifications to the above embodiments that do not require creative effort fall within the protection scope of one or more embodiments of this specification, and will not be described again in the embodiments.

[0163] Based on the same inventive concept, one or more embodiments of this specification also provide a code auditing device. Figure 6 This is a structural block diagram of the code auditing device. (Example:) Figure 6As shown, the code auditing device 600 may include: The acquisition module 601 is used to acquire the code file to be audited, namely the first skill file that matches the code file to be audited, wherein the first skill file includes code feature information corresponding to the first historical code file, and the first historical code file and the application type corresponding to the code file to be audited are the same. The audit module 602 is used to audit the code file to be audited based on the first skill file and obtain the audit result corresponding to the code file to be audited.

[0164] In some embodiments, the code auditing apparatus 600 described above may further include: The preprocessing module 603 is used to perform feature analysis on multiple historical code files to obtain at least one skill file. Based on this, the aforementioned first historical code file can be one of the multiple historical code files processed by the preprocessing module 603, and the aforementioned first skill file is one of the at least one skill file obtained by the preprocessing module 603.

[0165] In some embodiments, the code auditing apparatus 600 described above may further include: The optimization module 604 is used to obtain the dynamic test results corresponding to the code file to be audited, compare them with the audit results obtained by the audit module 602, and update the first skill file according to the dynamic test results if the dynamic test results are inconsistent with the current audit results.

[0166] Since the principle by which the code auditing device 600 solves the problem is similar to that of the aforementioned code auditing method, the specific implementation and principle of each module in the code auditing device 600 can be found in the relevant embodiments of the aforementioned code auditing method, and repeated details will not be repeated.

[0167] Based on the same inventive concept, one or more embodiments of this specification also provide a data preprocessing apparatus. Figure 7 This is a block diagram of the data preprocessing device. Figure 7 As shown, the data preprocessing apparatus 700 may include: The feature analysis module 701 is used to perform feature analysis on historical code files to obtain code feature information of historical code files. The file generation module 702 is used to generate skill files corresponding to historical code files based on code feature information.

[0168] The skill file generated by the file generation module 702 is used as context information and applied to a preset stage in the lifecycle of the target code file. The target code file is of the same type as the application corresponding to the historical code file. The preset stage includes at least one of the design stage, code audit stage, and operation and maintenance stage.

[0169] Since the principle of the problem solved by the data preprocessing device 700 is similar to that of the aforementioned data preprocessing method, the specific implementation and principle of each module in the data preprocessing device 700 can be found in the relevant embodiments of the aforementioned data preprocessing method, and repeated details will not be repeated.

[0170] See Figure 8 , Figure 8 This is a structural block diagram of an electronic device provided for one or more embodiments of this specification. Figure 8 As shown, the electronic device 800 may include a processor 801 and a memory 802; the memory 802 may be coupled to the processor 801. It is worth noting that... Figure 8 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions. The electronic device can be a server, client, or other intermediate device in a software development system.

[0171] In one possible implementation, the functions of the code auditing device 600 and / or the data preprocessing device 700 can be integrated into the processor 801. The processor 801 can be configured to perform some or all of the steps described in any of the preceding method embodiments.

[0172] In another possible implementation, the code auditing device 600 and / or the data preprocessing device 700 can be configured separately from the processor 801. For example, the code auditing device 600 and / or the data preprocessing device 700 can be configured as a chip connected to the processor 801, and the auditing of the code file to be audited or the feature analysis of historical code files can be realized through the control of the processor 801 to obtain the corresponding audit results or skill files.

[0173] Furthermore, in some alternative implementations, the electronic device 800 may also include: a communication module, an input unit, an audio processor, a display, a power supply, etc. It is worth noting that the electronic device 800 is not necessarily required to include these components. Figure 8 All components shown; in addition, the electronic device 800 may also include Figure 8 For components not shown, please refer to existing technologies.

[0174] This specification also provides, in one or more embodiments, a computer-readable storage medium capable of implementing all steps of the code auditing method or data preprocessing method in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the code auditing method or data preprocessing method in the above embodiments. Specific steps are described in the preceding embodiments and will not be repeated here.

[0175] In addition, one or more embodiments of this specification also provide a computer program product capable of implementing all the steps in the above-described code auditing method or data preprocessing method embodiments; the computer program product includes: a computer program or instructions, which, when executed on a computer, cause the computer to implement all the steps of the code auditing method or data preprocessing method in the above-described embodiments. Specific steps can be found in the foregoing embodiments and will not be repeated here.

[0176] The foregoing has described specific embodiments of this specification. In other possible implementations, some or all of the actions or steps described in the above embodiments may be performed in a different order than that shown in the above embodiments, and the desired result may still be achieved. Furthermore, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0177] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and system embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0178] It should be noted that, unless otherwise specified, one or more embodiments of this specification and the features thereof can be combined with each other. This specification is not limited to any single aspect, nor to any single embodiment, nor to any combination and / or substitution of such aspects and / or embodiments. Furthermore, each aspect and / or embodiment of one or more embodiments of this specification can be used alone, or in combination with one or more other aspects and / or embodiments thereof.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of one or more embodiments of this specification, and are not intended to limit them. Although one or more embodiments of this specification have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of one or more embodiments of this specification, and they should all be covered within the scope of the claims and the specification of one or more embodiments of this specification.

[0180] The foregoing description of one or more embodiments of this specification has been provided in conjunction with optional implementation methods. However, these embodiments are merely exemplary and serve only an illustrative purpose. Based on this, various substitutions and modifications can be made to one or more embodiments of this specification, all of which fall within the protection scope of one or more embodiments of this specification.

Claims

1. A code auditing method, characterized in that, include: Obtain the code file to be audited; Obtain a first skill file that matches the code file to be audited, wherein the first skill file includes code feature information corresponding to a first historical code file, and the first historical code file is of the same type as the application corresponding to the code file to be audited; The audit results are obtained by auditing the code file to be audited based on the first skill file.

2. The method according to claim 1, characterized in that, The code feature information includes at least one of the following: application architecture information, authentication logic information, and data flow information; Auditing the code file to be audited based on the first skill document includes at least one of the following: Based on the application architecture information, determine the application architecture of the code file to be audited; Based on the authentication logic information, identify the key authentication classes in the code file to be audited, and perform security control analysis based on the key authentication classes; Based on the data flow information, identify the key data flow nodes in the code file to be audited, and perform data flow analysis based on the key data flow nodes.

3. The method according to claim 1 or 2, characterized in that, Also includes: Feature analysis was performed on multiple historical code files to obtain at least one skill file; Wherein, the first historical code file is one of the plurality of historical code files, and the first skill file is one of the at least one skill file.

4. The method according to claim 3, characterized in that, Feature analysis was performed on multiple historical code files, including: The historical code file and preset prompt words are input into the first large model application, so that the first large model application performs feature analysis on the historical code file based on the preset prompt words to obtain the skill file corresponding to the historical code file; The preset prompt words are used to indicate at least one of the following: the analysis steps of the first large model application on the historical code file, and the format of the skill file.

5. The method according to claim 3, characterized in that, Feature analysis was performed on multiple historical code files, including: The historical code file, preset prompt words, and historical analysis results are input into the first large model application, so that the first large model application performs feature analysis on the historical code file based on the preset prompt words and the historical analysis results to obtain the skill file corresponding to the historical code file; The preset prompt words are used to indicate the analysis steps of the first large model application on the historical code file; The historical analysis results are the analysis results obtained by analyzing the historical code files based on a preset analysis method, which includes at least one of data flow analysis, control flow analysis, and symbolic execution analysis.

6. The method according to claim 3, characterized in that, Also includes: After obtaining the skill file, the skill file is stored in correspondence with the application identifier corresponding to the historical code file, so that the corresponding skill file can be called based on the application identifier.

7. The method according to claim 1 or 2, characterized in that, Also includes: Obtain the dynamic test results corresponding to the code file to be audited; If the dynamic test results are inconsistent with the current audit results, the first skill file shall be updated based on the dynamic test results.

8. The method according to claim 1 or 2, characterized in that, Obtaining the code file to be audited includes: in response to a preset trigger command, obtaining the code file to be audited; The preset trigger command includes at least one of the following: The first trigger command is generated based on preset user operations; The second trigger instruction is generated based on the preset software development pipeline.

9. The method according to claim 1 or 2, characterized in that, Also includes: Obtain the audit prompt words for this audit, which include at least one preset vulnerability to be detected in this code audit; Auditing the code file to be audited based on the first skill file includes: The code file to be audited, the first skill file, and the audit prompt words are input into the second large model application, so that the second large model application analyzes the code file to be audited based on the first skill file to determine whether the code file to be audited has the preset vulnerability.

10. A data preprocessing method, characterized in that, include: Perform feature analysis on historical code files to obtain code feature information of the historical code files; Based on the code feature information, a skill file corresponding to the historical code file is generated; The skill file is used as context information and applied to preset stages in the lifecycle of the target code file. The target code file and the historical code file correspond to the same type of application. The preset stages include at least one of the design stage, code audit stage, and operation and maintenance stage.

11. A code auditing device, characterized in that, include: The acquisition module is used to acquire the code file to be audited and a first skill file that matches the code file to be audited, wherein the first skill file includes code feature information corresponding to a first historical code file, and the first historical code file is of the same type as the application corresponding to the code file to be audited; The audit module is used to audit the code file to be audited based on the first skill file, and obtain the audit result corresponding to the code file to be audited.

12. A data preprocessing apparatus, characterized in that, include: The feature analysis module is used to perform feature analysis on historical code files to obtain the code feature information of the historical code files; The file generation module is used to generate skill files corresponding to the historical code files based on the code feature information. The skill file is used as context information and applied to preset stages in the lifecycle of the target code file. The target code file and the historical code file correspond to the same type of application. The preset stages include at least one of the design stage, code audit stage, and operation and maintenance stage.

13. An electronic device, characterized in that, The electronic device includes: Memory, used to store computer program products; A processor is configured to execute a computer program product stored in the memory, wherein, when the computer program product is executed, it implements the method described in any one of claims 1-10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed, implement the method described in any one of claims 1-10.

Images