Incremental code detection method, device, medium and electronic equipment

Abstract

The present application belongs to the technical field of code detection, and the present application provides an incremental code detection method, device, medium and electronic device. Among them, the incremental code detection method includes comparing the code to be detected and the original code to obtain the difference code of the code to be detected relative to the original code; the code to be detected is the code modified on the basis of the original code; according to the difference code, a difference method list in the difference code is obtained, and the difference method list has at least one difference method sub-code, and the difference method list is a set of methods that cause the code to be detected to change relative to the original code; according to the preset calling rules, the calling code and the called code corresponding to each difference method sub-code in the difference method list are obtained; the calling code, the called code and the difference code are detected as incremental codes. The technical solution of the present application can improve the efficiency of code detection.

Description

Technical Field

[0001] The present application belongs to the field of code detection technology, and specifically relates to an incremental code detection method, an incremental code detection device, a computer-readable medium, and an electronic device. Background Art

[0002] Incremental detection is one of the important ways to improve the detection speed of large files in code auditing. Imperfect extraction and processing of incremental files will lead to a sharp increase in the false positive rate and missed negative rate of code incremental detection results.

[0003] Currently, incremental file extraction for the code to be detected is often achieved by comparing the previous and next version files and extracting the difference files. However, in actual engine detection, a large number of data flow defects are often involved, and the code file domain includes information such as entry points, source points, and outbreak points. As a result, the accuracy of the existing incremental code extraction is not high, which is not conducive to improving the efficiency of detecting the code to be detected.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present application is to provide an incremental code detection method, device, medium and electronic device, which can at least to some extent overcome the technical problems of low detection efficiency in related technologies.

[0006] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0007] According to one aspect of an embodiment of the present application, there is provided an incremental code detection method, comprising: comparing a code to be detected with an original code to obtain a difference code between the code to be detected and the original code; the code to be detected is a code modified on the basis of the original code; according to the difference code, obtaining a difference method list in the difference code, the difference method list having at least one difference method sub-code, the difference method list being a set of methods causing changes in the code to be detected relative to the original code; according to a preset calling rule, obtaining a calling code and a called code corresponding to each difference method sub-code in the difference method list; detecting the calling code, the called code and the difference code as incremental code.

[0008] In some embodiments, obtaining the calling code and the called code respectively corresponding to each difference method sub-code in the difference method list according to a preset calling rule includes: obtaining metadata respectively corresponding to each difference method sub-code in the difference method list; the metadata includes method class metadata; determining the calling code and the called code respectively corresponding to each difference method sub-code in the difference method list according to the method class metadata and the preset calling rule.

[0009] In some embodiments, the method class metadata and the preset calling rules are used to determine the calling codes and the called codes corresponding to the various difference method sub-codes in the difference method list, including: obtaining metadata corresponding to other codes in the code to be detected except the difference method sub-code; according to the preset calling rules, associating the metadata corresponding to the other codes with the method class metadata corresponding to the difference method sub-codes, and generating a calling chain corresponding to the code to be detected; according to the calling chain, obtaining the calling codes and the called codes corresponding to the various difference method sub-codes in the difference method list.

[0010] In some embodiments, the calling rules include calling naming rules; obtaining the calling code and the called code corresponding to each difference method sub-code in the difference method list according to the preset calling rules includes: obtaining the method signatures corresponding to each of the difference method sub-codes in the difference method list; based on the calling naming rules and based on the method signatures, determining the calling code and the called code corresponding to each of the difference method sub-codes in turn.

[0011] In some embodiments, based on the call naming rule and the method signature, the calling code and the called code corresponding to each of the difference method subcodes are determined in turn, including: based on the difference method subcode, an initial incremental code call chain is established; based on the call naming rule and the method signature, whether each of the difference method subcodes is an entry for calling other codes, and whether it is an application class code name, are determined in turn; wherein the call naming rule defines an application class code name, and the application class code has an upper-level call entry; when it is determined that the difference method subcode is an entry for calling other codes, the called code corresponding to the difference method subcode is obtained, and the calling relationship between the difference method subcode and the called code is added to the incremental code call chain; when the method signature is the application class code name, the calling code corresponding to the difference method subcode is obtained, and the calling relationship between the calling code and the difference method subcode is added to the incremental code call chain.

[0012] In some embodiments, after determining the calling code and the called code corresponding to each of the difference method sub-codes respectively based on the calling naming rule and the method signature, the method further includes: obtaining at least one external calling entry for calling each code in the incremental code calling chain according to a preset entry rule; and performing incremental code detection on the calling code, the called code and the difference code based on the external calling entry.

[0013] In some embodiments, obtaining a list of difference methods in the difference code based on the difference code includes: performing grammatical analysis on the difference code to obtain a grammatical structure corresponding to the difference code; comparing changes in the grammatical structure in the code to be detected and in the original code to obtain a list of difference methods in the difference code based on the changes.

[0014] According to one aspect of an embodiment of the present application, there is provided an incremental code detection device, comprising:

[0015] A first acquisition unit is used to compare the code to be detected with the original code to obtain a difference code between the code to be detected and the original code; the code to be detected is a code modified based on the original code;

[0016] A second acquisition unit is used to acquire, according to the difference code, a difference method list in the difference code, wherein the difference method list has at least one difference method sub-code, and the difference method list is a set of methods that cause the code to be detected to change relative to the original code;

[0017] A third acquisition unit is used to acquire, according to a preset calling rule, a calling code and a called code corresponding to each difference method subcode in the difference method list;

[0018] The detection unit is used to detect the calling code, the called code and the difference code as incremental codes.

[0019] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the incremental code detection method in the above technical solution is implemented.

[0020] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the incremental code detection method in the above technical solution by executing the executable instructions.

[0021] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the incremental code detection method in the above technical solution.

[0022] In the technical solution provided in the embodiment of the present application, each difference method subcode in the difference code is first obtained, and then the forward calling code of the difference method and the backward called code are obtained according to the preset calling rules. The calling code, the called code and the difference code are detected as incremental codes, so as to detect each code on the upstream and downstream calling chain of each difference method subcode, thereby preventing the tainted data flow of external users from affecting the security of the code to be detected through the incremental code. At the same time, the difference code can also be normalized and legalized, which can improve the efficiency of code detection and the accuracy of detection.

[0023] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0026] Figure 2 A schematic diagram of the process flow of an incremental code detection method of the present application is shown.

[0027] Figure 3 It is a flowchart for determining a calling code and a called code according to an embodiment of the present application.

[0028] Figure 4 It is a flowchart of an incremental code detection method provided according to a specific embodiment of the present application.

[0029] Figure 4a The schematic diagram shows a structure of a code to be detected.

[0030] Figure 4b Schematically shows Figure 4aA schematic diagram of an incremental code call chain based on .

[0031] Figure 5 It is a flowchart of a bidirectional call relationship search provided according to a specific embodiment of the present application.

[0032] Figure 6 yes Figure 5 Schematic diagram of code for generating a result list according to the embodiment shown in FIG.

[0033] Figure 7 This is a schematic diagram of metadata generation according to an embodiment of the present application.

[0034] Figure 8 The structural block diagram of the incremental code detection device provided in an embodiment of the present application is schematically shown.

[0035] Fig. 9 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0037] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0038] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0039] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0040] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0041] like Figure 1 As shown, the system architecture 100 may include a terminal device 110, a network 120, and a server 130. The terminal device 110 may include various electronic devices such as a smart phone, a tablet computer, a laptop computer, and a desktop computer. The server 130 may be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The network 120 may be a communication medium of various connection types that can provide a communication link between the terminal device 110 and the server 130, such as a wired communication link or a wireless communication link.

[0042] According to the implementation requirements, the system architecture in the embodiment of the present application can have any number of terminal devices, networks and servers. For example, the server 130 can be a server group composed of multiple server devices. In addition, the technical solution provided in the embodiment of the present application can be applied to the terminal device 110, can also be applied to the server 130, or can be implemented by the terminal device 110 and the server 130 together, and the present application does not make any special restrictions on this.

[0043] For example, the scheme of the present application is applicable to any computer device or platform composed of multiple computer devices that need to determine the incremental code test in the software. The computer device or platform has a main control program for incremental code testing in the present application, which can be a plug-in program or an independent program. In addition, the main control program can also be run in a certain or at least part of the computer devices of the test platform. In one embodiment, the test platform can also include at least one storage device, the storage device can store the data generated by the operation of the main control program, the storage device can perform code testing on the software version file to obtain test result information, etc., and can also store intermediate data generated during the incremental code test of the main control program. The storage device can also be used to store the software version files of each software version involved in the test platform, and the software version file includes at least one code file, and each code file includes at least one (or at least one line) of code. There are many possible specific ways for the storage device to store various data in the present application. For example, in one possible implementation, at least one storage device can adopt a distributed storage method.

[0044] The incremental code detection method provided by the present application is described in detail below in conjunction with specific implementation methods.

[0045] like Figure 2 As shown, Figure 2A schematic flow chart of an incremental code detection method of the present application is shown. The method of this embodiment can be applied to a test platform composed of one computer device or multiple computer devices.

[0046] The method of this embodiment may include the following steps S210 to S240.

[0047] Step S210: Compare the code to be detected with the original code to obtain a difference code between the code to be detected and the original code.

[0048] In actual applications, code updates and iterations are frequent. In this application, the code to be tested is the code modified based on the original code. Therefore, the code to be tested will have code changes or additions relative to the original code.

[0049] Specifically, the code to be checked and the source code both include multiple lines of code. The code to be checked and the source code both include multiple sub-code functions, and each sub-code function generally includes multiple (or called lines) of code.

[0050] By comparing the code to be detected with the original code, the difference code between the code to be detected and the original code can be obtained. Specifically, the hash values ​​corresponding to each sub-code in the code to be detected and the original code can be calculated, so as to determine the difference code by comparing the hash values. In the present application, there can be many ways to determine the difference code between two codes to be detected and the original code, and there is no limitation on this.

[0051] Step S220: According to the difference code, a difference method list in the difference code is obtained, wherein the difference method list has at least one difference method sub-code.

[0052] The difference method list is a set of methods that cause the code to be detected to change relative to the original code.

[0053] For the extracted difference code, the lexical, grammatical and semantic analysis can be performed with the help of the syntax analysis framework to generate an abstract syntax tree (AST) to determine whether the grammatical structure of the method of the previous and subsequent versions has changed. If it has changed, the difference method is added to the list of difference methods to be processed.

[0054] The difference code may include several method codes, wherein some method codes are changed relative to the original code, and the set of changed methods is the difference method list.

[0055] In some embodiments, based on the difference code, a list of difference methods in the difference code is obtained, which may specifically include the following steps: obtaining metadata corresponding to the difference code, the metadata including parameter class data and method class metadata; based on the method class metadata in the difference code, determining the list of difference methods corresponding to the difference code.

[0056] Specifically, the difference code can be compiled so that the test platform can successfully obtain the metadata of the difference code. Compared with the code to be tested, the metadata is finer in granularity, thereby providing a more fine-grained comparison method. The metadata may include method class metadata and parameter class metadata. According to the comparison, the difference method of the code to be tested relative to the original code can be further located from the method class information, and then a difference method list can be generated, which is convenient for the test platform to perform subsequent traversal.

[0057] Step S230: According to a preset calling rule, the calling code and the called code corresponding to each difference method subcode in the difference method list are obtained.

[0058] In one embodiment, obtaining the calling code and the called code corresponding to each difference method subcode in the difference method list may specifically include the following steps: obtaining metadata corresponding to each difference method subcode in the difference method list; the metadata includes method class metadata; according to the method class metadata and the preset calling rules, determining the calling code and the called code corresponding to each difference method subcode in the difference method list. Specifically, the method class metadata may include method signature, method parameters, method body, return value, identifier, etc. Thus, the calling code and the called code corresponding to each difference subcode may be obtained from a smaller granularity and more detailed perspective, thereby improving the accuracy of obtaining the difference subcode context call chain.

[0059] In one embodiment, the calling codes and called codes corresponding to the respective difference method subcodes in the difference method list are determined according to the method class metadata and the preset calling rules, which may specifically include: obtaining the metadata corresponding to other codes except the difference method subcodes in the code to be detected; according to the preset calling rules, associating the metadata corresponding to other codes with the method class metadata corresponding to the difference method subcodes, and generating a calling chain corresponding to the code to be detected; according to the calling chain, obtaining the calling codes and called codes corresponding to the respective difference method subcodes in the difference method list.

[0060] The preset calling rules may include preset calling function signatures, and the calling function signatures may be adapted to the functions of the calling object, etc. It should be noted that when performing code version iterations, the same set of calling rules are usually followed to standardize the code and facilitate subsequent code maintenance.

[0061] In one embodiment, the call chain can be defined as G(V, E), where V represents the nodes of the graph G, and E represents the edges of the nodes. The nodes represent the calling code, the called code, and the code corresponding to the difference party, and the edges represent the calling relationship between the codes, so that the calling rules can be clearly displayed, and then the calling code and the called code corresponding to each difference method sub-code in the difference method list can be obtained according to the call chain.

[0062] In some embodiments, the calling rules may also include calling naming rules. According to the preset calling rules, the calling code and the called code corresponding to each difference method subcode in the difference method list are obtained, which may specifically include the following steps: obtaining the method signatures corresponding to each difference method subcode in the difference method list; based on the calling naming rules and the method signatures, determining the calling code and the called code corresponding to each difference method subcode in turn. Thus, the calling naming rules can be used to more quickly determine the calling code and the called code corresponding to each difference method subcode. In another embodiment, the calling naming can also be generated based on the metadata corresponding to the code to be detected, so that the extraction of the calling code and the called code is more accurate.

[0063] Step S240: Detect the calling code, the called code, and the difference code as incremental codes.

[0064] Specifically, the calling code is the entry code for calling the difference method sub-code in the difference code, and the called code is the code called by each difference method sub-code.

[0065] Therefore, first obtain each difference method subcode in the difference code, and then obtain the forward calling code of the difference method and the backward called code according to the preset calling rules. The calling code, the called code and the difference code are detected as incremental codes, so as to detect the codes on the upstream and downstream calling chains of each difference method subcode, thereby preventing the tainted data flow of external users from affecting the security of the code to be detected by calling the incremental code. At the same time, the difference code can also be normalized and legalized, which can improve the efficiency of code detection and the accuracy of detection.

[0066] Figure 3 FIG. 1 is a flowchart for determining a calling code and a called code according to an embodiment of the present application. Figure 3 As shown, in this embodiment, based on the calling naming rule and the method signature, the calling code and the called code corresponding to each difference method subcode are determined in sequence, which may specifically include the following steps S310 and S330:

[0067] Step S310: Establish an initial incremental code call chain based on the difference method subcodes;

[0068] Step S320: Based on the call naming rule and the method signature, determine in sequence whether each difference method subcode is an entry for calling other codes and whether it is an application class code name; wherein the call naming rule defines an application class code name, and the application class code has an upper-level call entry;

[0069] Step S330: when it is determined that the difference method subcode is an entry for calling other codes, obtain the called code corresponding to the difference method subcode, and add the calling relationship between the difference method subcode and the called code to the incremental code calling chain;

[0070] Step S340: When the method signature is an application class code name, obtain the calling code corresponding to the difference method subcode, and add the calling relationship between the calling code and the difference method subcode to the incremental code calling chain.

[0071] Specifically, the incremental code call chain is a call chain corresponding to the difference method sub-code, and records the context call relationship information of the difference method sub-code.

[0072] The difference method subcodes can be traversed one by one to determine whether each difference method subcode is an entry for calling other codes, and whether it can be called by other codes, thereby generating an incremental code call chain. In other words, traverse each difference method subcode to see if it has a corresponding calling code and called code. If so, the calling code and called code on the call chain are detected as incremental codes. It is easy to understand that if the difference method subcode does not have a calling code, it means that the difference method subcode cannot be called externally, that is, the security of the difference method subcode is relatively high, and there will be no input attacks or sensitive data leakage problems from external users. Correspondingly, if the difference method subcode does not have a called code, it means that the program is executed to the difference method subcode, and there is no need to detect other files behind the call chain of the difference code.

[0073] Figure 4a The schematic diagram shows a structure of a code to be detected. Figure 4b Schematically shows Figure 4a A schematic diagram of an incremental code call chain based on .

[0074] like Figure 4aAs shown, the code to be detected includes code A, B, C and D. Among them, code A1 can call B1 and B2, B1 can call C1, C1 has two executable branches C2 and D1, B2 can call C3, and C3 can call D2. Assume that C is the difference code. The difference code C has three methods, C1, C2 and C3. Assume that C1 and C2 are the difference methods that cause the code to be detected to change relative to the original code, that is, assume that C1 and C2 are the difference method subcodes, and assume that A1 is the external call entry. As shown Figure 4b As shown, the calling code of the difference method subcode C1 is B1, and the called code of C1 is D1. B1 can be called through the external call entry A1. The two executable branches of C1 are also retained in the incremental code call chain to detect each code on the upstream and downstream call chains of C1 and C2, thereby preventing the tainted data flow of external users from affecting the security of the code to be detected through the incremental code. At the same time, the difference code C can also be normalized and legalized, which can improve the efficiency of code detection and the accuracy of detection.

[0075] In some embodiments, after determining the calling code and the called code corresponding to each difference method sub-code respectively based on the calling naming rules and the method signature, the following steps may be specifically included: according to the preset entry rules, obtaining at least one external calling entry for calling each code in the incremental code calling chain; based on the external calling entry, performing incremental code detection on the calling code, the called code and the difference code.

[0076] Specifically, the entry rule defines the entry method of the code to be detected, and the entry rule is a set of defined entry methods. For example, the main method, the predefined interface method, or the method of reading the database, etc. According to the preset entry rules, it is easy to obtain at least one external call entry for calling each code in the incremental code call chain, so that the code, the called code, and the difference code can be called based on the external call entry to perform incremental code detection. In one embodiment, in order to facilitate call detection and reduce the amount of calculation of the system, the class files corresponding to the calling code, the called code, and the difference code can also be used as incremental codes, and the class files are sent to the detection platform for detection, and the detection results are output.

[0077] To facilitate understanding of the inventive concept of the present application, a specific embodiment is provided below for illustration.

[0078] Figure 4 1 is a flowchart of an incremental code detection method provided according to a specific embodiment of the present application. Figure 4 As shown, the incremental code detection method may include the following steps S401 to S410.

[0079] Step S401, upload the code to be tested;

[0080] Step S402: Use the sha1 value of the code to be detected as the file fingerprint, compare the fingerprints of the previous and next versions of the file, and extract the difference code with changes;

[0081] Step S403: Compare the syntax structure of the difference file based on AST, and obtain the difference method and the difference method subcode corresponding to the difference method;

[0082] Step S404: Generate a fact file corresponding to the code to be detected according to the code to be detected, wherein the fact file includes method class metadata;

[0083] Step S405: extract one or more external call entry points of the code to be detected according to the preset entry rules;

[0084] Step S406: searching the forward and backward calling relationships of the difference method subcodes according to the metadata and the preset calling rules;

[0085] Step S407, obtaining the calling code and the called code corresponding to the difference method subcode;

[0086] Step S408, obtaining the external call entry corresponding to the difference code, the calling code and the called code;

[0087] Step S409: extract the difference code, calling code and called code, and input them into the detection engine for incremental code detection. Perform incremental code detection according to the external call entry corresponding to the difference code, calling code and called code;

[0088] Step S410: output the detection result.

[0089] Specifically, in this embodiment, the difference code is obtained through fingerprint comparison, the difference method and its sub-code are obtained through syntax comparison, the preset entry rule is used to obtain the external call entry of the code to be detected, and the preset calling rule and the metadata corresponding to the fact element are combined to perform forward and backward calling relationship searches on the difference method sub-code to obtain the calling code and the called code corresponding to the difference method sub-code, and the difference code, the calling code and the called code are used as the incremental code. Finally, the incremental code is called and tested based on the preset entry rule to obtain the detection result, thereby realizing the extraction of the difference method sub-code and the code on the calling chain, which solves the problems of slow detection speed of large files, high false alarm rate and high missed alarm rate of code incremental detection results.

[0090] Figure 5The flowchart of the bidirectional call relationship search provided according to a specific embodiment of the present application is used to obtain the calling code and the called code, and to obtain the difference method subcode, the calling code and the list of methods in the called code that are the calling entry. Figure 5 As shown, the forward and backward calling relationship searches may specifically include the following steps S501 to S506.

[0091] Step S501, traverse the difference method subcodes;

[0092] Step S502, forwardly obtain the object calling situation in the difference method subcode, in other words, obtain the calling code;

[0093] Step S503, determine whether the object call type is an application class method; if so, execute step S501; if not, execute step S506;

[0094] Step S504, backwardly obtain the object that calls the difference method subcode, in other words, obtain the called code;

[0095] Step S505, determine whether the object calling the difference method subcode is an entry method, if not, execute step S501 to obtain the backward acquisition call status of the next difference method subcode; if yes, execute step S506;

[0096] Step S506: Add to the result list.

[0097] After the traversal is completed, the final result list will be generated. The result list is a list of the method signatures corresponding to the calling entry in the difference method sub-code, calling code, and called code. Specifically, the difference method list is traversed in sequence, and combined with the fact file, it is forward judged whether the calling object in the difference method is an application class method. If so, the method signature of the calling object is added to the result list, otherwise the object call is ignored; combined with the fact file and the entry method list, the called object of the method is backward queried. If the target method is an entry method within the threshold range, the method signature of the target entry method is added to the result list, otherwise the search for the entry method is abandoned. Keeping the entry file as an incremental file can ensure that the engine detects possible data flow paths. Among them, the entry method list is generated according to the entry rules. The application class method is a pre-defined method with a preceding calling code. The entry method is a pre-defined method with a post-order called code.

[0098] Figure 6 yes Figure 5 Schematic diagram of the code for generating a result list of the embodiment shown in . Figure 6As shown, the difference method list is recorded as WL, the entry method list is recorded as entrypoints, the fact file is recorded as method_invocation, and the result list is recorded as RL.

[0099] Figure 7 This is a schematic diagram of metadata generation according to an embodiment of the present application. Figure 7 include Figure 7 a and Figure 7 b, where Figure 7 a is a schematic diagram of the code to be detected; Figure 7 b is Figure 7 A schematic diagram of the fact file corresponding to the code to be detected. Specifically, from Figure 7 The metadata corresponding to the code to be detected can be obtained in b, including method signatures, such as demo.Main, method parameter types, such as java.lang.String, and the class to which the method belongs. This can provide a more granular comparison method and improve the accuracy of incremental code extraction.

[0100] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0101] The following introduces an apparatus embodiment of the present application, which can be used to execute the incremental code detection method in the above-mentioned embodiment of the present application. Figure 8 The structure block diagram of the incremental code detection device provided by the embodiment of the present application is schematically shown. Figure 8 As shown, the incremental code detection device may specifically include:

[0102] The first acquisition unit 810 is used to compare the code to be detected with the original code to obtain a difference code between the code to be detected and the original code; the code to be detected is a code modified based on the original code;

[0103] A second acquisition unit 820 is configured to acquire, according to the difference code, a difference method list in the difference code, wherein the difference method list has at least one difference method subcode, and the difference method list is a set of methods that cause the code to be detected to change relative to the original code;

[0104] The third acquisition unit 830 is used to acquire the calling code and the called code corresponding to each difference method subcode in the difference method list according to a preset calling rule;

[0105] The detection unit 840 is used to detect the calling code, the called code and the difference code as incremental codes.

[0106] The specific details of the incremental code detection device provided in each embodiment of the present application have been described in detail in the corresponding method embodiments and will not be repeated here.

[0107] Fig. 9 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0108] It should be noted that Fig. 9 The computer system 900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0109] like Fig. 9 As shown, the computer system 900 includes a central processing unit 901 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 902 (ROM) or the program loaded from the storage part 908 to the random access memory 903 (RAM). Various programs and data required for system operation are also stored in the random access memory 903. The central processing unit 901, the read-only memory 902 and the random access memory 903 are connected to each other through a bus 904. An input / output interface 905 (Input / Output interface, i.e., I / O interface) is also connected to the bus 904.

[0110] The following components are connected to the input / output interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

[0111] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the central processor 901, various functions defined in the system of the present application are executed.

[0112] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0113] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0114] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0115] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0116] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0117] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An incremental code detection method, characterized in that: include: Comparing the code to be detected with the original code to obtain a difference code between the code to be detected and the original code; The code to be detected is a code modified based on the original code; According to the difference code, a difference method list in the difference code is obtained, wherein the difference method list has at least one difference method sub-code, and the difference method list is a set of methods that cause the code to be detected to change relative to the original code; According to a preset calling rule, obtaining a calling code and a called code respectively corresponding to each of the difference method subcodes in the difference method list; Detecting the calling code, the called code, and the difference code as incremental codes; The calling rule includes a calling naming rule; and obtaining the calling code and the called code corresponding to each difference method subcode in the difference method list according to the preset calling rule includes: Obtain method signatures corresponding to each of the difference method subcodes in the difference method list; Based on the calling naming rule and the method signature, determining the calling code and the called code corresponding to each of the difference method subcodes respectively in sequence; Wherein, based on the calling naming rule and the method signature, determining the calling code and the called code corresponding to each of the difference method subcodes respectively in sequence, includes: Based on the difference method subcodes, an initial incremental code call chain is established; Based on the calling naming rule and the method signature, determining in sequence whether each of the difference method subcodes is an entry for calling other codes; and determining in sequence whether it is an application class code name; wherein the calling naming rule defines an application class code name, and the application class code has an upper-level calling entry; In the case where it is determined that the difference method subcode is an entry for calling other codes, obtaining the called code corresponding to the difference method subcode, and adding the calling relationship between the difference method subcode and the called code to the incremental code calling chain; In the case where the method signature is the application class code name, the calling code corresponding to the difference method subcode is obtained, and the calling relationship between the calling code and the difference method subcode is added to the incremental code calling chain.

2. The method according to claim 1, characterized in that The step of obtaining the calling code and the called code corresponding to each of the difference method subcodes in the difference method list according to the preset calling rule includes: Obtain metadata corresponding to each of the difference method subcodes in the difference method list; the metadata includes method class metadata; According to the method class metadata and a preset calling rule, the calling code and the called code respectively corresponding to each of the difference method subcodes in the difference method list are determined.

3. The method according to claim 2, characterized in that The determining, according to the method class metadata and a preset calling rule, the calling code and the called code corresponding to each of the difference method subcodes in the difference method list, respectively, comprises: Obtain metadata corresponding to other codes in the code to be detected except the difference method sub-code; According to a preset calling rule, the metadata corresponding to the other codes are associated with the method class metadata corresponding to the difference method subcodes, and a calling chain corresponding to the code to be detected is generated; According to the call chain, the calling code and the called code respectively corresponding to each difference method subcode in the difference method list are obtained.

4. The method according to claim 1, characterized in that: After determining the calling code and the called code corresponding to each of the difference method subcodes respectively based on the calling naming rule and the method signature, the method further includes: According to a preset entry rule, obtaining at least one external call entry for calling each code in the incremental code call chain; Based on the external call entry, incremental code detection is performed on the calling code, the called code and the difference code.

5. The method according to claim 1, characterized in that The step of obtaining a list of difference methods in the difference code according to the difference code includes: Performing grammatical analysis on the difference code to obtain a grammatical structure corresponding to the difference code; The changes of the grammatical structures in the code to be detected and in the original code are compared to obtain a list of difference methods in the difference code according to the changes.

6. An incremental code detection device, characterized in that: include: A first acquisition unit, used for comparing the code to be detected with the original code, and acquiring a difference code between the code to be detected and the original code; The code to be detected is a code modified based on the original code; A second acquisition unit is used to acquire, according to the difference code, a difference method list in the difference code, wherein the difference method list has at least one difference method sub-code, and the difference method list is a set of methods that cause the code to be detected to change relative to the original code; A third acquisition unit is used to acquire, according to a preset calling rule, a calling code and a called code corresponding to each difference method subcode in the difference method list; The calling rule includes a calling naming rule; and obtaining the calling code and the called code corresponding to each difference method subcode in the difference method list according to the preset calling rule includes: Obtain method signatures corresponding to each of the difference method subcodes in the difference method list; Based on the calling naming rule and the method signature, determining the calling code and the called code corresponding to each of the difference method subcodes respectively in sequence; Wherein, based on the calling naming rule and the method signature, determining the calling code and the called code corresponding to each of the difference method subcodes respectively in sequence, includes: Based on the difference method subcodes, an initial incremental code call chain is established; Based on the calling naming rule and the method signature, determining in sequence whether each of the difference method subcodes is an entry for calling other codes; and determining in sequence whether it is an application class code name; wherein the calling naming rule defines an application class code name, and the application class code has an upper-level calling entry; In the case where it is determined that the difference method subcode is an entry for calling other codes, obtaining the called code corresponding to the difference method subcode, and adding the calling relationship between the difference method subcode and the called code to the incremental code calling chain; In the case where the method signature is the application class code name, obtaining a calling code corresponding to the difference method subcode, and adding a calling relationship between the calling code and the difference method subcode to the incremental code calling chain; The detection unit is used to detect the calling code, the called code and the difference code as incremental codes.

7. A computer-readable medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the incremental code detection method described in any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the incremental code detection method described in any one of claims 1 to 5 by executing the executable instructions.

Images