An automated code defect repair method based on static code analysis tools and artificial intelligence

Abstract

The present invention provides an automated code defect repair method based on a static code analysis tool and artificial intelligence, including: constructing a training data set; constructing an artificial intelligence model for code generation; optimizing the artificial intelligence model using the training data set; constructing a static code analysis tool, integrated into the software development continuous integration and continuous delivery deployment automation process; constructing a service component of a human-computer interaction interface, integrating the static code analysis tool and the code repository; applying the artificial intelligence model to analyze and repair code defects through the service component of the human-computer interaction interface. The method disclosed by the present invention is applied to the software development stage, which is conducive to improving development efficiency, ensuring product quality, and reducing manpower investment, and has significant practical value.

Description

Technical Field

[0001] The present invention relates to the field of electronic information technology, and in particular to an automated software code defect repair method based on static code analysis tools and artificial intelligence. Background Art

[0002] Software quality is directly related to product reliability and user experience. Therefore, code quality control is a crucial link in the software development process. Currently, code quality control in software development mainly relies on traditional static analysis tools and manual code review to ensure code quality and security. However, existing methods have the following major problems:

[0003] 1. Inefficiency: Manual code review takes a long time, especially in large projects where the amount of code is huge and submissions are frequent, which prolongs the development cycle.

[0004] 2. Lack of accuracy: Manual review is easily limited by the technical level and experience of the reviewer, which may lead to missed detections or false detections.

[0005] 3. Low degree of automation: Although traditional static analysis tools can automatically scan the code, they can usually only detect known vulnerabilities and irregular writing methods, and cannot perform automatic repairs, and still require manual intervention.

[0006] In order to overcome the above shortcomings and improve code quality and development efficiency, it is necessary to improve and perfect the existing technology. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention proposes an automated code defect repair method based on static code analysis tools and artificial intelligence.

[0008] The present invention adopts the following technical solutions to improve and perfect the prior art:

[0009] An automated code defect repair method based on static code analysis tools and artificial intelligence includes the following steps:

[0010] Step S110, constructing a training data set;

[0011] Step S120: construct an artificial intelligence model for code generation;

[0012] Step S130, optimizing the artificial intelligence model constructed in step S120 using the training data set constructed in step S110;

[0013] Step S140: Build a static code analysis tool and integrate it into the software development continuous integration and continuous delivery deployment automation process;

[0014] Step S150: construct a service component of a human-computer interaction interface, integrating the static code analysis tool and the code repository;

[0015] Step S160: Using the service component of the human-computer interaction interface, apply the artificial intelligence model to perform code defect analysis and repair.

[0016] Furthermore, the step S110 includes:

[0017] Step S1101: Collect common vulnerability data in source code, wherein the vulnerability data is obtained from vulnerability libraries, developer communities, and security blogs through a web crawler or manually.

[0018] Step S1102: Collect coding practice data, where the coding practice data includes best practices in official documents of various development languages, and questions and answers about secure coding and code quality in the programmer community, and the coding practice data is obtained by web crawlers or manually;

[0019] Step S1103: Collect result data of mainstream static code analysis tools from GitHub public repositories and enterprise-owned code repositories, where the result data includes detected vulnerabilities and code quality issues;

[0020] Step S1104: pre-process the acquired vulnerability data, coding practice data, and result data of the static code analysis tool to obtain a training data set.

[0021] Further, step S1104 includes:

[0022] Step S11041, use Python's pandas library to perform data deduplication;

[0023] Step S11042: convert the deduplicated data into a unified format;

[0024] Step S11043: Use Python's Pandas library to clean dirty data, where the dirty data includes missing values, format errors, and irrelevant special characters, and unify the indentation, format, and comments of the code snippets to obtain a preprocessed data set;

[0025] Step S11044: classify and annotate the preprocessed data set according to the characteristics of the vulnerability data, add language identifiers to the multi-language code samples, and obtain a classified data set.

[0026] Furthermore, step S1104 also includes:

[0027] Step S11045, slightly mutating the existing samples to increase data diversity, wherein the slight mutation includes slight mutation, and for rare vulnerability types, using oversampling technology to balance the data, thereby obtaining an enhanced data set;

[0028] Step S11046: Use Python's JSON module to convert the enhanced dataset into a standardized dataset in JSON format;

[0029] Step S11047: Apply feature engineering to optimize the standardized data set to obtain the final training data set.

[0030] Furthermore, the feature engineering in step S11047 includes:

[0031] Step S110471: Use the parser of the target programming language to convert the source code into an abstract syntax tree so as to capture the grammatical structure and semantic information of the code;

[0032] Step S110472, traverse the abstract syntax tree to extract key structural information, where the key structural information includes function calls, parameters, and control flow structures;

[0033] Step S110473: Use the CountVectorizer and TfidfVectorizer tools in the Python sklearn library to convert the text content into a numerical vector.

[0034] Furthermore, the step S120 includes:

[0035] Step S1201: Based on specific needs and resource constraints, select an open source artificial intelligence model that can process natural language instructions and focuses on code generation;

[0036] Step S1202: Download the artificial intelligence model from a trusted and secure source and deploy it locally. The trusted and secure source includes Hugging Face Model Hub and the official GitHub repository of the model.

[0037] Step S1203: construct an API interface for the artificial intelligence model to realize the online nature of the artificial intelligence model.

[0038] Furthermore, the step S130 includes:

[0039] Step S1301, dividing the training data set constructed in step S110 into a training set, a validation set and a test set according to a certain ratio;

[0040] Step S1302: Use the prepared training set data to optimize and adjust the artificial intelligence model, regularly evaluate the model performance on the validation set, and save the best checkpoint;

[0041] Step S1303: Select an appropriate optimizer and learning rate scheduler, and combine gradient accumulation and mixed precision training to optimize the effect;

[0042] Step S1304: Use the BLEU score or a custom code similarity index to evaluate the generation quality and obtain an evaluation score;

[0043] Step S1305: Use the evaluation score as a supervisory feedback signal to adjust the model structure or training strategy, and continuously optimize and improve the generation quality and performance of the artificial intelligence model.

[0044] Further, step S140 includes:

[0045] Step S1401: deploy mainstream static code analysis tools to discover potential problems and security vulnerabilities in the code;

[0046] Step S1402: Create an API access token on the code repository platform and configure corresponding access permissions to ensure that the static code analysis tool can read the code and metadata in the code repository;

[0047] Step S1403: Integrate the static code analysis tool into the software development continuous integration and continuous delivery deployment automation process, and automatically trigger the static analysis tool to perform code scanning when the software developer initiates code submission to the code repository or submits a request in the code repository to merge its code changes into the main branch.

[0048] Furthermore, the step S150 includes:

[0049] S1501. Develop a service component with a human-computer interaction interface;

[0050] S1502. Create an API access token in the static code analysis tool and configure corresponding access permissions to ensure that the service component developed in step S1501 can remotely read scan reports and logs securely;

[0051] S1503. Create an API access token in the code repository and configure corresponding access permissions to ensure that the service component built in step S1501 can securely read the code and metadata in the code repository.

[0052] Further, step S160 includes:

[0053] S1601. A software developer submits code to the code repository, or makes a request in the code repository to merge his / her code changes into the main branch;

[0054] S1602, automatically triggering a static analysis tool to scan the code and generate a scan result;

[0055] S1603: Automatically process code defects. Step S1603 includes:

[0056] S16031. Notify software developers of defects in submitted code through a message notification mechanism, wherein the message notification mechanism includes using a message queue system, calling an API interface, etc.;

[0057] S16032. The service component constructed in step S1501 identifies new scanning jobs by monitoring the work log of the static code analysis tool, and automatically calls the static code analysis tool API to obtain a detailed scanning report;

[0058] S16033. The service component constructed in step S1501 automatically extracts detailed information of each defect from the scan report, including defect type, defect description, and code file path;

[0059] S16034. The service component constructed in step S1501 automatically structures the extracted information and stores it securely in the database;

[0060] S16035. The service component constructed in step S1501 securely accesses the corresponding code file through the code repository API according to the path information of each defective code file stored in the database, accurately locates and extracts the defective code and its context information;

[0061] S16036: The service component constructed in step S1501 automatically converts the collected defect details, the defective code and its context information into natural language prompts that can be understood by the artificial intelligence model through a predefined code defect automatic repair prompt template;

[0062] S16037. The service component constructed in step S1501 transmits the generated natural language prompt to the artificial intelligence model through the API interface;

[0063] S16038, the AI ​​model automatically generates a repair solution including code segments based on the received natural language prompts;

[0064] S16039: The service component constructed in step S1501 obtains the repair solution through the API interface of the artificial intelligence model and stores it securely in the database;

[0065] S1604: The software developer receives a notification that the submitted code has a defect;

[0066] S1605. The software developer checks his own code, related defects, and the repair solutions provided by the artificial intelligence model through the service component built in step S1501, and takes the following measures according to the actual situation:

[0067] Accept: If the developer believes that the repair solution provided by the AI ​​model meets the actual needs, he or she can directly replace the source code content in his or her hands with the code snippet in the solution.

[0068] Rejection: If the developer believes that the repair solution provided by the AI ​​model is insufficient, they can request the AI ​​model to be regenerated through the interface. The developer can provide specific opinions and requirements to assist the AI ​​model in optimizing and generating new solutions;

[0069] S1606. After the repair is completed, the developer resubmits the code to the code repository, or submits a request in the code repository to merge the modified code changes into the main branch.

[0070] The present invention solves several major problems in the prior art by integrating advanced artificial intelligence technology and combining static code analysis tools, and provides an efficient, accurate, safe and sustainable innovative solution for code quality management in the software development process. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a flowchart of an automated software code defect repair method based on static code analysis tools and artificial intelligence in the present invention. DETAILED DESCRIPTION

[0072] In order to more clearly illustrate the purpose, technical solution and advantages of the present invention, the technical solution in the embodiment is further described in conjunction with the accompanying drawings of the embodiment of the present invention. The described embodiment is only a part of the present invention, not all.

[0073] The core content is the most critical, and a lengthy description may blur the focus. Therefore, some details will be appropriately omitted, because based on the existing content in the specification and common sense in the industry, technicians can fully understand it without excessive elaboration.

[0074] The method of the present invention can theoretically be directly used as an automated defect code repair service and integrated into the CICD process to achieve truly fully automatic repair. However, given that artificial intelligence technology is still in the exploration and development stage, a more practical approach is to use it as an auxiliary tool to help software developers repair code more efficiently, thereby ensuring code quality and improving the efficiency of software developers.

[0075] In addition, the order of the steps described in the specification is not fixed. Those skilled in the art can optimize and adjust the order of the steps according to the actual needs. The order shown in the specification and the drawings is only for the purpose of making the description clearer, and it is not mandatory to execute in this order unless otherwise explicitly required.

[0076] SonarQube is an open source code quality management tool dedicated to continuous inspection and analysis of source code quality. It can detect code errors and discover potential security issues. SonarQube supports more than 25 programming languages, including Java, C / C++, JavaScript, etc., and can be easily integrated into the CI / CD process to achieve automated code inspection.

[0077] As a widely used object-oriented programming language, Java is widely used in many fields such as enterprise application development, Android mobile application development, Web application development, big data processing and embedded systems.

[0078] In this embodiment, an automated Java code defect repair method based on the SonarQube static code analysis tool and artificial intelligence is provided. Based on the technical solution of the present invention, a new automated Java code defect repair can be implemented. The specific steps are as follows:

[0079] S110: Build a comprehensive AI model training dataset;

[0080] Preferably, the step S110 includes:

[0081] S1101. Collect common vulnerability data in Java source code, including but not limited to SQL injection, XSS cross-site scripting attack, RCE remote code execution, buffer overflow, deserialization and other vulnerabilities and their repair examples. This data can be obtained from vulnerability libraries, developer communities, security blogs, etc. through web crawlers or manual methods;

[0082] S1102. Collect Java coding best practices data, including best practices in the official Java development language documentation and questions and answers about secure coding and code quality in the Stack Overflow programmer community. Again, this data can be obtained through web crawlers or manual methods;

[0083] S1103. Collect the result data of mainstream static code analysis tools from GitHub public Java project repositories and enterprise-owned code repositories, including detected vulnerabilities and code quality issues;

[0084] S1104: Preprocess the acquired Java vulnerability data, Java coding practice data, and static code analysis tool result data to obtain a training data set. The specific steps are as follows:

[0085] S11041. Use Python's pandas library to deduplicate data to improve data quality and accuracy;

[0086] S11042, converting the deduplicated data into a unified format;

[0087] S11043. Use Python's Pandas library to clean dirty data (such as missing values, format errors, irrelevant special characters, etc.), and unify the indentation, format, and comments of code snippets to obtain the preprocessed data set;

[0088] S11044. Classify and label the preprocessed data set according to the characteristics of the vulnerability data to obtain a classified data set;

[0089] Optionally, step S1104 further includes:

[0090] S11045. Slightly mutate existing samples (such as variable name replacement, statement rearrangement, etc.) to increase data diversity. For rare vulnerability types, use oversampling technology to balance the data to obtain an enhanced data set;

[0091] S11046. Use Python's JSON module to convert the augmented dataset into a standardized dataset in JSON format;

[0092] S11047. Apply feature engineering to optimize the standardized data set to obtain the final training data set.

[0093] Feature engineering includes:

[0094] S110471. Use Java Parser to convert source code into an abstract syntax tree to capture the grammatical structure and semantic information of the code.

[0095] S110472, traverse the abstract syntax tree and extract key structural information, including function calls, parameters, control flow structures, etc.;

[0096] S110473. Use the CountVectorizer and TfidfVectorizer tools in Python's sklearn library to convert text content into numerical vectors.

[0097] S120: Build an AI model for code generation;

[0098] Preferably, the step S120 includes:

[0099] S1201, Code Llama-Instruct was selected as the artificial intelligence model;

[0100] Furthermore, Code Llama is an open-source code model based on Transformer, which can generate code in multiple programming languages ​​from code and natural language prompts, including but not limited to Python, Java, C++, etc. Code Llama versions include: Code Llama-basic code model, Code Llama-Python-Python fine-tuning version, Code Llama-Instruct natural language instruction fine-tuning version. The parameters are 7B, 13B, 34B and 70B respectively, and larger parameters require higher hardware requirements.

[0101] S1202. Download Code Llama-Instruct from HuggingFace Model Hub and deploy it locally.

[0102] S1203. Implement Code Llama-Instruct online by building an API interface.

[0103] S130: Optimize Code Llama-Instruct using training dataset;

[0104] Preferably, the step S130 includes:

[0105] S1301, splitting the training data set constructed in step S110 into a training set, a validation set, and a test set in a ratio of 8:1:1;

[0106] S1302. Use the prepared training set data to optimize and adjust Code Llama-Instruct, evaluate the model performance on the validation set regularly, and save the best checkpoints;

[0107] S1303, select AdamW optimizer and linear decay and warm-up learning rate scheduler, and combine gradient accumulation and mixed precision training to optimize the effect;

[0108] S1304, using a BLEU score or a custom code similarity index to evaluate the generation quality and obtain an evaluation score;

[0109] S1305. Use the evaluation score as a supervisory feedback signal to adjust the model structure or training strategy to continuously optimize the generation quality and performance of CodeLlama-Instruct.

[0110] S140: Build the SonarQube static code analysis tool and integrate it into the software development continuous integration and continuous delivery deployment automation process;

[0111] Preferably, step S140 includes:

[0112] S1401. Install and deploy SonarQube;

[0113] S1402. Create an API access token on the code repository platform and configure the corresponding access permissions to ensure that SonarQube can read the code and metadata in the code repository;

[0114] S1403. Integrate SonarQube into the software development continuous integration and continuous delivery deployment automation process, and automatically trigger the code scanning job when the code is submitted or merged. The specific method of integrating SonarQube into the software development continuous integration process can be specifically implemented by referring to the instructions for use of SonarQube and software development continuous integration tools, which will not be repeated here.

[0115] S150: Build a service component with a human-computer interaction interface, integrating SonarQube and the code repository;

[0116] Preferably, the step S150 includes:

[0117] S1501. Use Python, MySQL database and corresponding WEB framework to develop a service component with a human-computer interaction interface to facilitate developers to operate. Furthermore, the service component also has the following functions:

[0118] 1. Monitor SonarQube's work log;

[0119] 2. Obtain code scanning reports through SonarQube's API and extract defect information, including defect type, defect description, and code file path;

[0120] 3. According to the code file path, access the corresponding code file through the code repository API to accurately locate and extract the code containing the defect and its context;

[0121] 4. Provide persistent storage and query services for defect information;

[0122] 5. Automatically process the collected defect information and defect code, and generate understandable natural language prompts for Code Llama-Instruct through the predefined code defect automatic repair prompt template. Further, the code defect automatic repair prompt template example is as follows:

[0123] Background Information

[0124] Code language: Java

[0125] Issue type: {issue_type}

[0126] Bug description: {issue_description}

[0127] Code and context:

[0128] {code}

[0129] Task

[0130] As an experienced software engineer, please analyze the defects in the above code. Please provide the following:

[0131] Fix proposal: Provide specific fix proposals, including modified code and add clear natural language comments explaining what was changed.

[0132] Optimization strategy: Based on different optimization goals (such as performance, maintainability, security, etc.), provide at least two different optimization solutions. For each repair solution:

[0133] a) State the main goal of the optimization scheme.

[0134] b) Provide specific code implementation.

[0135] c) Explain how the solution achieves the optimization goal.

[0136] Please answer in a clear, professional manner, and make sure your suggestions conform to Java syntax and conventions.

[0137] 6. Interact with Code Llama-Instruct through its API;

[0138] 7. Receive and process the information returned by Code Llama-Instruct, display the defect information and original code snippets in the user interface, and present the repair suggestions and refactored code generated by Code Llama-Instruct for developers to refer to;

[0139] S1502. Create an API access token in SonarQube and configure corresponding access permissions to ensure that the service component developed in step S1501 can remotely read scan reports and logs securely;

[0140] S1503. Create an API access token in the code repository and configure corresponding access permissions to ensure that the service component built in step S1501 can safely read the code and metadata in the code repository;

[0141] S160: Using the service component of the human-computer interaction interface, Code Llama-Instruct is used to analyze and repair code defects. Step S160 includes:

[0142] S1601. A software developer submits code to the code repository, or makes a request in the code repository to merge his / her code changes into the main branch;

[0143] S1602, automatically trigger SonarQube to scan for code defects and generate scan results;

[0144] S1603, Automatically handle code defects;

[0145] Furthermore, step S1603 includes:

[0146] S16031. Notify software developers of defects in the code submitted by them through a message notification mechanism. The message notification mechanism includes the use of a message queue system, calling an API interface, and other integrated solutions. These technologies are already very mature and will not be described in detail.

[0147] S16032. The service component constructed in step S1501 monitors the SonarQube work log through the SonarQube API interface, identifies new scan job reports, and automatically calls the SonarQube API interface to obtain detailed scan reports;

[0148] S16033, the service component constructed in step S1501 automatically extracts detailed information of each defect from the scan report, including defect type, defect description, and code file path, etc.;

[0149] S16034. The service component constructed in step S1501 automatically structures the extracted information and stores it securely in the database;

[0150] S16035. The service component constructed in step S1501 securely accesses the corresponding code file through the code repository API according to the path information of each defective code file stored in the database, accurately locates and extracts the defective code and its context information;

[0151] S16036, the service component constructed in step S1501 automatically converts the collected defect details, defective code and its context information into natural language prompts understandable to Code Llama-Instruct through a predefined code defect automatic repair prompt template;

[0152] S16037. The service component constructed in step S1501 transmits the generated natural language prompt to Code Llama-Instruct through the API interface;

[0153] S16038, Code Llama-Instruct automatically generates a repair solution containing code snippets based on the natural language prompts received;

[0154] The service component built in S16039 and S1501 obtains the repair solution through the API interface of Code Llama-Instruct and stores it securely in the database;

[0155] S1604: The software developer receives a notification that the submitted code has a defect;

[0156] S1605. The software developer checks his own code, related defects and the repair solutions provided by Code Llama-Instruct through the service component built in step S1501, and takes the following measures according to the actual situation:

[0157] Accept: If the developer believes that the fix provided by Code Llama-Instruct meets the actual needs, he or she can directly replace the code snippet in the solution with the source code content in his or her hands.

[0158] Rejection: If the developer believes that the repair solution provided by Code Llama-Instruct is insufficient, they can request a regeneration through the Code Llama-Instruct interface. The developer can provide specific opinions and requirements to assist Code Llama-Instruct in optimizing and generating new solutions;

[0159] S1606. After the repair is completed, the developer resubmits the code to the code repository, or submits a request in the code repository to merge the modified code changes into the main branch.

[0160] The beneficial effects of the present invention mainly include the following aspects:

[0161] 1. Improve code quality and security: By combining static code analysis tools and artificial intelligence models, it is possible to automatically detect and fix common vulnerabilities and quality issues in the code, effectively reducing the time of manual code review and the possibility of false omissions, thereby improving the overall quality and security of software products.

[0162] 2. Improve development efficiency: The development team can complete code repairs and submissions in a shorter time, speed up software iteration and release, and thus improve overall development efficiency;

[0163] 3. Reduce software development costs: Reduce the workload of manual code review and repair, and at the same time reduce the additional overhead and time cost of vulnerability repair through automation and intelligent methods, thereby reducing the overall software development cost.

[0164] Those skilled in the art can realize all functions of the above modules by means of computer programs. The program can be stored in a computer-readable storage medium, including but not limited to: a computer disk, a centralized storage device, a cloud storage platform, a distributed storage system, etc. Developers only need to load and execute the program on a computer system to automatically realize the above technical solutions.

[0165] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An automated code defect repair method based on static code analysis tools and artificial intelligence, characterized in that: The steps include: Step S110, constructing a training data set; Step S120: construct an artificial intelligence model for code generation; Step S130, optimizing the artificial intelligence model constructed in step S120 using the training data set constructed in step S110; Step S140: Build a static code analysis tool and integrate it into the software development continuous integration and continuous delivery deployment automation process; Step S150: construct a service component of a human-computer interaction interface, integrating the static code analysis tool and the code repository; Step S160: Using the service component of the human-computer interaction interface, applying the artificial intelligence model to perform code defect analysis and repair; Step S140 includes: Step S1401: deploy mainstream static code analysis tools to discover potential problems and security vulnerabilities in the code; Step S1402: Create an API access token on the code repository platform and configure corresponding access permissions to ensure that the static code analysis tool can read the code and metadata in the code repository; Step S1403: Integrate the static code analysis tool into the software development continuous integration and continuous delivery deployment automation process, and automatically trigger the static analysis tool to perform code scanning when the software developer initiates code submission to the code repository or makes a request in the code repository to merge its code changes into the main branch; The step S150 includes: S1501. Develop a service component with a human-computer interaction interface; S1502. Create an API access token in the static code analysis tool and configure corresponding access permissions to ensure that the service component developed in step S1501 can remotely read scan reports and logs securely; S1503. Create an API access token in the code repository and configure corresponding access permissions to ensure that the service component built in step S1501 can safely read the code and metadata in the code repository; Step S160 includes: S1601. A software developer submits code to the code repository, or makes a request in the code repository to merge his / her code changes into the main branch; S1602, automatically triggering a static analysis tool to scan the code and generate a scan result; S1603: Automatically process code defects. Step S1603 includes: S16031. Notify software developers of defects in submitted code through a message notification mechanism, wherein the message notification mechanism includes using a message queue system and calling an API interface; S16032. The service component constructed in step S1501 identifies new scan job reports by monitoring the static code analysis tool work log, and automatically calls the static code analysis tool API to obtain a detailed scan report; S16033. The service component constructed in step S1501 automatically extracts detailed information of each defect from the scan report, including defect type, defect description, and code file path; S16034. The service component constructed in step S1501 automatically structures the extracted information and stores it securely in the database; S16035. The service component constructed in step S1501 securely accesses the corresponding code file through the code repository API according to the path information of each defective code file stored in the database, accurately locates and extracts the defective code and its context information; S16036: The service component constructed in step S1501 automatically converts the collected defect details, the defective code and its context information into natural language prompts that can be understood by the artificial intelligence model through a predefined code defect automatic repair prompt template; S16037. The service component constructed in step S1501 transmits the generated natural language prompt to the artificial intelligence model through the API interface; S16038, the AI ​​model automatically generates a repair solution including code segments based on the received natural language prompts; S16039: The service component constructed in step S1501 obtains the repair solution through the API interface of the artificial intelligence model and stores it securely in the database; S1604: The software developer receives a notification that the submitted code has a defect; S1605. The software developer checks his own code, related defects, and the repair solutions provided by the artificial intelligence model through the service component built in step S1501, and takes the following measures according to the actual situation: Accept: If the developer believes that the repair solution provided by the AI ​​model meets the actual needs, he or she can directly replace the code snippet in the solution with the source code content in his or her hands; Rejection: If the developer believes that the repair solution provided by the AI ​​model is insufficient, the developer requires the AI ​​model to be regenerated through the interface, and the developer provides specific opinions and requirements to assist the AI ​​model in optimizing and generating new solutions; S1606. After the repair is completed, the developer resubmits the code to the code repository, or submits a request in the code repository to merge the modified code changes into the main branch.

2. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 1, characterized in that: The step S110 includes: Step S1101: Collect common vulnerability data in source code, wherein the vulnerability data is obtained from vulnerability databases, developer communities, and security blogs through web crawlers or manual methods; Step S1102: Collect coding practice data, where the coding practice data includes best practices in official documents of various development languages, and questions and answers about secure coding and code quality in the programmer community, and the coding practice data is obtained by web crawlers or manually; Step S1103: Collect result data of mainstream static code analysis tools from GitHub public repositories and enterprise-owned code repositories, where the result data includes detected vulnerabilities and code quality issues; Step S1104: pre-process the acquired vulnerability data, coding practice data, and result data of the static code analysis tool to obtain a training data set.

3. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 2, characterized in that: Step S1104 includes: Step S11041, use Python's pandas library to perform data deduplication; Step S11042: convert the deduplicated data into a unified format; Step S11043: Use Python's Pandas library to clean dirty data, where the dirty data includes missing values, format errors, and irrelevant special characters, and unify the indentation, format, and comments of the code snippets to obtain a preprocessed data set; Step S11044: classify and annotate the preprocessed data set according to the characteristics of the vulnerability data, add language identifiers to the multi-language code samples, and obtain a classified data set.

4. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 3, characterized in that: Step S1104 also includes: Step S11045: slightly mutate the existing samples to increase data diversity, wherein the slight mutation includes slight mutation; for rare vulnerability types, use oversampling technology to balance the data, thereby obtaining an enhanced data set; Step S11046: Use Python's JSON module to convert the enhanced dataset into a standardized dataset in JSON format; Step S11047: Apply feature engineering to optimize the standardized data set to obtain the final training data set.

5. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 4, characterized in that: The feature engineering in step S11047 includes: Step S110471: Use the parser of the target programming language to convert the source code into an abstract syntax tree so as to capture the grammatical structure and semantic information of the code; Step S110472, traverse the abstract syntax tree to extract key structural information, where the key structural information includes function calls, parameters, and control flow structures; Step S110473: Use the CountVectorizer and TfidfVectorizer tools in the Python sklearn library to convert the text content into a numerical vector.

6. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 1, characterized in that: The step S120 includes: Step S1201: Based on specific needs and resource constraints, select an open source artificial intelligence model that can process natural language instructions and focuses on code generation; Step S1202: Download the artificial intelligence model from a trusted and secure source and deploy it locally. The trusted and secure source includes Hugging Face Model Hub and the official GitHub repository of the model. Step S1203: construct an API interface for the artificial intelligence model to realize the online nature of the artificial intelligence model.

7. The method for automatically repairing code defects based on static code analysis tools and artificial intelligence according to claim 1, characterized in that: The step S130 includes: Step S1301, dividing the training data set constructed in step S110 into a training set, a validation set and a test set according to a certain ratio; Step S1302: Use the prepared training set data to optimize and adjust the artificial intelligence model, regularly evaluate the model performance on the validation set, and save the best checkpoint; Step S1303: Select an appropriate optimizer and learning rate scheduler, and combine gradient accumulation and mixed precision training to optimize the effect; Step S1304: Use the BLEU score or a custom code similarity index to evaluate the generation quality and obtain an evaluation score; Step S1305: Use the evaluation score as a supervisory feedback signal to adjust the model structure or training strategy, and continuously optimize and improve the generation quality and performance of the artificial intelligence model.

Images