A code defect detection and repair method and device based on large model

Abstract

The present invention discloses a code defect detection and repair method and device based on a large model, including a large model embedding strategy, a vector fusion strategy and a multi-task training mechanism, so as to simultaneously utilize the global control flow information, data flow information and the correlation of multiple code tasks of a code snippet, and improve the efficiency of the large model in code defect detection and repair tasks. On the one hand, a graph neural network is used to perform vector fusion between basic blocks, automatically capture the data association and control association between different basic blocks of the code snippet, and output a vector representation of the basic block containing global information; on the other hand, the multi-task training mechanism, by sharing large model parameters and graph neural network parameters, enables different tasks to share the learned code knowledge, and promote each other's performance on specific code tasks.

Description

Technical Field

[0001] The present invention belongs to the technical field of code defect detection and repair based on a large model, and in particular, relates to a code defect detection and repair method and device based on a large model. Background Art

[0002] At present, with the development of the software technology industry, software has become the brain center of various industries, and the security issues of software have become increasingly prominent. High-precision and high-recall code defect detection technology has become an extremely important industry technology; and with the development of big model technology in recent years, big models have shown great potential in the code field; therefore, it has become an urgent need for the industry to implement a high-precision and high-recall code defect detection system based on big models, and use the code generation capabilities of big models to automatically repair code defects.

[0003] Most of the existing code defect detection systems are based on program analysis technology and deep learning technology. On the one hand, the defect detection technology based on code analysis is widely used in the industry. This method relies on a certain defect pattern defined by humans for code defect detection, which has good interpretability and accuracy, but it also relies heavily on expert knowledge and experience. The matching and verification of some defect patterns may involve some difficult NP-Hard problems. As the analysis path and analysis scope increase, the consumption of computing resources will also increase exponentially. On the other hand, the method based on deep learning can mine code defect patterns based on historical training data, which can be used for large-scale software defect detection, with less computing resource overhead, but it has the following problems: First, some existing studies only train models or write detection rules for a certain type of specific defect pattern, while others simply regard the code defect detection task as a binary classification task, that is, whether the code fragment under inspection contains defects, so it is impossible to build a general code defect detection system. Secondly, these methods often face the trade-off between high false negative rate and high false positive rate, and cannot achieve good levels in both key indicators. Finally, these methods cannot automatically repair defects. In fact, due to the complexity of modern software systems, repairing software defects is also an extremely tedious task. We should use the correlation between defect repair and detection tasks to improve the level of the model in software defect repair tasks. Summary of the invention

[0004] In view of the deficiencies in the prior art, the purpose of the embodiments of the present application is to provide a code defect detection and repair method and device based on a large model to improve the efficiency and quality of code review.

[0005] According to a first aspect of an embodiment of the present application, a code defect detection and repair method based on a large model is provided, comprising:

[0006] Obtain a project code directory of a software project, and construct a dependency graph between various code files in the software project according to the project code directory;

[0007] According to the dependency graph, each code file is scanned in a topological order, and the function definitions in the files are used as basic code fragments to generate a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends;

[0008] Traversing each basic block based on the control flow graph, if there is a function call statement in the basic block, merging the control flow graph of the called function into the control flow graph of the calling function;

[0009] According to the control flow graph, using a large language model, an embedding representation of a statement sequence of a basic block is obtained;

[0010] According to the control flow graph and the embedded representation of the basic block, a graph neural network is used to fuse information between the basic blocks to obtain a vector representation of the basic block containing global information of the code snippet to be detected;

[0011] Using the vector representation of basic blocks and control flow graphs containing global information, the summary generation model, defect classification model, and defect repair model are trained;

[0012] Obtain a software project to be processed, use the trained summary generation model to replace functions in the software project to be processed whose length exceeds a predetermined threshold with corresponding summaries, use the trained defect classification model and defect repair model to perform defect detection and classification, and perform defect repair.

[0013] Furthermore, the project code directory indicates each code package and each code file under the code package in a complete software project, and the dependency graph includes nodes representing code files and directed edges representing file reference relationships.

[0014] Furthermore, the control flow graph includes nodes representing basic blocks and directed edges representing jump relationships between basic blocks. The control flow graph is denoted as ,in, A collection of nodes representing basic blocks; Indicates whether there is a jump relationship between basic block nodes. Represents basic blocks and basic blocks There is a feasible execution path between ; , representing a basic block Contains a series of program statements that are executed sequentially , Represents basic blocks Contains Class software defects, Represents basic blocks Contains no defects.

[0015] Further, traversing each basic block based on the control flow graph, if there is a function call statement in the basic block, merging the control flow graph of the called function into the control flow graph of the calling function, including:

[0016] Traversing each basic block based on the control flow graph, if a function call statement exists in the basic block, splitting the basic block and treating the function call statement as a separate basic block;

[0017] If the function definition corresponding to the function call statement is in the same file as the function that calls it, the control flow graph of the called function is merged into the control flow graph of the calling function; otherwise, a summary of the function is generated using a summary generation model, and the summary is annotated onto the function call statement, wherein the summary describes the meaning of the function's parameters, return value, and function function.

[0018] Furthermore, according to the control flow graph, an embedding representation of a statement sequence of a basic block is obtained using a large language model, including:

[0019] Use a tokenizer to tokenize the statement sequence of the basic block to obtain a word sequence, and add the word '[CLS]' before the word sequence to identify the global semantic information of the word sequence, and add the word '[SEP]' at the boundary between different statements to separate different statements;

[0020] Using a large Transformer-based language model, the word sequence corresponding to the sentence sequence in the basic block is taken as input to obtain the embedded representation of the sentence sequence.

[0021] Furthermore, according to the control flow graph and the embedded representation of the basic block, the graph neural network is used to perform information fusion between the basic blocks to obtain a vector representation of the basic block containing the global information of the code snippet to be detected, specifically:

[0022] The graph neural network is used to aggregate the vector representations of the adjacent nodes of each basic block node in the control flow graph to obtain the vector representation of the basic block node containing global information. The aggregation process is expressed as: , represents the activation function selected by the l-th layer of the graph neural network, represents the input of the lth layer network, represents the parameters of the lth layer network, E represents the adjacency matrix of the control flow graph, , , is a diagonal matrix, .

[0023] Furthermore, the vector representation and control flow graph of the basic block containing global information are used to train the defect repair model, defect classification model and summary generation model, including:

[0024] The vector representation of each node on the control flow graph is averaged to obtain a graph-level vector representation, the graph-level vector is used as the input of the summary generation model, the code summary of the function fragment is decoded and generated, and the annotated function summary is used as the target output to perform the training task of the summary generation model;

[0025] Taking the vector representation of the basic block containing global information as the input of the defect classification model, outputting the probability that it belongs to a certain type of defect, taking the defect category contained in the basic block as the target output, and performing the training task of the defect classification model;

[0026] Perform mask operations on basic blocks containing defects, use a defect repair model including a multi-layer Transformer Decoder to perform decoding and generation, use the code sequence after the defects are repaired as the target output, and perform the training task of the defect repair model;

[0027] Among them, the weighted sum of the losses of the three training tasks is used to train the large language model and graph neural network, and the loss of each training task is used to train the corresponding model.

[0028] According to a second aspect of an embodiment of the present application, a code defect detection and repair device based on a large model is provided, comprising:

[0029] A dependency graph building module is used to obtain a project code directory of a software project and build a dependency graph between various code files in the software project according to the project code directory;

[0030] A control flow graph generation module is used to scan each code file in a topological order according to the dependency graph, and use the function definitions in the files as basic code fragments to generate a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends;

[0031] A control flow graph merging module is used to traverse each basic block based on the control flow graph, and if there is a function call statement in the basic block, merge the control flow graph of the called function into the control flow graph of the calling function;

[0032] A basic block statement embedding module, used to obtain an embedding representation of a basic block statement sequence using a large language model according to the control flow graph;

[0033] An information fusion module, used to use a graph neural network to perform information fusion between basic blocks according to the control flow graph and the embedded representation of the basic block, so as to obtain a vector representation of the basic block containing the global information of the code fragment to be detected;

[0034] A model training module, used to train summary generation models, defect classification models, and defect repair models using vector representations of basic blocks containing global information and control flow graphs;

[0035] The defect classification and repair module is used to obtain the software project to be processed, use the trained summary generation model to replace the functions in the software project to be processed whose length exceeds a predetermined threshold with the corresponding summary, use the trained defect classification model and defect repair model to perform defect detection and classification, and perform defect repair.

[0036] According to a third aspect of an embodiment of the present application, there is provided an electronic device, including:

[0037] one or more processors;

[0038] A memory for storing one or more programs;

[0039] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect.

[0040] According to a third aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0041] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0042] It can be seen from the above embodiments that the present application designs a code defect detection and repair method based on a large model, which includes a large model embedding strategy, a vector fusion strategy and a multi-task training mechanism, so as to simultaneously utilize the global control flow information, data flow information and the correlation of multiple code tasks of the code snippet, and improve the efficiency of the large model in code defect detection and repair tasks. On the one hand, the graph neural network is used to perform vector fusion between basic blocks, automatically capture the data association and control association between different basic blocks of the code snippet, and output a vector representation of the basic block containing global information; on the other hand, the multi-task training mechanism, by sharing large model parameters and graph neural network parameters, realizes the sharing of learned code knowledge between different tasks, and promotes each other's performance on specific code tasks, thereby forming the entire code defect detection and repair method.

[0043] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0045] Figure 1 The present invention is a flowchart of a method for detecting and repairing code defects based on a large model according to an exemplary embodiment.

[0046] Figure 2 The network structure and relationship diagram of the model involved in the method are shown according to an exemplary embodiment.

[0047] Figure 3 The invention is a block diagram of a code defect detection and repair device based on a large model according to an exemplary embodiment.

[0048] Figure 4 The diagram is a schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0049] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0050] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0051] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0052] Figure 1 is a flowchart of a code defect detection and repair system based on a large model according to an exemplary embodiment. Figure 1 As shown, the method may include the following steps:

[0053] S11: Obtain a project code directory of a software project, and construct a dependency graph between various code files in the software project according to the project code directory;

[0054] S12: Scanning each code file in a topological order according to the dependency graph, using the function definitions in the files as basic code fragments, and generating a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends;

[0055] S13: traversing each basic block based on the control flow graph, and if there is a function call statement in the basic block, merging the control flow graph of the called function into the control flow graph of the calling function;

[0056] S14: according to the control flow graph, using a large language model to obtain an embedded representation of a statement sequence of a basic block;

[0057] S15: According to the control flow graph and the embedded representation of the basic block, a graph neural network is used to fuse information between the basic blocks to obtain a vector representation of the basic block containing global information of the code snippet to be detected;

[0058] S16: Use the vector representation of basic blocks and control flow graphs containing global information to train defect repair models, defect classification models, and summary generation models;

[0059] S17: Obtain a code snippet to be detected, generate a code summary for the code snippet to be detected using the trained defect repair model, defect classification model and summary generation model, perform defect detection and classification on the code snippet to be detected, and perform defect repair.

[0060] It can be seen from the above embodiments that the present application designs a code defect detection and repair method based on a large model, which includes a large model embedding strategy, a vector fusion strategy and a multi-task training mechanism, so as to simultaneously utilize the global control flow information, data flow information and the correlation of multiple code tasks of the code snippet, and improve the efficiency of the large model in code defect detection and repair tasks. On the one hand, the graph neural network is used to perform vector fusion between basic blocks, automatically capture the data association and control association between different basic blocks of the code snippet, and output a vector representation of the basic block containing global information; on the other hand, the multi-task training mechanism, by sharing large model parameters and graph neural network parameters, realizes the sharing of learned code knowledge between different tasks, and promotes each other's performance on specific code tasks, thereby forming the entire code defect detection and repair system.

[0061] In the specific implementation of step S11, the project code directory of the software project is obtained, and a dependency graph between the various code files in the software project is constructed according to the project code directory, wherein the project code directory indicates each code package in a complete software project and each code file under the code package, and the dependency graph includes nodes representing code files and directed edges representing file reference relationships (directed edges point from referenced files to reference files). In the specific implementation, it is also necessary to annotate the summary of the functions in the software project to facilitate the training of the summary generation model in step S16.

[0062] In the specific implementation of step S12, according to the dependency graph, each code file is scanned in a topological order, and the function definition in the file is used as the basic code fragment, and a control flow graph of the code fragment to be detected in the software project and the basic code fragment it depends on is generated, wherein the control flow graph includes nodes representing basic blocks and directed edges representing jump relationships between basic blocks;

[0063] In a specific implementation, as a training data set, each basic block is annotated with its defect information, so the LLVM-Clang tool can generate a control flow graph containing defect annotation information for the code snippet to be detected. The control flow graph is recorded as ,in, A collection of nodes representing basic blocks; Indicates whether there is a jump relationship between basic block nodes. Represents basic blocks and basic blocks There is a feasible execution path between ; , representing a basic block Contains a series of program statements that are executed sequentially , Represents basic blocks Contains Class software defects, Represents basic blocks Does not include any defects. The defect categories described in this method are all composed of the 2022 Top-25 defect categories published by the CWE (Common Weakness Enumeration) website (https: / / cwe.mitre.org / ), including out-of-bounds write or read, SQL injection, deserialization vulnerabilities and other defect categories.

[0064] In the specific implementation of step S13, each basic block is traversed based on the control flow graph, and if there is a function call statement in the basic block, the control flow graph of the called function is merged into the control flow graph of the calling function;

[0065] Specifically, Figure 2 As shown, this step may include the following sub-steps:

[0066] S31: traversing each basic block based on the control flow graph, if there is a function call statement in the basic block, splitting the basic block and treating the function call statement as a separate basic block;

[0067] Specifically, for the control flow graph , if there is a function call statement , then the set of basic blocks after splitting is .

[0068] S32: if the function definition corresponding to the function call statement is in the same file as the function calling it, then merge the control flow graph of the called function into the control flow graph of the calling function; otherwise, generate a summary of the function using a summary generation model, and annotate the summary to the function call statement, wherein the summary describes the meaning of the parameters, return value and function function of the function;

[0069] Specifically, for the two control flow graphs to be merged and , if the combined control flow graph is , , represents the basic block Contains function call statements and , ,but , For those who need to generate summaries , if its corresponding function is defined as ,express The corresponding function definition v consists of the sequence of statements Composition, inputting the function definition into the summary generation model M, and , If the function summary of the large model response is inserted after the summary .

[0070] In the specific implementation of step S14, according to the control flow graph, the embedded representation of the statement sequence of the basic block is obtained using a large language model, including:

[0071] S41: Use a tokenizer to tokenize the statement sequence of the basic block to obtain a word sequence, and add the word '[CLS]' before the word sequence to identify the global semantic information of the word sequence, and add the word '[SEP]' at the boundary between different statements to separate different statements;

[0072] Specifically, let the basic block ,in Represents a series of program statements executed sequentially in the basic block v. After passing through the tokenizer T, ,in express The jth token after word segmentation, [CLS] is a special marker used to be inserted at the beginning of the text segment to aggregate the global semantic information of the text segment.

[0073] S42: Using a Transformer-based large language model, taking the word sequence corresponding to the sentence sequence in the basic block as input, obtain the embedding representation of the sentence sequence;

[0074] Specifically, , , where LLM represents a large language model (such as CodeGPT, CodeLLaMA, etc.), Represents the output vector of the i-th token. The word vector representation of the word '[CLS]' is the vector representation of the entire basic block.

[0075] In the specific implementation of step S15, according to the control flow graph and the embedded representation of the basic block, the graph neural network is used to perform information fusion between the basic blocks to obtain a vector representation of the basic block containing the global information of the code snippet to be detected;

[0076] Specifically, the embedding representation of the basic block is used as the input vector of the graph neural network GNN , where the graph neural network consists of a set of parameters Model Control, initialization input is ,in represents the output vector of the i-th basic block in step S14, , N is the number of layers of the graph neural network, Represents the parameters of the lth layer network.

[0077] The graph neural network is used to aggregate the vector representation of the adjacent nodes of each basic block node in the control flow graph, and further obtain the vector representation of the basic block node containing global information such as control flow and data flow; specifically, the aggregation process can be expressed as: ,in, represents the activation function selected by the l-th layer of the graph neural network, Represents the input of the lth layer network and the output of the l-1th layer network, represents the parameters of the first layer network, E represents the adjacency matrix of the control flow graph (the adjacency matrix indicates whether there is a jump relationship between basic block nodes. If the basic block and basic blocks If there is a jump relationship between , basic block adjacency), , ,and is a diagonal matrix, .

[0078] In the specific implementation of step S16, the vector representation of the basic block containing global information and the control flow graph are used to train the summary generation model, the defect classification model and the defect repair model, including:

[0079] S61: average the vector representation of each node on the control flow graph obtained in step S15 to obtain a graph-level vector representation, use the graph-level vector as the input of the summary generation model, decode and generate a code summary of the function fragment, use the annotated function summary as the target output, and train the summary generation model;

[0080] Specifically, a multi-layer Transformer Decoder is used as the summary generation model. If the function code segment The control flow graph contains the basic block node set as After step S52, the output vector set of the basic block node is , set the output layer ,but ,in A word sequence representing the code summary output by the model;

[0081] S62: using the vector representation of the basic block obtained in S15 as the input of the defect classification model, outputting the probability that the basic block belongs to a certain type of defect, using the defect category contained in the basic block as the target output, and training the defect classification model;

[0082] Specifically, the defect classification model includes a multi-layer MLP and a softmax layer as the final output layer. ,in Represents basic blocks The probability of containing the i-th type of defect.

[0083] S63: performing a mask operation on the basic block containing the defect, decoding and generating using a defect repair model including a multi-layer Transformer Decoder, taking a code sequence after the defect is repaired as a target output, and training the defect repair model;

[0084] Specifically, if the basic block containing the defect is , and the output vector of the basic block after step S52 is ,but ,in A token sequence representing the code after model repair.

[0085] Specifically, the loss function of the above three training tasks is the cross entropy loss function, namely: ,in, Represents the error of the model on the jth task. For the summary generation model training task and the defect repair model training task, Indicates the probability that the model output is the i-th word in the vocabulary, Indicates the probability that the actual label is the i-th word in the vocabulary (0 or 1); for the defect classification model training task, represents the probability of the i-th type defect, Represents the actual label, which is the probability of the i-th type of defect (0 or 1).

[0086] Specifically, the weighted sum of the errors of the above three tasks is taken as the total error of the model, that is: ,in, represents the error weight of the jth task, Represents the error of the model on the jth task; finally, the gradient is back-propagated and the model parameters are adjusted based on the total error.

[0087] Specifically, the shared parameters of the model include: ,in, represents the parameters of the large model used, Represents the parameters of the graph neural network used for basic block information fusion. The total error of the above three tasks will jointly determine how to adjust the shared parameters. The non-shared parameters of the model include: , , ,in, Indicates the parameters unique to the summary generation task. Represents the parameters of the transformer decoder in the summary generation model, Indicates the parameters unique to the defect detection task, They represent the parameters of the MLP and softmax layers in the defect detection model, respectively. Indicates the parameters that are exclusive to the code defect repair task. Represents the parameters of the transformer decoder in the defect repair model. The error of each task determines the adjustment method of the unique parameters of the task.

[0088] In the specific implementation of step S17, a software project to be processed is obtained, and the trained summary generation model is used to replace the functions in the software project to be processed whose length exceeds a predetermined threshold with corresponding summaries, and the trained defect classification model and defect repair model are used to perform defect detection and classification, and perform defect repair;

[0089] Specifically, for the software project to be processed, before inputting the defect classification model and the defect repair model, the processing process of S11-S15 is required, and the vector representation of the basic block containing the global information of the code fragment to be detected is used as the input of the trained defect classification model to obtain the probability that it belongs to a certain type of defect; the basic block containing the defect is masked and decoded and generated using the trained defect repair model to obtain the code sequence after the defect is repaired.

[0090] Corresponding to the aforementioned embodiment of the code defect detection and repair method based on a large model, the present application also provides an embodiment of a code defect detection and repair device based on a large model.

[0091] Figure 3 1 is a block diagram of a code defect detection and repair device based on a large model according to an exemplary embodiment. Figure 3 , the device may include:

[0092] A dependency graph building module 21 is used to obtain a project code directory of a software project and build a dependency graph between various code files in the software project according to the project code directory;

[0093] A control flow graph generation module 22 is used to scan each code file in a topological order according to the dependency graph, and generate a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends, using the function definitions in the files as basic code fragments;

[0094] A control flow graph merging module 23 is used to traverse each basic block based on the control flow graph, and if there is a function call statement in the basic block, merge the control flow graph of the called function into the control flow graph of the calling function;

[0095] A basic block statement embedding module 24, configured to obtain an embedding representation of a basic block statement sequence using a large language model according to the control flow graph;

[0096] An information fusion module 25, configured to use a graph neural network to perform information fusion between basic blocks based on the control flow graph and the embedded representation of the basic blocks, and obtain a vector representation of the basic block containing the global information of the code snippet to be detected;

[0097] A model training module 26, for training a summary generation model, a defect classification model, and a defect repair model using a vector representation of a basic block containing global information and a control flow graph;

[0098] The defect classification and repair module 27 is used to obtain the software project to be processed, use the trained summary generation model to replace the functions in the software project to be processed whose length exceeds a predetermined threshold with corresponding summaries, use the trained defect classification model and defect repair model to perform defect detection and classification, and perform defect repair.

[0099] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0100] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0101] Accordingly, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned large model-based code defect detection and repair method.

[0102] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned large model-based code defect detection and repair method. Figure 4 As shown in FIG. 1 , a hardware structure diagram of a device having data processing capability in which a code defect detection and repair device based on a large model provided by an embodiment of the present invention is located, except that Figure 4 In addition to the processor, memory and network interface shown, any device with data processing capability in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capability, which will not be described in detail.

[0103] Accordingly, the present application also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by the processor, the code defect detection and repair method based on the large model as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

[0104] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0105] It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A code defect detection and repair method based on a large model, characterized in that: include: Obtain a project code directory of a software project, and construct a dependency graph between various code files in the software project according to the project code directory; According to the dependency graph, each code file is scanned in a topological order, and the function definitions in the files are used as basic code fragments to generate a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends; Traversing each basic block based on the control flow graph, if there is a function call statement in the basic block, merging the control flow graph of the called function into the control flow graph of the calling function; According to the control flow graph, using a large language model, an embedding representation of a statement sequence of a basic block is obtained; According to the control flow graph and the embedded representation of the basic block, a graph neural network is used to fuse information between the basic blocks to obtain a vector representation of the basic block containing global information of the code snippet to be detected; Using the vector representation of basic blocks and control flow graphs containing global information, the summary generation model, defect classification model, and defect repair model are trained; Obtain a software project to be processed, use the trained summary generation model to replace functions in the software project to be processed whose length exceeds a predetermined threshold with corresponding summaries, use the trained defect classification model and defect repair model to perform defect detection and classification, and perform defect repair; Among them, the vector representation and control flow graph of the basic block containing global information are used to train the defect repair model, defect classification model and summary generation model, including: The vector representation of each node on the control flow graph is averaged to obtain a graph-level vector representation, the graph-level vector is used as the input of the summary generation model, the code summary of the function fragment is decoded and generated, and the annotated function summary is used as the target output to perform the training task of the summary generation model; Taking the vector representation of the basic block containing global information as the input of the defect classification model, outputting the probability that it belongs to a certain type of defect, taking the defect category contained in the basic block as the target output, and performing the training task of the defect classification model; Perform mask operations on basic blocks containing defects, use a defect repair model including a multi-layer Transformer Decoder to perform decoding and generation, use the code sequence after the defects are repaired as the target output, and perform the training task of the defect repair model; Among them, the weighted sum of the losses of the three training tasks is used to train the large language model and graph neural network, and the loss of each training task is used to train the corresponding model.

2. The method according to claim 1, characterized in that: The project code directory indicates each code package and each code file under the code package in a complete software project, and the dependency graph includes nodes representing code files and directed edges representing file reference relationships.

3. The method according to claim 1, characterized in that: The control flow graph includes nodes representing basic blocks and directed edges representing jump relationships between basic blocks. The control flow graph is denoted as ,in, A collection of nodes representing basic blocks; Indicates whether there is a jump relationship between basic block nodes. Represents basic blocks and basic blocks There is a feasible execution path between ; , representing a basic block Contains a series of program statements that are executed sequentially , Represents basic blocks Contains Class software defects, Represents basic blocks Contains no defects.

4. The method according to claim 1, characterized in that: Traversing each basic block based on the control flow graph, if there is a function call statement in the basic block, merging the control flow graph of the called function into the control flow graph of the calling function, including: Traversing each basic block based on the control flow graph, if a function call statement exists in the basic block, splitting the basic block and treating the function call statement as a separate basic block; If the function definition corresponding to the function call statement is in the same file as the function that calls it, the control flow graph of the called function is merged into the control flow graph of the calling function; otherwise, a summary of the function is generated using a summary generation model, and the summary is annotated onto the function call statement, wherein the summary describes the meaning of the function's parameters, return value, and function function.

5. The method according to claim 1, characterized in that: According to the control flow graph, an embedding representation of a statement sequence of a basic block is obtained using a large language model, including: Use a tokenizer to tokenize the statement sequence of the basic block to obtain a word sequence, and add the word '[CLS]' before the word sequence to identify the global semantic information of the word sequence, and add the word '[SEP]' at the boundary between different statements to separate different statements; Using a large Transformer-based language model, the word sequence corresponding to the sentence sequence in the basic block is taken as input to obtain the embedded representation of the sentence sequence.

6. The method according to claim 1, characterized in that: According to the control flow graph and the embedded representation of the basic block, the graph neural network is used to fuse the information between the basic blocks to obtain the vector representation of the basic block containing the global information of the code snippet to be detected, specifically: The graph neural network is used to aggregate the vector representations of the adjacent nodes of each basic block node in the control flow graph to obtain the vector representation of the basic block node containing global information. The aggregation process is expressed as: ( ,E| )= ( ), represents the activation function selected by the l-th layer of the graph neural network, represents the input of the lth layer network, represents the parameters of the lth layer network, E represents the adjacency matrix of the control flow graph, =E+I, = , is a diagonal matrix, =Z.

7. A code defect detection and repair method based on a large model, characterized in that: include: A dependency graph building module is used to obtain a project code directory of a software project and build a dependency graph between various code files in the software project according to the project code directory; A control flow graph generation module is used to scan each code file in a topological order according to the dependency graph, and use the function definitions in the files as basic code fragments to generate a control flow graph of the code fragment to be detected in the software project and the basic code fragments on which it depends; A control flow graph merging module is used to traverse each basic block based on the control flow graph, and if there is a function call statement in the basic block, merge the control flow graph of the called function into the control flow graph of the calling function; A basic block statement embedding module, used to obtain an embedding representation of a basic block statement sequence using a large language model according to the control flow graph; An information fusion module, used to use a graph neural network to perform information fusion between basic blocks according to the control flow graph and the embedded representation of the basic block, so as to obtain a vector representation of the basic block containing the global information of the code fragment to be detected; A model training module, used to train summary generation models, defect classification models, and defect repair models using vector representations of basic blocks containing global information and control flow graphs; A defect classification and repair module is used to obtain a software project to be processed, use the trained summary generation model to replace the functions in the software project to be processed whose length exceeds a predetermined threshold with corresponding summaries, use the trained defect classification model and defect repair model to perform defect detection and classification, and perform defect repair; Among them, the vector representation and control flow graph of the basic block containing global information are used to train the defect repair model, defect classification model and summary generation model, including: The vector representation of each node on the control flow graph is averaged to obtain a graph-level vector representation, the graph-level vector is used as the input of the summary generation model, the code summary of the function fragment is decoded and generated, and the annotated function summary is used as the target output to perform the training task of the summary generation model; Taking the vector representation of the basic block containing global information as the input of the defect classification model, outputting the probability that it belongs to a certain type of defect, taking the defect category contained in the basic block as the target output, and performing the training task of the defect classification model; Perform mask operations on basic blocks containing defects, use a defect repair model including a multi-layer Transformer Decoder to perform decoding and generation, use the code sequence after the defects are repaired as the target output, and perform the training task of the defect repair model; Among them, the weighted sum of the losses of the three training tasks is used to train the large language model and graph neural network, and the loss of each training task is used to train the corresponding model.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images