Code analysis method and device based on knowledge graph

Abstract

The present disclosure provides a code analysis method based on knowledge graph, which can be applied to the field of artificial intelligence technology. The method includes: determining the class information to be analyzed based on the full class code information and user configuration information; determining the inheritance and implementation relationship of each class and the single-level function call relationship based on the class information to be analyzed; supplementing the single-level function call relationship based on the inheritance and implementation relationship of the class to generate a single-level function call node; generating a code class call knowledge graph based on the single-level function call node; and analyzing the code based on the code class call knowledge graph. The present disclosure also provides a code analysis device, equipment, storage medium and program product based on knowledge graph.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, specifically to the field of static code analysis technology, and more specifically to a code analysis method, apparatus, device, medium and program product based on knowledge graph. Background Art

[0002] Static code analysis refers to analyzing the semantics and behavior of the code without actually executing the program, thereby finding abnormal program semantics or undefined behavior caused by incorrect coding in the program. Static analysis does not require waiting for all the code to be written, nor does it require building a running environment or writing test cases. It can find various problems in the code early in the software development process.

[0003] However, modern software systems are becoming larger and larger, with the number of lines of code growing from tens of thousands or hundreds of thousands to tens of millions, and the system complexity is also increasing. Especially with the emergence of object-oriented languages, the emergence of polymorphism, abstract classes and other scenarios has made function calls more and more complicated. How to quickly and accurately analyze function call flows is the core issue of code-level vulnerability mining and dangerous function call chain mining.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] In view of the above problems, the present disclosure provides a code analysis method, apparatus, device, medium and program product based on knowledge graph.

[0006] According to a first aspect of the present disclosure, a knowledge graph-based code analysis method is provided, comprising: determining class information to be analyzed according to full class code information and user configuration information;

[0007] Determine the inheritance and implementation relationship of each class and the single-level calling relationship of functions according to the class information to be analyzed;

[0008] Supplementing the single-level function call relationship according to the inheritance and implementation relationship of the class to generate a single-level function call node;

[0009] Generate a code class call knowledge graph according to the single-level function call node; and

[0010] The knowledge graph is called according to the code class to analyze the code.

[0011] According to an embodiment of the present disclosure, the inheritance and implementation relationship of the class includes the inheritance relationship of the class, the relationship between the interface class and the implementation class, and the relationship between the abstract class and the implementation class. The single-level function call relationship is supplemented according to the inheritance and implementation relationship of the class to determine the single-level function call node, including:

[0012] Determine the class function call relationship according to the inheritance relationship of the class, the relationship between the interface class and the implementation class, and the relationship between the abstract class and the implementation class;

[0013] Determine a supplemented function single-level calling relationship according to the class function calling relationship and the function single-level calling relationship;

[0014] The single-level function call node is determined according to the function name and the supplemented single-level function call relationship corresponding to the function name, and is stored in the graph database.

[0015] According to an embodiment of the present disclosure, generating a code class call knowledge graph according to the single-level function call node includes:

[0016] Get the single-level function call node in the graph database;

[0017] Determining an entity relationship table, an entity attribute table, and a schema table according to the single-level function call node; and

[0018] A code class call knowledge graph is generated according to the entity relationship table, entity attribute table and schema table.

[0019] According to an embodiment of the present disclosure, determining an entity relationship table and a schema table according to the single-level function call node includes:

[0020] Generate multiple entity-relationship-entity triplets of code class-call relationship-code class from the code class function and class call relationship fields, where the entity is the code class and the relationship is the call relationship; and

[0021] A schema table is constructed, wherein the schema table includes a code class name, an attribute name, an attribute type, and an association relationship.

[0022] According to an embodiment of the present disclosure, calling the knowledge graph to analyze the code according to the code class includes:

[0023] Search the code class call chain relationship through the depth-first traversal algorithm to generate all paths from any starting point; and

[0024] A program call chain of the target function is determined according to the target function name and the path.

[0025] According to an embodiment of the present disclosure, the calling of the knowledge graph to analyze the code according to the code class further includes:

[0026] Determine the in-and-out degree of the function based on the target function name and the knowledge graph; and

[0027] The function heat is determined according to the in-and-out degrees.

[0028] According to an embodiment of the present disclosure, the calling of the knowledge graph to analyze the code according to the code class further includes:

[0029] Calculate the call chain similarity of multiple software.

[0030] According to an embodiment of the present disclosure, the calculating of call chain similarities of multiple software includes:

[0031] Obtain code class call knowledge graphs of at least two software;

[0032] Generate at least two vector matrices based on the point-edge relationship of the connected graph of the knowledge graph called by the code class;

[0033] Calculating the similarity of the vector matrix using a deep learning algorithm; and

[0034] The similarity between the two software is determined according to the similarity of the vector matrices.

[0035] A second aspect of the present disclosure provides a knowledge graph-based code analysis device, including: a first determination module, configured to determine class information to be analyzed based on full class code information and user configuration information;

[0036] A second determination module is used to determine the inheritance and implementation relationship of each class and the single-level calling relationship of functions according to the class information to be analyzed;

[0037] A first generating module, used for supplementing the single-level function calling relationship according to the inheritance and implementation relationship of the class to generate a single-level function calling node;

[0038] A second generating module is used to generate a code class call knowledge graph according to the single-level function call node; and

[0039] The analysis module is used to analyze the code by calling the knowledge graph according to the code class.

[0040] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned knowledge graph-based code analysis method.

[0041] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned knowledge graph-based code analysis method.

[0042] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned knowledge graph-based code analysis method when executed by a processor.

[0043] Through the knowledge graph-based code analysis method provided by the embodiment of the present disclosure, a knowledge graph is constructed by analyzing the single-level calling relationship of functions in the class code. Based on the knowledge graph, the function call flow can be quickly and accurately analyzed in a graph path search manner, thereby assisting in completing code static analysis and dangerous call chain search. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0045] Figure 1 The application scenario diagram of the knowledge graph-based code analysis method, apparatus, device, medium, and program product according to an embodiment of the present disclosure is schematically shown;

[0046] Figure 2 A flowchart of a code analysis method based on a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0047] Figure 3 A flowchart of a method for determining a single-level function call point according to an embodiment of the present disclosure is schematically shown;

[0048] Figure 4 A schematic diagram of a single-level function call point according to an embodiment of the present disclosure is schematically shown;

[0049] Figure 5 A flowchart of a method for constructing a function-like knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0050] Figure 6 The flowchart of the code analysis method according to the embodiment of the present disclosure is schematically shown;

[0051] Figure 7 A schematic diagram shows a structural block diagram of a code analysis device based on a knowledge graph according to an embodiment of the present disclosure; and

[0052] Figure 8 A block diagram of an electronic device suitable for implementing a knowledge graph-based code analysis method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0053] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0054] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0055] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0056] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0057] An embodiment of the present disclosure provides a code analysis method based on a knowledge graph, including: determining the class information to be analyzed based on the full class code information and user configuration information; determining the inheritance and implementation relationship and the single-level function call relationship of each class based on the class information to be analyzed; supplementing the single-level function call relationship based on the inheritance and implementation relationship of the class to generate a single-level function call node; generating a code class call knowledge graph based on the single-level function call node; and analyzing the code based on the code class call knowledge graph.

[0058] Figure 1 The following schematically shows an application scenario diagram of a code analysis method, apparatus, device, medium, and program product based on a knowledge graph according to an embodiment of the present disclosure. It should be noted that: Figure 1The application scenarios shown are only examples of application scenarios that can be used in the embodiments of the present disclosure, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. It should be noted that the code analysis method and device based on the knowledge graph provided in the embodiments of the present disclosure can be used in the technical field of static code analysis and related aspects of the financial field, and can also be used in any field other than the financial field. The application field of the code analysis method and device based on the knowledge graph provided in the embodiments of the present disclosure is not limited.

[0059] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a code packet analysis and mining scenario. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0060] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0061] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0062] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as information or data generated according to user configuration information and request information, etc.) to the terminal device.

[0063] It should be noted that the knowledge graph-based code analysis method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the knowledge graph-based code analysis device provided in the embodiment of the present disclosure can generally be set in the server 105. The knowledge graph-based code analysis method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the knowledge graph-based code analysis device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0064] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0065] The following will be based on Figure 1 The scene described by Figure 2 to Figure 6 The knowledge graph-based code analysis method of the disclosed embodiment is described in detail.

[0066] Figure 2 The flowchart of the knowledge graph-based code analysis method according to an embodiment of the present disclosure is schematically shown.

[0067] like Figure 2 As shown, the knowledge graph-based code analysis method of this embodiment includes operations S210 to S250, and the method can be executed by a processor or other computing devices.

[0068] In operation S210, the class information to be analyzed is determined according to the full class code information and the user configuration information.

[0069] In one example, the code packages to be analyzed are first integrated according to the user configuration, including the integration of code packages, individual code classes, and basic class information of the operating environment, to confirm the class range to be analyzed.

[0070] In operation S220, the inheritance and implementation relationship and the single-level function calling relationship of each class are determined according to the class information to be analyzed.

[0071] In one example, each class file is scanned and analyzed in turn according to the class scope information to be analyzed determined in operation S210, and the inheritance relationship of each class and the single-level calling relationship of all functions contained in the class are extracted. After all classes are fully analyzed, due to the emergence of object-oriented languages, polymorphism, abstract classes and other scenarios, the function calling situation has become more complicated. In order to obtain a complete single-level function calling relationship, it is necessary to sort out the inheritance and implementation relationship of a single class, where the inheritance and implementation relationship of a class includes the inheritance relationship of the class, the relationship between the interface class and the implementation class, and the relationship between the abstract class and the implementation class.

[0072] In operation S230, the single-level function call relationship is supplemented according to the inheritance and implementation relationship of the class to generate a single-level function call node.

[0073] In an example, in order to obtain a complete single-level function call relationship, after determining the inheritance and implementation relationship of the class and the single-level call relationship of the function, it is necessary to traverse the single-level call relationship of each class according to the inheritance and implementation relationship of the class, supplement the single-level call relationship, generate a complete single-level function call node from the supplemented single-level call relationship, and save it in the form of a graph database. The specific process of supplementing the single-level call relationship can be seen in Figure 3 Method for determining single-level function call sites.

[0074] In operation S240, a code class call knowledge graph is generated according to the single-level function call nodes.

[0075] In one example, function information data, i.e., single-level function call nodes (including function names and single-level function call relationships), are obtained from the graph database. Code class functions and class call relationship fields are mapped to the triples of "entity-relationship-entity", the basic unit of the knowledge graph, where the entity is the code class. For example, the "entity-relationship-entity" of code class-call relationship-code class is generated, and a graph generation point-edge relationship table and schema table are constructed. The class call graph can be formed through the entity relationship table and schema table for subsequent display and analysis. The generation process of the code class call knowledge graph can be seen in Figure 5 Operations S241 to S243 in the process.

[0076] In operation S250, the knowledge graph is called according to the code class to analyze the code.

[0077] In one example, the code class call knowledge graph can be used for graph analysis to achieve rapid analysis of software code, such as using the depth-first traversal algorithm to explore the depth of the program call chain, the centrality algorithm to measure the call degree of a class or method, and the DeepWalk algorithm combined with the node2vec algorithm to measure the similarity of different software A, etc. It can be expanded to display the code class call knowledge graph, for example, the function call chain depth can be displayed, that is, by inputting the search value of the starting point v, the code class call chain with any v as the starting point can be retrieved for discrimination display, including possible reachable paths, path depth, path nodes and other information. The function heat can be displayed, that is, the input function starting point can calculate the centrality of the class and method through the knowledge graph, and the heat can be ranked by using the in-and-out degree of the entity stage. The stage with high in-and-out degree is a method with high heat or an inherited method.

[0078] Through the knowledge graph-based code analysis method provided by the embodiment of the present disclosure, a knowledge graph is constructed by analyzing the single-level calling relationship of functions in the class code. Based on the knowledge graph, the function call flow can be quickly and accurately analyzed in a graph path search manner, thereby assisting in completing code static analysis and dangerous call chain search.

[0079] Figure 3 The flowchart of the method for determining a single-level function call point according to an embodiment of the present disclosure is schematically shown. Figure 4 A schematic diagram of a single-level function call point according to an embodiment of the present disclosure is shown schematically. Figure 3 As shown, operation S230 includes operations S231 to S233.

[0080] In operation S231, the class function call relationship is determined according to the class inheritance relationship, the relationship between the interface class and the implementation class, and the relationship between the abstract class and the implementation class. In operation S232, the supplemented function single-level call relationship is determined according to the class function call relationship and the function single-level call relationship. In operation S233, the single-level function call node is determined according to the function name and the supplemented function single-level call relationship corresponding to the function name, and stored in the graph database.

[0081] In an example, it is necessary to traverse the single-level calling relationship of each class according to the inheritance and implementation relationship of the class to supplement the single-level calling relationship. For example, the Method1 method of Class A calls the method1 interface of the interface class interface I, and Class B and ClassC are both implementation classes of interface I, then the single-level calling relationship of Class A.method1->ClassI.method1 is expanded to Class A.method1->Class B.method1 and ClassA.method1->Class C.method1; for example, the method1 of Class A calls the method1 method of the abstract class abstract class M, and class D is the specific implementation class of class M, then class A.method1->abstractclass M.method1 will be updated to class A.method1->class D.method1; similarly, if the class function called by classA.method1 has a subclass overriding function, it is also expanded, and all subclass functions that overwrite the called function are included in the single-level calling relationship node. After the processing is completed, a complete single-level function call node is formed. Figure 4 As shown, there are three single-level calling relationship nodes. Class A Method1 has a calling relationship with Class B Method1, Class CMethod1, Class D Method1, and Class A Method2; Class B Method1 has a calling relationship with Class BMethod2; Class B Method2 has a calling relationship with Class B Method3 and Class C Method5. By aggregating these single-level calling relationship nodes, we can get multiple complete program call chains, for example, Class AMethod1->Class B Method1->Class B Method2->Class B Method3.

[0082] Figure 5 The flowchart of the method for constructing a function-like knowledge graph according to an embodiment of the present disclosure is schematically shown. As shown in the figure, operation S240 includes operations S241 to S243.

[0083] In operation S241, a single-level function call node in a graph database is obtained. In operation S242, an entity relationship table, an entity attribute table, and a schema table are determined according to the single-level function call node. In operation S243, a code class call knowledge graph is generated according to the entity relationship table, the entity attribute table, and the schema table.

[0084] According to an embodiment of the present disclosure, the code class function and class call relationship fields are generated into multiple entity-relationship-entity triplets of code class-call relationship-code class, where the entity is the code class and the relationship is the call relationship; a schema table is constructed, where the schema table includes the code class name, attribute name, attribute type and association relationship.

[0085] In one example, it is necessary to construct a graph generation point-edge relationship table and a schema table, as shown in Tables 1 to 3 below. As shown in Table 1, in the entity relationship table, the entity is the code class, which is the point of the knowledge graph, and the association relationship is the call relationship, which is the edge of the knowledge graph; the entity attribute table records the relationship between code classes, for example, Class B and Class A are inheritance relationships. Through the "entity-relationship-entity" table and the Schema table, the graph database can be input for output to generate a code class call knowledge graph. After the knowledge graph is generated, the code can be quickly and accurately analyzed based on the knowledge graph.

[0086] Table 1 "Entity-Relationship-Entity" table

[0087] Code Class Code Class Relationship Edge number Class A Method3 Class A Method l 0_flow Class A Method Class A Method2 1 1_flow Class A Method1 Class B Method 1 2_flow Class B Method1 Class B Method2 1 3_flow

[0088] Table 2 "Entity-Attribute-Attribute Value" table

[0089] Code Class Affiliation Relationship Value Class B inherit Class A Class C inherit Class B Class A accomplish interface I Class B accomplish interface I

[0090] Table 3 Schema table

[0091] type name illustrate Unidirectional Property Name Property Type entity Code Class Starting point code class Starting point code class String entity Code Class Purpose Code Class Purpose Code Class String relation Relationship Relationship TRUE Starting point code class String Purpose Code Class String Edge number String Relationship <![CDATA[ i nt]]>

[0092] Figure 6 The flowchart of the code analysis method according to the embodiment of the present disclosure is schematically shown. Figure 6 As shown, operation S250 includes operations S251 to S253. It should be noted that operations S251, S252 and S253 are only different analysis directions based on the knowledge graph, and the execution order is not specifically limited.

[0093] In operation S251 , a depth-first traversal algorithm is used to explore the depth of the program call chain.

[0094] According to the embodiment of the present disclosure, the code class call chain relationship is searched through the depth-first traversal algorithm to generate all paths of any starting point. The program call chain of the target function is determined according to the target function name and the path.

[0095] Operation S251 can be performed to obtain the program call chain. Specifically, taking the depth-first traversal algorithm as an example, the code class call chain relationship is searched through the depth-first traversal algorithm. It is assumed that the initial state of the given graph G is that all vertices have never been visited. Select any vertex v in G as the initial starting point (starting point code class), and the depth-first traversal can be defined as follows: first visit the starting point v and mark it as visited; then search each adjacent point w of v from v in turn. If w has not been visited, then continue the depth-first traversal with w as the new starting point until all vertices in the graph that have a path connection with the starting point code class v (also called vertices reachable from the source point) have been visited. If there are still unvisited vertices in the graph at this time, select another unvisited vertex as the new source point and repeat the above process until all vertices in the graph have been visited.

[0096] The specific traversal process is as follows: Let x be the currently visited vertex. After marking x as visited, select an undetected edge (x, y) from x. If vertex y has been visited, select another undetected edge from x. Otherwise, follow the edge (x, y) to reach y that has not been visited, visit y and mark it as visited. Then start searching from y until all paths from y are searched, that is, after all vertices reachable from y are visited, backtrack to vertex x and select another undetected edge from x. The above process is continued until all edges from x have been detected. At this point, if x is not the source, backtrack to the vertex that has been visited before x. Otherwise, all vertices in the graph that have paths connected to the source (that is, all vertices reachable from the source) have been visited. If graph G is a connected graph, the traversal process ends. Otherwise, continue to select a vertex that has not been visited as a new source and perform a new search process. After traversal by the algorithm, all paths of any starting point v can be generated, such as the call chain relationship of "Class A Method1-ClassB Method1-Class B Method2-ClassC Method5".

[0097] In operation S252 , the call chain similarities of the plurality of software are calculated.

[0098] According to an embodiment of the present disclosure, code class calling knowledge graphs of at least two software are obtained; at least two vector matrices are generated according to the point-edge relationship of the connected graph of the code class calling knowledge graph; the similarity of the vector matrices is calculated using a deep learning algorithm; and the similarity of the two software is determined according to the similarity of the vector matrices.

[0099] In one example, the similarity of different software can also be analyzed based on the knowledge graph. First, the code class call knowledge graph of at least two software is constructed according to the above knowledge graph construction method; using graph embedding methods such as deep walk and node2vec, the point-edge relationship of the connected graph of the knowledge graph is converted into a set of mathematical vectors, and the graph data is identified with a matrix. By converting different software into vectors, deep learning algorithms such as convolutional neural networks or clustering algorithms can be used to measure matrix similarity, thereby judging the similarity between software based on the similarity of vector matrices.

[0100] In operation S253, the heat of the target function is calculated.

[0101] According to an embodiment of the present disclosure, the in-degree of the function is determined based on the target function name and the knowledge graph; and the function heat is determined based on the in-degree.

[0102] In one example, the input function starting point can be used to calculate the centrality of the class and method through the knowledge graph, and the function heat can be ranked by using the in-and-out degree of the entity stage. The stage with high in-and-out degree is the method with high heat or inherited method. It is scalable and can display the depth of the function call chain, that is, by inputting the search value of the starting point function V, the code class call chain with any function V as the starting point can be retrieved for identification display, including possible reachable paths, path depth, path nodes and other information.

[0103] Based on the above-mentioned code analysis method based on knowledge graph, the present disclosure also provides a code analysis device based on knowledge graph. Figure 7 The device is described in detail.

[0104] Figure 7 The structural block diagram of a knowledge graph-based code analysis device according to an embodiment of the present disclosure is schematically shown.

[0105] like Figure 7 As shown, the knowledge graph-based code analysis device 700 of this embodiment includes a first determination module 710, a second determination module 720, a first generation module 730, a second generation module 740 and an analysis module 750.

[0106] The first determination module 710 is used to determine the class information to be analyzed according to the full class code information and the user configuration information. In one embodiment, the first determination module 710 can be used to perform the operation S210 described above, which will not be described in detail here.

[0107] The second determination module 720 is used to determine the inheritance and implementation relationship of each class and the single-level function call relationship according to the class information to be analyzed. In one embodiment, the second determination module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0108] The first generation module 730 is used to supplement the function single-level call relationship according to the inheritance and implementation relationship of the class to generate a single-level function call node. In one embodiment, the first generation module 730 can be used to perform the operation S230 described above, which will not be repeated here.

[0109] The second generation module 740 is used to generate a code class call knowledge graph according to the single-level function call node. In one embodiment, the second generation module 740 can be used to perform the operation S240 described above, which will not be repeated here.

[0110] The analysis module 750 is used to analyze the code according to calling the knowledge graph according to the code class. In one embodiment, the analysis module 750 can be used to perform the operation S250 described above, which will not be repeated here.

[0111] According to an embodiment of the present disclosure, any multiple modules of the first determination module 710, the second determination module 720, the first generation module 730, the second generation module 740 and the analysis module 750 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first determination module 710, the second determination module 720, the first generation module 730, the second generation module 740 and the analysis module 750 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the first determination module 710, the second determination module 720, the first generation module 730, the second generation module 740 and the analysis module 750 may be at least partially implemented as a computer program module, which may perform a corresponding function when executed.

[0112] Figure 8 A block diagram of an electronic device suitable for implementing a knowledge graph-based code analysis method according to an embodiment of the present disclosure is schematically shown.

[0113] like Figure 8 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0114] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0115] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0116] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0117] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0118] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the code analysis method based on the knowledge graph provided in the embodiment of the present disclosure.

[0119] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0120] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0121] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0122] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0123] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0124] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0125] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A code analysis method based on knowledge graph, characterized in that: include: Determine the class information to be analyzed based on the full class code information and user configuration information; Determine the inheritance and implementation relationship of each class and the single-level calling relationship of functions according to the class information to be analyzed; Determine the class function calling relationship according to the inheritance and implementation relationship of the class; Determine a supplemented function single-level calling relationship according to the class function calling relationship and the function single-level calling relationship; Determine a single-level function call node according to a function name and a supplemented single-level function call relationship corresponding to the function name; Determine an entity relationship table, an entity attribute table and a schema table according to the single-level function call node; Generate a code class calling knowledge graph according to the entity relationship table, entity attribute table and schema table; as well as The knowledge graph is called according to the code class to analyze the code.

2. The method according to claim 1, characterized in that Determining the entity relationship table and the schema table according to the single-level function call node includes: Generate multiple entity-relationship-entity triplets of code class-call relationship-code class from the code class function and class call relationship fields, where the entity is the code class and the relationship is the call relationship; and A schema table is constructed, wherein the schema table includes a code class name, an attribute name, an attribute type, and an association relationship.

3. The method according to claim 2, characterized in that The calling of the knowledge graph to analyze the code according to the code class includes: Search the code class call chain relationship through the depth-first traversal algorithm to generate all paths from any starting point; and A program call chain of the target function is determined according to the target function name and the path.

4. The method according to claim 2, characterized in that: The analyzing the code by calling the knowledge graph according to the code class also includes: Determine the in-and-out degree of the function based on the target function name and the knowledge graph; and The function heat is determined according to the in-and-out degrees.

5. The method according to claim 2, characterized in that: The analyzing the code by calling the knowledge graph according to the code class also includes: Calculate the call chain similarity of multiple software.

6. The method according to claim 5, characterized in that The calculating of the call chain similarity of the plurality of software includes: Obtain code class call knowledge graphs of at least two software; Generate at least two vector matrices based on the point-edge relationship of the connected graph of the knowledge graph called by the code class; Calculating the similarity of the vector matrix using a deep learning algorithm; and The similarity between the two software is determined according to the similarity of the vector matrices.

7. A code analysis device based on knowledge graph, characterized in that: include: A first determination module is used to determine the class information to be analyzed according to the full class code information and user configuration information; A second determination module is used to determine the inheritance and implementation relationship of each class and the single-level calling relationship of functions according to the class information to be analyzed; A first generating module, used for supplementing the single-level function calling relationship according to the inheritance and implementation relationship of the class to generate a single-level function calling node; A second generating module is used to generate a code class call knowledge graph according to the single-level function call node; as well as An analysis module is used to analyze the code by calling the knowledge graph according to the code class. The first generation module is further used to determine the class function call relationship according to the inheritance and implementation relationship of the class; determine the supplemented function single-level call relationship according to the class function call relationship and the function single-level call relationship; determine the single-level function call node according to the function name and the supplemented function single-level call relationship corresponding to the function name; The second generation module is also used to determine the entity relationship table, entity attribute table and schema table according to the single-level function call node; and generate a code class call knowledge graph according to the entity relationship table, entity attribute table and schema table.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images