Method and device for determining online risk of software application, and electronic equipment

Abstract

The application discloses a method and device for determining online risk of a software application and electronic equipment, and relates to the field of information security. The method comprises the following steps: obtaining source code of the software application and technical clauses of a first type, wherein the technical clauses of the first type are technical clauses that must be obeyed and implemented by developers during software development; scanning the source code according to the technical clauses of the first type to detect whether there is first abnormal code in the source code, wherein the first abnormal code is code that does not conform to the technical clauses of the first type; in the case that the first abnormal code exists in the source code, determining that the online risk of the software application is higher than a preset risk threshold, and prohibiting the software application from being online published. The application solves the technical problem of low code checking efficiency caused by the fact that the existing technology relies on manual experience to check the code of the application before online.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, in particular, to a method and device for determining the online risk of a software application and an electronic device. BACKGROUND

[0002] Before a software application is officially released online, code checking work needs to be performed to avoid the risk of information security or normal operation of the software application due to non-standard code writing.

[0003] However, in the prior art, code checking work is usually performed by a dedicated staff member according to manual experience to check the code before online release. This checking method not only consumes a large amount of human cost, resulting in a low code checking efficiency, but also is not reliable enough due to excessive reliance on manual experience. If there is human negligence, a software application with a high online risk may also be arranged for online release, thereby affecting the normal development of business.

[0004] At present, no effective solution has been proposed to solve the above problems. SUMMARY

[0005] The embodiments of the present application provide a method and device for determining the online risk of a software application and an electronic device to at least solve the technical problem of low code checking efficiency in the prior art due to the reliance on manual experience to check the code of an application before online release.

[0006] According to an aspect of the embodiments of the present application, a method for determining the online risk of a software application is provided, including: obtaining source code of the software application and a first type of technical clause, wherein the first type of technical clause is a technical clause that a developer must comply with during software development; scanning the source code according to the first type of technical clause to detect whether there is first abnormal code in the source code, wherein the first abnormal code is code that does not comply with the first type of technical clause; in the case where there is first abnormal code in the source code, determining that the online risk of the software application is higher than a preset risk threshold, and prohibiting the software application from being released online.

[0007] Further, the method for determining the online risk of a software application further includes: obtaining a software development file, wherein the software development file is used to record matters that need to be paid attention to by a developer during software development; analyzing the software development file based on a first model to obtain text information containing a first type of keyword in the software development file, and taking the text information containing the first type of keyword as the first type of technical clause, wherein the first model is a neural network model trained based on training text containing the first type of keyword.

[0008] Further, the method for determining the online risk of the software application further comprises: after obtaining the software development file, parsing the software development file based on a second model to obtain text information containing a second type of keyword in the software development file, and taking the text information containing the second type of keyword as a second type of technical clause, wherein the second type of technical clause is a technical clause that is recommended to be followed by the developer during the software development process, and the second model is a neural network model trained based on training text containing the second type of keyword.

[0009] Further, the method for determining the online risk of the software application further comprises: before parsing the software development file based on the first model, obtaining a plurality of first training texts, wherein each first training text contains at least one first type of keyword; setting a label corresponding to each first training text as a first label, wherein the first label represents that the text information with the first label is a first type of technical clause; and iteratively training a first neural network according to each first training text and the first label corresponding to each first training text to obtain the first model, wherein the first model is used to identify text information containing the first type of keyword in the input text and determine that the text information is a first type of technical clause.

[0010] Further, the method for determining the online risk of the software application further comprises: before parsing the software development file based on the second model, obtaining a plurality of second training texts, wherein each second training text contains at least one second type of keyword; setting a label corresponding to each second training text as a second label, wherein the second label represents that the text information with the second label is a second type of technical clause; and iteratively training a second neural network according to each second training text and the second label corresponding to each second training text to obtain the second model, wherein the second model is used to identify text information containing the second type of keyword in the input text and determine that the text information is a second type of technical clause.

[0011] Further, the method for determining the online risk of the software application further comprises: after the scanning of the source code according to the first type of technical terms and the detection of whether the first abnormal code exists in the source code, in the case that the first abnormal code does not exist in the source code, scanning the source code according to the second type of technical terms, and detecting whether the second abnormal code exists in the source code, wherein the second abnormal code is code that does not conform to the second type of technical terms; in the case that the second abnormal code exists in the source code, determining the online risk of the software application according to the number of the second abnormal code and the weight value of the target technical term corresponding to the second abnormal code, wherein the weight value of the target technical term is determined by at least one of the following: the ambiguity degree of the target technical term and the importance degree of the target technical term, wherein the target technical term is the second type of technical term corresponding to the second abnormal code.

[0012] Further, the determination process of the weight value of the target technical term comprises: determining the ambiguity degree of the target technical term based on a technical term ambiguity degree detection model, and determining the weight value of the target technical term according to the ambiguity degree of the target technical term, wherein the ambiguity degree is used to represent the degree of clarity of the technical operation specification involved in the target technical term, the ambiguity degree and the weight value are positively correlated, and the technical term ambiguity degree detection model is a model obtained by using technical terms with known ambiguity degree levels as training samples for model training.

[0013] Further, the determination process of the weight value of the target technical term comprises: determining the importance degree of the target technical term based on a technical term importance degree detection model, and determining the weight value of the target technical term according to the importance degree of the target technical term, wherein the importance degree is used to represent the importance of the technical operation specification involved in the target technical term for the normal operation of the software application, the importance degree and the weight value are positively correlated, and the technical term importance degree detection model is a model obtained by using technical terms with known importance degree levels as training samples for model training.

[0014] Further, the method for determining the online risk of the software application further comprises: in the case that the number of the second abnormal code is N, summing up the N weight values corresponding to the N second abnormal codes to obtain an online risk score corresponding to the software application, wherein N is a positive integer, each of the N second abnormal codes corresponds to one of the N weight values, the weight value corresponding to each second abnormal code is the weight value of the target technical term corresponding to the second abnormal code, and the online risk score is used to represent the online risk of the software application.

[0015] Further, the method for determining the online risk of the software application further includes: after summing the N weight values corresponding to the N second abnormal codes to obtain the online risk score corresponding to the software application, detecting whether the online risk score is greater than or equal to a preset score; in a case where the online risk score is greater than or equal to the preset score, prohibiting the software application from being online published; and in a case where the online risk score is less than the preset score, online publishing the software application.

[0016] Further, the method for determining the online risk of the software application further includes: after detecting whether the first abnormal code exists in the source code, generating a prompt information according to the first abnormal code and the first type of technical terms corresponding to the first abnormal code; and sending the prompt information to a target terminal, where the target terminal is a terminal corresponding to a target developer, and the target developer is a developer of the software application.

[0017] According to another aspect of the embodiments of the present application, a device for determining the online risk of a software application is also provided, which includes: an acquisition module configured to acquire source code of a software application and a first type of technical terms, where the first type of technical terms are technical terms that must be complied with by a developer during software development; a detection module configured to scan the source code according to the first type of technical terms, and detect whether a first abnormal code exists in the source code, where the first abnormal code is a code that does not comply with the first type of technical terms; and a determination module configured to, in a case where the first abnormal code exists in the source code, determine that the online risk of the software application is higher than a preset risk threshold, and prohibit the software application from being online published.

[0018] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which stores a computer program, where the computer program, when executed, controls a device in which the computer readable storage medium is located to perform the method for determining the online risk of the software application.

[0019] According to another aspect of the embodiments of the present application, an electronic device is also provided, which includes one or more processors and a memory, where the memory is configured to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method for determining the online risk of the software application.

[0020] In the present application, the first type of technical terms is used to detect whether the first abnormal code exists in the source code. First, the source code of the software application and the first type of technical terms are obtained, wherein the first type of technical terms is a technical term that must be complied with by the developer during software development. Then, the source code is scanned according to the first type of technical terms to detect whether the first abnormal code exists in the source code, wherein the first abnormal code is code that does not comply with the first type of technical terms. Finally, in the case that the first abnormal code exists in the source code, it is determined that the online risk of the software application is higher than the preset risk threshold, and the software application is prohibited from being online.

[0021] From the above, on the one hand, the present application no longer relies on manual experience to check the source code of the software application, but detects the source code by the first type of technical terms. If code that does not comply with the first type of technical terms is detected, the software application is prohibited from being online, thereby avoiding the problem of poor stability when relying on manual experience to check the source code of the software application before online, and thereby avoiding the situation that software with a large online risk due to human oversight is also arranged to be online. On the other hand, since the present application automatically scans the source code according to the first type of technical terms and detects whether the first abnormal code exists in the source code, it does not need to occupy too much human cost, thereby also improving the checking efficiency of the source code.

[0022] Therefore, the technical solution of the present application achieves the purpose of automatically checking the source code of the software application without relying on manual experience, thereby realizing the technical effects of improving the code checking efficiency and the code security, and thereby solving the technical problem of low code checking efficiency in the prior art due to relying on manual experience to check the code of the application before online. BRIEF DESCRIPTION OF DRAWINGS

[0023] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0024] Figure 1 is a flowchart of an optional method for determining the online risk of a software application according to an embodiment of the present application;

[0025] Figure 2 is a flowchart of an optional training process of a first model according to an embodiment of the present application;

[0026] Figure 3 is a flowchart of another optional method for determining the online risk of a software application according to an embodiment of the present application;

[0027] Figure 4 Fig. 1 is a schematic diagram of an optional software application online risk determination device according to an embodiment of the present application;

[0028] Figure 5 Fig. 2 is a schematic diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product, or device.

[0031] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request for obtaining the relevant information to the aforementioned user or institution, and after receiving the consent information fed back by the aforementioned user or institution, the relevant information is obtained.

[0032] The present application will be further described below in conjunction with the embodiments.

[0033] Embodiment 1

[0034] According to the embodiments of the present application, an embodiment of a method for determining the online risk of a software application is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0035] Figure 1 is a flowchart of an optional method for determining the online risk of a software application according to the embodiments of the present application, as shown in Figure 1 , the method comprises the following steps:

[0036] Step S101, obtaining the source code of the software application and the first type of technical terms.

[0037] In step S101, the first type of technical terms is the technical terms that the developer must comply with during the software development process.

[0038] Specifically, the above-mentioned software application is a software application to be online, wherein the source code corresponding to the software application needs to be code checked before the software application is formally online, for example, whether the syntax used in the compilation process of the source code conforms to the preset syntax rule, whether the length of each line of code in the source code conforms to the preset code length rule, whether the naming of the code function involved in the source code conforms to the preset naming rule, whether the code related to the query time parameter in the source code conforms to the configuration rule, and whether the code related to sensitive information (such as privacy data) is configured with an encryption rule.

[0039] It is easy to understand that if the source code corresponding to the software application is not code checked, the software application will likely face a great information security risk or a risk of not being able to run normally after being online, therefore, it is necessary to code check the source code corresponding to the software application. On this basis, how to check the source code is the key to the quality of the check, and unlike the prior art which mainly relies on manual experience for checking, the present application uses the first type of technical terms to check the source code, wherein the first type of technical terms is the technical terms that the developer must comply with during the software development process. For example, the first type of technical terms can be the above-mentioned preset code length rule, preset syntax rule, encryption rule corresponding to sensitive information, etc.

[0040] Step S102, scanning the source code according to the first type of technical terms to detect whether there is first abnormal code in the source code.

[0041] In step S102, the first abnormal code is code that does not conform to the first type of technical terms.

[0042] In an alternative embodiment, a code checking system can be used as an execution subject of the determination method of the online risk of the software application in the embodiments of the present application.

[0043] After obtaining the source code of the software application, the code checking system performs line-by-line scanning on the source code according to the technical terms of the first type, interprets the meaning of each line of code, and detects whether each line of code complies with the technical terms of the first type. If there are some codes in the source code that do not comply with the technical terms of the first type, the code checking system determines that these codes are the first abnormal codes.

[0044] For example, it is assumed that the technical terms of the first type are the preset code length rule and the encryption rule corresponding to the sensitive information. When the code checking tool scans the source code, it detects that the length of the i-th line of code in the source code does not comply with the preset code length rule, and the k-th line of code in the source code involves sensitive information but does not set the encryption rule. Then, the code checking tool determines that the i-th line of code and the k-th line of code are both the first abnormal codes.

[0045] In step S103, if the code checking tool detects that there are first abnormal codes in the source code of the software application, it means that the software application has a high online risk (i.e., the online risk of the software application is higher than the preset risk threshold). If the software application is online, the software application may not run normally or there may be information security risks. Therefore, in order to ensure the stability and security of the software application, the code checking tool will prohibit the software application from being online.

[0046] In step S103, if the code checking tool detects that there are first abnormal codes in the source code of the software application, it means that the software application has a high online risk (i.e., the online risk of the software application is higher than the preset risk threshold). If the software application is online, the software application may not run normally or there may be information security risks. Therefore, in order to ensure the stability and security of the software application, the code checking tool will prohibit the software application from being online.

[0047] Based on the above steps S101 to S103, in the present application, the method of detecting whether there are first abnormal codes in the source code according to the technical terms of the first type is adopted. First, the source code of the software application and the technical terms of the first type are obtained, wherein the technical terms of the first type are the technical terms that the developers must comply with during the software development process. Then, the source code is scanned according to the technical terms of the first type to detect whether there are first abnormal codes in the source code, wherein the first abnormal codes are the codes that do not comply with the technical terms of the first type. Finally, in the case where there are first abnormal codes in the source code, it is determined that the online risk of the software application is higher than the preset risk threshold, and the software application is prohibited from being online.

[0048] From the above, one aspect of the present application is no longer dependent on manual experience to check the source code of the software application, but detects the source code through the first type of technical terms, and if the code that does not meet the first type of technical terms is detected, the software application is prohibited from being online, thereby avoiding the problem of poor stability when relying on manual experience to check the source code of the software application before online, thereby avoiding the situation that software with a large online risk due to human oversight is also arranged to be online. On the other hand, since the present application automatically scans the source code according to the first type of technical terms, and detects whether the first abnormal code exists in the source code, it does not need to occupy too much human cost, thereby also improving the checking efficiency of the source code.

[0049] Therefore, the technical solution of the present application achieves the purpose of automatically checking the source code of the software application without relying on manual experience, thereby realizing the technical effect of improving the code checking efficiency and the code security, and further solving the technical problem of low code checking efficiency in the prior art due to relying on manual experience to check the code of the application before online.

[0050] In an optional embodiment, the code checking system first obtains a software development file, wherein the software development file is used to record matters that need to be paid attention to by the developer in the software development process. Then, the code checking system parses the software development file based on the first model to obtain text information containing the first type of keywords in the software development file, and takes the text information containing the first type of keywords as the first type of technical terms, wherein the first model is a neural network model trained based on training text containing the first type of keywords.

[0051] Optionally, the software development file can be understood as a software development standard file formulated by the enterprise, which is used to record various requirements and matters that need to be paid attention to by the developer in the development process. In order to extract the first type of technical terms from the software development file, the code checking system parses the software development file using the pre-trained first model, thereby extracting text information containing the first type of keywords in the software development file, and determining these text information containing the first type of keywords as the first type of technical terms.

[0052] Since the first type of technical terms is the technical terms that the developer must comply with in the software development process, the first type of keywords include but are not limited to the keywords such as "must", "must", "guarantee", "prohibit" and the like.

[0053] For example, a piece of text information recorded in the software development file is "the length of each line of code must be ensured within 60 bytes", since the two first-type keywords "must" and "ensure" are contained in the piece of text information, the code checking system can determine that the piece of text information is a first-type technical clause.

[0054] In an optional embodiment, after obtaining the software development file, the code checking system can further parse the software development file based on a second model to obtain text information containing a second-type keyword in the software development file, and take the text information containing the second-type keyword as a second-type technical clause, wherein the second-type technical clause is a technical clause that suggests a developer to comply with in the software development process, and the second model is a neural network model trained based on training text containing the second-type keyword.

[0055] Optionally, since the second-type technical clause is a technical clause that suggests a developer to comply with in the software development process, the second-type keyword includes but is not limited to keywords such as "suggest", "preferably", "optimal", etc.

[0056] For example, a piece of text information recorded in the software development file is "it is suggested that a variable appearing in each line of code be named according to a first rule", since the second-type keyword "suggest" is contained in the piece of text information, the code checking system can determine that the piece of text information is a second-type technical clause.

[0057] In an optional embodiment, Figure 2 A flowchart of a training process of an optional first model according to an embodiment of the present application is shown in FIG. 2. Figure 2 As shown in FIG. 2, the training process includes the following steps:

[0058] In step S201, a plurality of first training texts are obtained.

[0059] In step S201, each first training text contains at least one first-type keyword.

[0060] For example, various pieces of text information containing the keyword "forbid" can be taken as first training texts, various pieces of text information containing the keyword "must" can be taken as first training texts, and various pieces of text information containing keywords such as "must", "definitely", "ensure", "must" can be taken as first training texts.

[0061] In step S202, a label corresponding to each first training text is set as a first label.

[0062] In step S202, the first label represents that the text information with the first label is a first-type technical clause.

[0063] Optionally, for each first training text, a first label is set for the first training text, which is used to identify that the text information corresponding to the first training text is a first type of technical clause.

[0064] In step S203, the first neural network is iteratively trained according to each first training text and the first label corresponding to each first training text, and a first model is obtained.

[0065] In step S203, the first model is used to identify the text information containing the first type of keywords in the input text, and determine that the text information is the first type of technical clause.

[0066] Optionally, the first neural network is a deep learning neural network to be trained. The first training text and the first label corresponding to each first training text are input into the first neural network as a training set. The first neural network is iteratively trained until the output result of the first neural network can make the preset loss function in a convergent state, and then the current first neural network is determined as the first model.

[0067] Optionally, after obtaining the first model, only a piece of text (for example, a software development file) needs to be input into the first model. The first model can identify the text information containing the first type of keywords in the input text, and determine that the text information is the first type of technical clause.

[0068] It should be noted that the robustness of the first model is related to the number and quality of the first training texts. Therefore, when training the first model, a sufficient number of first training texts need to be prepared, and the quality of the first training texts needs to be ensured.

[0069] In an optional embodiment, before the software development file is parsed based on the second model, the code review system further obtains a plurality of second training texts, wherein each second training text contains at least one second type of keywords. Then, the code review system sets the label corresponding to each second training text as a second label, wherein the second label represents that the text information with the second label is a second type of technical clause. Finally, the code review system iteratively trains a second neural network according to each second training text and the second label corresponding to each second training text, and obtains a second model, wherein the second model is used to identify the text information containing the second type of keywords in the input text, and determine that the text information is the second type of technical clause.

[0070] Optionally, the training process of the second model is substantially the same as the training process of the first model, except that the training data used by the two models are different, the training data used for training the second model is the second training text, and the label corresponding to the second training text is the second label, wherein the second training text is text information containing at least one second type keyword. For example, various text information containing keywords such as "suggestion" / "preferred" / "optional" / "advice" / "propose" / "preferred" and the like can be used as the second training text.

[0071] The second model trained by a sufficient number of second training texts and the second label corresponding to each training text can identify text information containing a second type keyword in the input text and determine that the text information is a second type of technical clause.

[0072] It should be noted that the prior art relies on manual experience to check the source code of the software application, in other words, in the prior art, the quality of code checking mainly depends on the understanding and familiarity of the checking personnel with the software development file. Since the content of the software development file is very large, there is a high probability that the checking personnel will overlook some abnormal codes, resulting in that the software application may have a high information security risk or running risk when it is released online. In the present application, the first type of technical clause and the second type of technical clause are parsed from the software development file by using the neural network model, so that it is not necessary to understand and remember the software development file by manual means. Not only can the burden of the checking personnel be reduced, but also the technical clauses parsed can be used to check the code, so that the checking standard is reliable and stable, and the problem of missing abnormal codes can be avoided.

[0073] In an optional embodiment, in the case where the first abnormal code does not exist in the source code, the code checking system can also scan the source code according to the second type of technical clause to detect whether the second abnormal code exists in the source code, wherein the second abnormal code is code that does not conform to the second type of technical clause.

[0074] Optionally, in the case where the second abnormal code exists in the source code, the code checking system determines the online risk of the software application according to the number of the second abnormal code and the weight value of the target technical clause corresponding to the second abnormal code, wherein the weight value of the target technical clause is determined by at least one of the following: the ambiguity of the target technical clause and the importance of the target technical clause, wherein the target technical clause is the second type of technical clause corresponding to the second abnormal code.

[0075] Specifically, to obtain the fuzziness of the target technical clause, the code review system can determine the fuzziness of the target technical clause based on a clause fuzziness detection model, and determine the weight value of the target technical clause according to the model degree of the target technical clause, wherein the fuzziness is used to represent the degree of explicitness of the technical operation specification involved in the target technical clause, the fuzziness and the weight value are positively correlated, and the clause fuzziness detection model is a model obtained by using technical clauses with known fuzziness levels as training samples for model training.

[0076] For example, technical clause A and technical clause B are both technical clauses of the second type, wherein the content of technical clause A is "preferably, the number of variables appearing in each line of code is preferably limited to 5 or less"; the content of technical clause B is "optionally, the number of variables appearing in each line of code should not be too many". It is easy to understand that the explicitness of technical clause A is higher than that of technical clause B, therefore, in the present application, the fuzziness of technical clause A is also greater than that of technical clause B, and the weight value of technical clause A is greater than that of technical clause B.

[0077] In addition, the clause fuzziness detection model in the present application can also be a neural network model, and its corresponding training samples are technical clauses with known fuzziness levels, and the label corresponding to each training sample is the fuzziness level corresponding to the training sample. As a neural network model, the training process of the clause fuzziness detection model is basically the same as the training processes of the first model and the second model, and the present application will not be described in detail here.

[0078] In addition, the present application can also determine the weight value of the target technical clause according to the importance of the target technical clause. Specifically, the code review system can determine the importance of the target technical clause based on a clause importance detection model, and determine the weight value of the target technical clause according to the importance of the target technical clause, wherein the importance is used to represent the importance of the technical operation specification involved in the target technical clause for the normal operation of the software application, the importance and the weight value are positively correlated, and the clause importance detection model is a model obtained by using technical clauses with known importance levels as training samples for model training.

[0079] For example, technical clause C and technical clause D are both technical clauses of the second type, wherein the content of technical clause C is "preferably, for the code used to transmit user health information, it is best to use encryption rules for encryption, otherwise there is a risk of information leakage"; the content of technical clause D is "optionally, for noun numbering, it is recommended to number in order to avoid duplicate numbering". It is easy to understand that the importance of technical clause C is higher than that of technical clause D, so in this application, the weight value of technical clause C is greater than that of technical clause D.

[0080] In addition, the clause importance detection model in this application can also be a neural network model, and its corresponding training samples are technical clauses with known importance levels, and the label corresponding to each training sample is the importance level corresponding to the training sample. The training process of the clause importance detection model is also roughly the same as the training process of the first model and the training process of the second model, and this application will not be described in detail here.

[0081] In an optional embodiment, in the case where the number of second abnormal codes is N, the code checking system sums the N weight values corresponding to the N second abnormal codes to obtain an online risk score corresponding to the software application, wherein N is a positive integer, each of the N second abnormal codes corresponds to a weight value in the N weight values, and the weight value corresponding to each second abnormal code is the weight value of the target technical clause corresponding to the second abnormal code. The online risk score is used to represent the online risk of the software application.

[0082] Optionally, assuming that N is 3, i.e., the code checking system determines 3 second abnormal codes after scanning the source code, and assuming that the 3 second abnormal codes are code 1, code 2 and code 3, wherein the weight value corresponding to code 1 is 10, the weight value corresponding to code 2 is 20, and the weight value corresponding to code 3 is 15. By summing the 3 weight values, the online risk score corresponding to the software application is 45.

[0083] It should be noted that the second abnormal code is a code that does not meet the technical clause of the second type, therefore, the higher the online risk score corresponding to the software application, the more the number of codes in the source code of the software application that do not meet the technical clause of the second type, or the higher the potential risk of the code, and therefore, the higher the online risk of the software application.

[0084] In an optional embodiment, after the N weight values corresponding to the N second abnormal codes are summed to obtain the online risk score of the software application, the code checking system can detect whether the online risk score is greater than or equal to a preset score. In the case where the online risk score is greater than or equal to the preset score, the code checking system prohibits the software application from being online published; in the case where the online risk score is less than the preset score, the code checking system online publishes the software application.

[0085] Optionally, if the online risk score of the software application is greater than or equal to the preset score, the code checking system determines that the software application has a relatively large online risk, and in order to avoid the online risk, the code checking system prohibits the software application from being online published. Correspondingly, if the online risk score of the software application is less than the preset score, the code checking system determines that the online risk of the software application is relatively low, and thus the software application can be online published.

[0086] It should be noted that the preset score can be set by the user.

[0087] In an optional embodiment, after detecting whether the first abnormal code exists in the source code, the code checking system can generate prompt information according to the first abnormal code and the first type of technical terms corresponding to the first abnormal code, and send the prompt information to a target terminal, wherein the target terminal is a terminal corresponding to a target developer, and the target developer is a developer of the software application.

[0088] It is easy to understand that, in order to improve the code repair efficiency, the code checking system can remind the target developer to repair the first abnormal code by taking the first abnormal code and the first type of technical terms corresponding to the first abnormal code as the prompt information.

[0089] In addition, if the code checking system checks that the second abnormal code exists in the source code, it means that there is still room for optimization of the source code, and therefore, the code checking system can also generate prompt information according to the second abnormal code and the second type of technical terms corresponding to the second abnormal code, and send the prompt information to the target terminal, so as to optimize the second abnormal code by the target developer.

[0090] Figure 3 A flowchart of another optional method for determining the online risk of a software application according to an embodiment of the present application is shown in FIG. 6. As shown in FIG. 6, the method comprises the following steps. Figure 3As shown, first, the software development file is imported into the code checking system, and then the code checking system parses the software development file to obtain the technical clauses of the first type and the technical clauses of the second type. The code checking system checks the source code of the software application according to the technical clauses of the first type and the technical clauses of the second type to obtain a problem list. Among them, the problem list records the first abnormal code and the second abnormal code checked out. Finally, the code checking system generates prompt information according to the problem list, and sends the prompt information to the target developer responsible for developing the software application.

[0091] From the above, on the one hand, the present application no longer relies on manual experience to check the source code of the software application, but detects the source code through the technical clauses of the first type. If the code that does not conform to the technical clauses of the first type is detected, the software application is prohibited from being online published, thereby avoiding the problem of poor stability when relying on manual experience to check the source code of the software application before online. Further, the situation that the software with a large online risk due to human negligence is also arranged to be online published is avoided. On the other hand, since the present application automatically scans the source code according to the technical clauses of the first type and detects whether the first abnormal code exists in the source code, it does not need to occupy too much human cost, thereby also improving the checking efficiency of the source code.

[0092] Embodiment 2

[0093] According to the embodiments of the present application, an embodiment of a software application online risk determination device is provided, wherein, Figure 4 According to an optional software application online risk determination device according to the embodiments of the present application, as shown in the figure, Figure 4 The device comprises:

[0094] The acquisition module 401 is configured to acquire the source code of the software application and the technical clauses of the first type, wherein the technical clauses of the first type are technical clauses that must be complied with by the developer during the software development process;

[0095] The detection module 402 is configured to scan the source code according to the technical clauses of the first type, and detect whether the first abnormal code exists in the source code, wherein the first abnormal code is code that does not conform to the technical clauses of the first type;

[0096] The determination module 403 is configured to determine that the online risk of the software application is higher than the preset risk threshold in the case that the first abnormal code exists in the source code, and prohibit the software application from being online published.

[0097] It should be noted that the above acquisition module 401, detection module 402 and determination module 403 correspond to steps S101-S103 in the above embodiment 1, and the three modules have the same examples and application scenarios as the corresponding steps, but are not limited to the disclosure of the above embodiment 1.

[0098] Optionally, the acquisition module further includes a first acquisition unit and a first analysis unit. The first acquisition unit is configured to acquire a software development file, where the software development file is used to record matters that need to be paid attention to by a developer during software development. The first analysis unit is configured to analyze the software development file based on a first model to obtain text information containing a first type of keyword in the software development file, and take the text information containing the first type of keyword as a first type of technical provision. The first model is a neural network model trained based on training text containing the first type of keyword.

[0099] Optionally, the determination apparatus of the online risk of the software application further includes an analysis module configured to analyze the software development file based on a second model to obtain text information containing a second type of keyword in the software development file, and take the text information containing the second type of keyword as a second type of technical provision. The second type of technical provision is a technical provision that is recommended to be followed by the developer during software development. The second model is a neural network model trained based on training text containing the second type of keyword.

[0100] Optionally, the determination apparatus of the online risk of the software application further includes a first acquisition module, a setting module and a training module. The first acquisition module is configured to acquire a plurality of first training texts, where each first training text contains at least one first type of keyword. The setting module is configured to set a label corresponding to each first training text as a first label, where the first label represents that the text information with the first label is a first type of technical provision. The training module is configured to iteratively train a first neural network according to each first training text and the first label corresponding to each first training text to obtain a first model. The first model is used to identify text information containing a first type of keyword in input text and determine that the text information is a first type of technical provision.

[0101] Optionally, the software application online risk determination apparatus further comprises a second acquisition module, a first setting module and a first training module. The second acquisition module is configured to acquire a plurality of second training texts, wherein each second training text contains at least one second type keyword. The first setting module is configured to set a label corresponding to each second training text as a second label, wherein the second label represents that the text information with the second label is a technical clause of the second type. The first training module is configured to iteratively train the second neural network according to each second training text and the second label corresponding to each second training text to obtain a second model, wherein the second model is used to identify text information containing a second type keyword in an input text and determine that the text information is a technical clause of the second type.

[0102] Optionally, the software application online risk determination apparatus further comprises a first detection module and a first determination module. The first detection module is configured to, in a case where the source code does not contain the first abnormal code, scan the source code according to the technical clause of the second type to detect whether the source code contains second abnormal code, wherein the second abnormal code is code that does not conform to the technical clause of the second type. The first determination module is configured to, in a case where the source code contains the second abnormal code, determine the online risk of the software application according to the number of the second abnormal code and the weight value of a target technical clause corresponding to the second abnormal code, wherein the weight value of the target technical clause is determined by at least one of the following: the ambiguity degree of the target technical clause and the importance degree of the target technical clause, and the target technical clause is a technical clause of the second type corresponding to the second abnormal code.

[0103] Optionally, the software application online risk determination apparatus further comprises a first weight value determination module configured to determine the ambiguity degree of the target technical clause based on the clause ambiguity degree detection model, and determine the weight value of the target technical clause according to the ambiguity degree of the target technical clause, wherein the ambiguity degree is used to represent the degree of explicitness of the technical operation specification involved in the target technical clause, the ambiguity degree and the weight value are in a positive correlation relationship, and the clause ambiguity degree detection model is a model obtained by using technical clauses with known ambiguity degree levels as training samples for model training.

[0104] Optionally, the software application online risk determination apparatus further comprises a second weight value determination module configured to determine the importance of the target technical clause based on a clause importance detection model, and determine the weight value of the target technical clause according to the importance of the target technical clause, wherein the importance is used to represent the importance of the technical operation specification involved in the target technical clause for the normal operation of the software application, the importance and the weight value are in a positive correlation, and the clause importance detection model is a model obtained by using technical clauses with known importance levels as training samples for model training.

[0105] Optionally, the first determination module further comprises a risk score determination unit configured to, in a case where the number of the second abnormal codes is N, sum the N weight values corresponding to the N second abnormal codes to obtain an online risk score corresponding to the software application, wherein N is a positive integer, each of the N second abnormal codes corresponds to one of the N weight values, the weight value corresponding to each second abnormal code is the weight value of the target technical clause corresponding to the second abnormal code, and the online risk score is used to represent the online risk of the software application.

[0106] Optionally, the software application online risk determination apparatus further comprises a second detection module, a release prohibition module and a release module. The second detection module is configured to detect whether the online risk score is greater than or equal to a preset score. The release prohibition module is configured to prohibit the software application from being released online in a case where the online risk score is greater than or equal to the preset score. The release module is configured to release the software application online in a case where the online risk score is less than the preset score.

[0107] Optionally, the software application online risk determination apparatus further comprises an information generation module and an information sending module. The information generation module is configured to generate a prompt information according to the first abnormal code and the first type of technical clause corresponding to the first abnormal code. The information sending module is configured to send the prompt information to a target terminal, wherein the target terminal is a terminal corresponding to a target developer, and the target developer is a developer of the software application.

[0108] Embodiment 3

[0109] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. The computer program is set to execute the software application online risk determination method when running.

[0110] Embodiment 4

[0111] According to another aspect of the embodiments of the present application, an electronic device is also provided, and the electronic device comprises the software application online risk determination apparatus. Figure 5is a schematic diagram of an optional electronic device according to an embodiment of the present application, as shown in Figure 5 The electronic device includes one or more processors; a memory for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program for running, wherein the program is arranged to run to perform the above-mentioned method for determining the online risk of the software application.

[0112] The above-mentioned sequence numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0113] In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0114] In the several embodiments provided by the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the unit embodiment described above is only schematic. For example, the division of the unit can be a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling or direct coupling or communication connection between the units can be indirect coupling or communication connection through some interface, or electrical or other forms.

[0115] The unit described as a separate component can or can not be physically separate, and the component shown as a unit can or can not be a physical unit, that is, it can be located in one place, or it can be distributed on multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0116] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0117] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0118] The above is only the preferred embodiment of the present application, and it should be pointed out that the ordinary developer in the technical field can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method for determining the launch risk of a software application, characterized in that, The method comprises the following steps: obtaining source code of a software application and technical terms of a first type, wherein the technical terms of the first type are technical terms that must be complied with by a developer during a software development process; scanning the source code according to the technical terms of the first type to detect whether there is first abnormal code in the source code, wherein the first abnormal code is code that does not comply with the technical terms of the first type; in the case where the first abnormal code exists in the source code, determining that the online risk of the software application is higher than a preset risk threshold, and prohibiting the software application from being online published; wherein the technical terms of the first type are obtained by: obtaining a software development file, wherein the software development file is used to record matters that need to be paid attention to by the developer during the software development process; parsing the software development file based on a first model to obtain text information containing first type keywords in the software development file, and taking the text information containing the first type keywords as the technical terms of the first type, wherein the first model is a neural network model trained based on training text containing the first type keywords; after obtaining the software development file, the method further comprises: parsing the software development file based on a second model to obtain text information containing second type keywords in the software development file, and taking the text information containing the second type keywords as technical terms of a second type, wherein the technical terms of the second type are technical terms that are recommended to be complied with by the developer during the software development process, and the second model is a neural network model trained based on training text containing the second type keywords; after scanning the source code according to the technical terms of the first type to detect whether there is first abnormal code in the source code, the method further comprises: in the case where the first abnormal code does not exist in the source code, scanning the source code according to the technical terms of the second type to detect whether there is second abnormal code in the source code, wherein the second abnormal code is code that does not comply with the technical terms of the second type; in the case where the second abnormal code exists in the source code, determining the online risk of the software application according to the number of the second abnormal code and the weight value of a target technical term corresponding to the second abnormal code, wherein the weight value of the target technical term is determined by at least one of the following: the fuzziness of the target technical term and the importance of the target technical term, wherein the target technical term is a technical term of the second type corresponding to the second abnormal code.

2. The method of claim 1, wherein, before parsing the software development file based on the first model, the method further comprises: obtaining a plurality of first training texts, wherein each first training text contains at least one first type keyword; The label corresponding to each first training text is set as a first label, where the first label represents that the text information with the first label is a technical clause of the first type; The first neural network is iteratively trained according to each first training text and the first label corresponding to each first training text, to obtain the first model, where the first model is used to identify text information containing the first type of keyword in an input text and determine that the text information is a technical clause of the first type.

3. The method of claim 1, wherein, Before the software development file is parsed based on the second model, the method further comprises: Obtaining a plurality of second training texts, wherein each second training text contains at least one second type keyword; The label corresponding to each second training text is set as a second label, where the second label represents that the text information with the second label is a technical clause of the second type; The second neural network is iteratively trained according to each second training text and the second label corresponding to each second training text, to obtain the second model, where the second model is used to identify text information containing the second type of keyword in an input text and determine that the text information is a technical clause of the second type.

4. The method of claim 1, wherein, The determination process of the weight value of the target technical clause comprises: The ambiguity degree of the target technical clause is determined based on a clause ambiguity degree detection model, and the weight value of the target technical clause is determined according to the ambiguity degree of the target technical clause, where the ambiguity degree represents the degree of explicitness of the technical operation specification involved in the target technical clause, the ambiguity degree and the weight value are positively correlated, and the clause ambiguity degree detection model is a model obtained by using technical clauses with known ambiguity degree levels as training samples for model training.

5. The method of claim 1, wherein, The determination process of the weight value of the target technical clause comprises: The importance degree of the target technical clause is determined based on a clause importance degree detection model, and the weight value of the target technical clause is determined according to the importance degree of the target technical clause, where the importance degree represents the importance of the technical operation specification involved in the target technical clause for the normal operation of the software application, the importance degree and the weight value are positively correlated, and the clause importance degree detection model is a model obtained by using technical clauses with known importance degree levels as training samples for model training.

6. The method of claim 1, wherein, The online risk of the software application is determined according to the number of second abnormal codes and the weight value of the target technical clause corresponding to the second abnormal code, comprising: In a case where the number of the second abnormal codes is N, N weight values corresponding to the N second abnormal codes are summed to obtain an online risk score of the software application, where N is a positive integer, each of the N second abnormal codes corresponds to one of the N weight values, the weight value corresponding to each second abnormal code is a weight value of a target technical clause corresponding to the second abnormal code, and the online risk score is used to represent an online risk of the software application.

7. The method of claim 6, wherein, After the N weight values corresponding to the N second abnormal codes are summed to obtain the online risk score of the software application, the method further includes: detecting whether the online risk score is greater than or equal to a preset score; in a case where the online risk score is greater than or equal to the preset score, prohibiting the software application from being online published; in a case where the online risk score is less than the preset score, online publishing the software application.

8. The method of claim 1, wherein, After detecting whether the first abnormal code exists in the source code, the method further includes: generating prompt information according to the first abnormal code and a first type of technical clause corresponding to the first abnormal code; sending the prompt information to a target terminal, where the target terminal is a terminal corresponding to a target developer, and the target developer is a developer of the software application.

9. A device for determining the launch risk of a software application, characterized in that, comprise: an acquisition module configured to acquire a source code of a software application and a first type of technical clause, where the first type of technical clause is a technical clause that must be complied with by a developer during software development; a detection module configured to scan the source code according to the first type of technical clause to detect whether a first abnormal code exists in the source code, where the first abnormal code is a code that does not comply with the first type of technical clause; a determination module configured to, in a case where the first abnormal code exists in the source code, determine that an online risk of the software application is higher than a preset risk threshold, and prohibit the software application from being online published; wherein the acquisition module further comprises: a first acquisition unit configured to acquire a software development file, where the software development file is used to record matters that need to be paid attention to by the developer during software development; and a first analysis unit configured to analyze the software development file based on a first model to obtain text information containing a first type of keyword in the software development file, and take the text information containing the first type of keyword as the first type of technical clause, where the first model is a neural network model trained based on training text containing the first type of keyword. The apparatus further includes an analysis module configured to analyze the software development file based on a second model to obtain text information containing a second type of keyword in the software development file, and to take the text information containing the second type of keyword as a second type of technical clause, wherein the second type of technical clause is a technical clause that is suggested to be followed by a developer during software development, and the second model is a neural network model trained based on training text containing the second type of keyword. The apparatus further includes a first detection module configured to, in a case where the first abnormal code does not exist in the source code, scan the source code according to the second type of technical clause to detect whether second abnormal code exists in the source code, wherein the second abnormal code is code that does not conform to the second type of technical clause; and a first determination module configured to, in a case where the second abnormal code exists in the source code, determine the online risk of the software application according to a number of the second abnormal code and a weight value of a target technical clause corresponding to the second abnormal code, wherein the weight value of the target technical clause is determined by at least one of a fuzziness degree of the target technical clause and an importance degree of the target technical clause, and the target technical clause is a second type of technical clause corresponding to the second abnormal code.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium has stored therein a computer program, wherein the computer program, when executed, controls a device in which the computer readable storage medium is located to perform the method for determining the online risk of the software application according to any one of claims 1 to 8.

11. An electronic device, comprising: An apparatus includes one or more processors and memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method for determining the online risk of the software application according to any one of claims 1 to 8.

Images