Code review optimization method, system and equipment

Abstract

The invention is applicable to the technical field of software development, and provides a code review optimization method, which comprises the following steps of: analyzing a demand description to generate a demand analysis result; preprocessing the software code to obtain a static analysis result; running the software code, and dynamically analyzing the running software code to obtain a dynamic analysis result; carrying out fusion analysis on the demand analysis result, the static analysis result and the dynamic analysis result by adopting a deep learning model, and identifying vulnerability points of the software code; generating a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge; and performing risk assessment and vulnerability evolution prediction on the vulnerability points to obtain an analysis risk score and security threat points within a preset time, and generating a code optimization strategy. According to the method, optimization can be carried out according to actual problems encountered by developers in the development process, it is ensured that code modification directly aims at the specific problems, the optimization precision and efficiency are improved, meanwhile, the prediction function is achieved, and therefore the code safety is improved.

Description

Technical Field

[0001] The present application belongs to the field of software development technology, and in particular, relates to a code review optimization method, system and device. Background Art

[0002] In current software development practices, especially in highly complex projects such as game development, code analysis and optimization are still the core links to ensure software quality and security. However, although traditional code review tools, such as SonarQube and Checkmarx, have improved code quality to a certain extent through static code analysis and basic dynamic analysis, their limitations are becoming increasingly prominent in the face of growing code complexity and dynamically changing security threats.

[0003] Specifically, existing code review tools mainly focus on static analysis and some basic dynamic analysis, and usually rely on predefined rules and patterns. They are difficult to cope with complex and dynamically changing code environments and security threats. For example, static analysis cannot fully reflect the essence of the dynamic characteristics of the code at runtime, while dynamic analysis is difficult to provide in-depth insights into the global structure of the code. Both are difficult to achieve comprehensive and accurate analysis results, especially for complex projects. At the same time, existing code review methods lack the ability to predict possible problems in the future and in-depth security analysis, which leads to the code review and analysis results being not comprehensive and accurate enough to meet the needs of complex projects. Summary of the invention

[0004] The embodiments of the present application provide a code review optimization method, system and device, which can solve one of the above-mentioned prior art problems.

[0005] In a first aspect, an embodiment of the present application provides a code review optimization method, including:

[0006] Obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result;

[0007] Acquire software code to be reviewed, preprocess the software code to obtain a structured representation of the software code, perform static analysis on the structured representation, and obtain a static analysis result;

[0008] Running the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results;

[0009] A deep learning model is used to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify the vulnerabilities of the software code;

[0010] Generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0011] Based on the comprehensive vulnerability feature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time;

[0012] A code optimization strategy is generated based on the risk score and the security threat point.

[0013] Further, the obtaining of the software code to be reviewed, preprocessing the software code, obtaining a structured representation of the software code, performing static analysis on the structured representation, and obtaining a static analysis result includes:

[0014] The software code is parsed using natural language processing technology, and the software code is converted into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods;

[0015] Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes an abnormal behavior of the software code;

[0016] Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result;

[0017] Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized by using a clustering algorithm to obtain different problem types;

[0018] Association rule algorithms are used to prioritize different problem types and generate static analysis results.

[0019] Furthermore, the use of static analysis technology to perform preliminary analysis on the structured software code to obtain a first analysis result includes:

[0020] Based on the structured representation, obtaining a critical code path of the software code;

[0021] Based on the critical code path, symbolic execution technology is used to obtain abnormal behaviors of the software code by simulating execution paths under different inputs, wherein the abnormal behaviors include memory problems and deadlock problems;

[0022] Insert assertions in the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

[0023] Furthermore, obtaining a key code path of the software code based on the structured representation includes:

[0024] Using program slicing technology to obtain data dependencies and control dependencies of the software code;

[0025] Based on the data dependency and the control dependency, generate a logic unit of the software code;

[0026] A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

[0027] Further, the running of the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results include:

[0028] Use dynamic instrumentation technology to obtain the control flow and data flow of the software in real time during runtime and build a program behavior model;

[0029] According to the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, wherein the detection results include performance bottlenecks and security vulnerabilities;

[0030] For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs;

[0031] For the security vulnerability, determine the cause and impact scope of the security vulnerability through data flow analysis and taint analysis;

[0032] The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

[0033] Furthermore, the generation of a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge includes:

[0034] Acquire historical vulnerability data and expert knowledge in an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics;

[0035] The data fusion technology is used to fuse the vulnerability severity features and the exploit difficulty features to generate a comprehensive vulnerability feature library.

[0036] Furthermore, based on the comprehensive vulnerability feature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time, including:

[0037] Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector;

[0038] Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model, and obtain a risk score for each vulnerability point;

[0039] Based on the vulnerability feature vector, a vulnerability evolution model is constructed using a long short-term memory network. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk point within a preset time.

[0040] Furthermore, the generating of a code optimization strategy based on the risk score and the security threat point includes:

[0041] Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score;

[0042] The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

[0043] In a second aspect, an embodiment of the present application provides a code review optimization system, including:

[0044] The first processing module is used to obtain the software requirement description, parse the requirement description, and generate the requirement analysis result;

[0045] The second processing module is used to obtain the software code to be reviewed, pre-process the software code, obtain a structured representation of the software code, perform static analysis on the structured representation, and obtain a static analysis result;

[0046] The third processing module is used to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results;

[0047] The fourth processing module is used to use a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results and dynamic analysis results to identify the vulnerability points of the software code;

[0048] The fifth processing module is used to generate a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge;

[0049] The sixth processing module is used to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability feature library, and obtain analysis risk scores and security threat points within a preset time;

[0050] The seventh processing module is used to generate a code optimization strategy based on the risk score and the security threat point.

[0051] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned code review optimization method when executing the computer program.

[0052] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0053] A code review optimization method of the present application combines the developer's requirement description with the results of static analysis and dynamic analysis, so that the code review optimization method can be optimized according to the actual problems encountered by the developer during the development process, ensuring that code modifications are directly targeted at specific problems, thereby improving the accuracy and efficiency of optimization. In addition, the code review optimization method of the present application also has a prediction function, which can predict the evolution pattern of future vulnerabilities based on the obtained vulnerability points, and then can effectively prevent and resist a variety of known and unknown attacks, thereby improving code security. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0055] Figure 1 It is a flowchart of a code review optimization method provided by an embodiment of the present invention;

[0056] Figure 2 It is a structural diagram of a code review optimization system provided by an embodiment of the present invention;

[0057] Figure 3 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0059] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0060] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0061] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0062] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0063] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0064] See also Figure 1 As shown, the present invention is a code review optimization method, comprising the following steps:

[0065] S100, obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result;

[0066] In this embodiment, a requirement input interface, such as a Web form, is provided. When developers encounter bottlenecks during the development process and need to optimize the software code, the requirement description can be input through the requirement input interface. For example, if the database query efficiency during the runtime of the software code needs to be improved, the requirement description "improve database query efficiency" can be input through the Web form. In this way, the code review optimization method can be optimized according to the actual problems encountered by developers during the development process, ensuring that code modifications are directly targeted at specific problems, thereby improving the accuracy and efficiency of optimization.

[0067] In this embodiment, natural language processing tools such as spaCy or NLTK are used to perform word segmentation, part-of-speech tagging and syntactic analysis on the demand description, extract keywords, and perform cosine similarity matching on the extracted keywords and multiple demand types in the pre-built demand category knowledge base. If the similarity matching value between the keywords and the demand category is higher than the preset matching threshold, the above demand description is classified into the corresponding demand category, thereby generating a demand analysis structure, and then determining the optimization direction of the demand. It can be understood that a demand description can be classified into multiple demand categories, such as performance optimization, security enhancement, etc., and the determination of the demand category is related to the preset matching threshold. Taking the above-mentioned demand description "improving database query efficiency" as an example, spaCy is used to perform word segmentation and part-of-speech tagging on the demand, and the keywords "database", "query", and "efficiency" are extracted. The extracted keywords are matched with multiple demand categories in the demand category knowledge base in turn, and the matching degree with the "performance optimization" category is calculated to be 9, which is higher than the preset matching threshold of 8, so it is determined that the demand belongs to the performance optimization category.

[0068] S200, obtaining software code to be reviewed, preprocessing the software code to obtain a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result;

[0069] In this embodiment, the software code is preprocessed, including removing comments, formatting code, parsing syntax, etc., so as to convert the original code into a format that is easier to analyze and process. In addition, the structured representation of the software code enables the logical structure of the code, function call relationships, data flow and other information to be displayed in a clearer and more intuitive manner, which also facilitates subsequent code review.

[0070] In some embodiments, the step S200 includes:

[0071] The software code is parsed using natural language processing technology, and the software code is converted into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods;

[0072] Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes an abnormal behavior of the software code;

[0073] Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result;

[0074] Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized by using a clustering algorithm to obtain different problem types;

[0075] Association rule algorithms are used to prioritize different problem types and generate static analysis results.

[0076] In this embodiment, natural language processing technology is used to parse the software code, and through syntax analysis and semantic analysis, key elements in the code, such as variables, functions, classes, etc., are identified to construct an abstract syntax tree.

[0077] In this embodiment, static analysis technology is used to perform preliminary analysis on the structured representation of software code, and further processing is performed in combination with a pre-trained static analysis model to improve the accuracy of software code analysis. Specifically, firstly, static analysis technology is directly applied to the structured representation of the code, without actually running the code, to quickly and comprehensively identify potential abnormal behaviors, such as memory problems and deadlock problems, and then form a first analysis result. Subsequently, the first analysis result is input as a training indicator into the pre-trained static analysis model, and the static analysis model is trained to have a strong recognition ability, thereby improving the accuracy of abnormal behavior detection.

[0078] In this embodiment, the first analysis result is input into the static analysis model to obtain the second analysis result. Based on the second analysis result, the static problems of the software code are obtained, and the clustering algorithm is used to classify each static problem to obtain different problem types, and then the association rule algorithm is used to obtain different types of priorities, thereby enhancing the adaptability and flexibility of static analysis. As new problems continue to emerge and old problems are gradually resolved, the association rule algorithm can automatically adjust its association rules and priority allocation strategy, making the static analysis more suitable for the actual development scenario and improving the accuracy and effectiveness of the analysis.

[0079] In some embodiments, the using of static analysis technology to perform preliminary analysis on the structured software code to obtain a first analysis result includes:

[0080] Based on the structured representation, obtaining a critical code path of the software code;

[0081] Based on the critical code path, symbolic execution technology is used to obtain abnormal behaviors of the software code by simulating execution paths under different inputs, wherein the abnormal behaviors include memory problems and deadlock problems;

[0082] Insert assertions in the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

[0083] In this embodiment, by identifying and extracting the key code paths in the software code, the key code paths are the core of the program logic and the high-incidence area of ​​abnormal behavior, the redundancy and blindness of the analysis are effectively reduced. By using symbolic execution technology to conduct in-depth analysis on the key code paths, the efficiency and accuracy of problem discovery can be significantly improved. Specifically, the symbolic execution technology is used to simulate the execution path under different inputs, which can handle a large number of possible input situations. By simulating program execution, complex problems such as memory leaks and deadlocks that are difficult to trigger in conventional tests are discovered, thereby broadening the coverage of the test. It can also predict and locate potential abnormal behaviors without actually running the program, greatly improving the efficiency and depth of the test.

[0084] In addition, assertions are inserted into the code and key conditions in the simulation process are verified to ensure that the simulated execution behavior of the program meets expectations. Specifically, assertions, as a lightweight testing method, can set checkpoints at key points in the program's operation, and issue warnings immediately once the program state deviates from expectations. Secondly, by continuously monitoring the simulation process through invariants, it is possible to ensure that the program remains in a safe and stable state throughout the execution process, preventing erroneous behaviors caused by inconsistent states.

[0085] In summary, this method achieves comprehensive and in-depth analysis and testing of software code through a series of technical means such as structured representation, symbolic execution, assertion verification, and invariant monitoring, obtains the potential abnormal behavior of software code, and provides a basis for subsequent code optimization.

[0086] In some embodiments, obtaining a critical code path of the software code based on the structured representation includes:

[0087] Using program slicing technology to obtain data dependencies and control dependencies of the software code;

[0088] Based on the data dependency and the control dependency, generate a logic unit of the software code;

[0089] A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

[0090] In this embodiment, the software code represented by the structure is analyzed by program slicing technology, and the data dependency and control dependency of the software code are obtained through data flow analysis and control flow analysis. For example, a slicing algorithm based on PDG (Program Dependence Graph) is used to construct a program dependency graph of the software code, in which nodes represent statements and directed edges represent data dependencies and control dependencies between statements. According to the acquired data dependencies and control dependencies, a complete logic unit is generated. A program dependency graph is constructed according to the generated logic unit, a control flow graph is generated according to the program dependency graph, each node in the control flow graph is traversed, and the path expression is extracted for each node. According to the path expression, the symbolic execution technology is used to obtain the path constraint. The path constraint is input into the constraint solver to determine whether the constraint is satisfied. If the path constraint is satisfied, the path is determined to be a sensitive path and added to the sensitive path set. If the path constraint is not satisfied, the path is determined to be an insensitive path and is not considered. Repeat the execution until all nodes in the control flow graph are traversed, and a complete sensitive path set is finally obtained, wherein the sensitive path set includes all critical code paths.

[0091] In summary, by comprehensively using program slicing, path-sensitive analysis, and program dependency graph analysis techniques, we can fully understand the logical structure and execution behavior of complex codes, obtain key code paths, and provide strong support for code optimization and error detection.

[0092] S300, running the software code, performing dynamic analysis on the running software code, and obtaining a dynamic analysis result;

[0093] In some embodiments, the step S300 includes:

[0094] Use dynamic instrumentation technology to obtain the control flow and data flow of the software in real time during runtime and build a program behavior model;

[0095] According to the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, wherein the detection results include performance bottlenecks and security vulnerabilities;

[0096] For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs;

[0097] For the security vulnerability, determine the cause and impact scope of the security vulnerability through data flow analysis and taint analysis;

[0098] The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

[0099] In this embodiment, by adopting the dynamic plugging technology, the monitoring code is inserted into the key code path obtained in the above step S200, the function call sequence and parameter information in the software running process are captured in real time, and the control flow information is obtained. At the same time, the dynamic binary plugging framework such as Intel Pin is covered in the software code, and the data flow information of the program is obtained at the instruction level. The data flow information includes the definition and use of variables. The above control flow information and data flow information are input into the program behavior model, and the input control flow information and data flow information are abstracted and modeled by using formal methods such as priority state automata to obtain the behavior mode of the program in different states and its conversion relationship.

[0100] In this embodiment, a performance bottleneck feature library and a security vulnerability feature library are pre-built, wherein the performance bottleneck feature library contains common performance anti-patterns, such as frequent disk I / O, unnecessary memory copy, deadlock, etc., and each feature is described by a set of temporal logic expressions. The security vulnerability feature library contains common vulnerability types, such as buffer overflow, SQL injection, cross-site scripting, etc., and each vulnerability is characterized by a set of data flow patterns.

[0101] In this embodiment, the Boyer-Moore string matching algorithm is used to detect the program behavior model, detect subsequences that meet the performance bottleneck characteristics and security vulnerability characteristics, and calculate their frequency and location. For the suspected performance bottleneck detected, the code file and line number corresponding to the performance bottleneck are determined by analyzing the function call stack information. At the same time, resource occupancy analysis is used to count the CPU occupancy time, I / O waiting time, memory allocation and other indicators of the bottleneck function to determine the type and severity of the bottleneck. For the suspected security vulnerabilities detected, the taint analysis technology is used to track the propagation and use of user input data in the program to identify dangerous data flows.

[0102] In this embodiment, during the dynamic analysis process, the program's CPU usage, memory usage, I / O throughput and other resource usage, as well as the number of function calls, error logs and other execution information are continuously recorded at 1 second intervals. This information is stored in the MySQL database in timestamp order, and a multi-dimensional index is established to facilitate subsequent query and analysis.

[0103] In this embodiment, the dynamic analysis results include all performance bottlenecks and security vulnerabilities, their severity levels, occurrence locations, context information, etc., as well as control flow information and data flow information, to facilitate developers to obtain execution processes and data dependencies.

[0104] S400, using a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code;

[0105] In this embodiment, the static analysis results and the dynamic analysis results are fused based on the demand analysis results, and the weight of the demand analysis results is explicitly considered in the fusion process. For example, the vector representation of the demand analysis results is used as a major factor in the fusion process by adopting the weighted sum or weighted connection method. Specifically, before feature fusion, each demand category in the demand analysis results is converted into a unique code, and the codes of the demand analysis results are screened and weighted for relevance with the static analysis results and the dynamic analysis results. For example, if the demand analysis is about security enhancement, then security-related static anomalies will be given a higher weight. Similarly, the performance bottlenecks and security vulnerabilities in the dynamic analysis results are screened and weighted, giving priority to issues that match the demand analysis results. In addition, the numerical features of the static analysis results and the dynamic analysis results are standardized to ensure that their weights are consistent during the feature fusion process.

[0106] In this embodiment, the weights of the various problems in the static analysis results and the dynamic analysis results are dynamically adjusted according to the weights of the demand categories of the demand analysis results. For example, a multi-layer neural network is designed, in which the first layer receives the encoding of the demand analysis results, and the second layer receives the features of the static analysis results and the dynamic analysis results, and a comprehensive feature vector is generated by adjusting the weights and activation functions of the network layers.

[0107] In this embodiment, a deep learning model is trained using a training data set, where the training data set contains software codes with known vulnerabilities and their corresponding requirements analysis, static analysis, and dynamic analysis results; during the training process, the model parameters and optimizer configuration are continuously adjusted to improve the recognition accuracy and generalization ability of the model. The trained deep learning model is applied to the new software code analysis results to identify potential vulnerabilities. Specifically, the deep information model generates a comprehensive feature vector based on the input requirements analysis results, static analysis results, and dynamic analysis results, and then outputs each potential vulnerability point.

[0108] S500, generates a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0109] In some embodiments, the step S500 includes:

[0110] Acquire historical vulnerability data and expert knowledge in an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics;

[0111] The data fusion technology is used to fuse the vulnerability severity features and the exploit difficulty features to generate a comprehensive vulnerability feature library.

[0112] In this embodiment, historical vulnerability data and expert knowledge in the expert knowledge base are obtained, the data is preprocessed, key features such as vulnerability severity and difficulty of exploitation are extracted, and data fusion technology is used to fuse historical vulnerability data and expert knowledge to generate a comprehensive vulnerability feature library. Specifically, 1,000 vulnerability data that occurred in the past five years are obtained from channels such as the National Information Security Vulnerability Sharing Platform, and 500 vulnerability-related knowledge is extracted from the security expert knowledge base. These 1,500 data are preprocessed by cleaning and deduplication to extract 10 key features such as vulnerability severity, difficulty of exploitation, and scope of impact. Then a weighted average fusion algorithm is used, such as assigning a weight of 6 to historical vulnerability data and a weight of 4 to expert knowledge, to generate a comprehensive vulnerability feature library.

[0113] S600, based on the comprehensive vulnerability feature library, performing risk assessment and vulnerability evolution prediction on the vulnerability points, and obtaining analysis risk scores and security threat points within a preset time;

[0114] In this embodiment, by predicting the evolution of vulnerabilities, the code review optimization method also has a prediction function, which can predict the evolution pattern of future vulnerabilities based on the obtained vulnerability points, and then can effectively prevent and resist various known and unknown attacks, thereby improving code security.

[0115] In some embodiments, the above step S600 includes:

[0116] Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector;

[0117] Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model, and obtain a risk score for each vulnerability point;

[0118] Based on the vulnerability feature vector, a vulnerability evolution model is constructed using a long short-term memory network. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk point within a preset time.

[0119] In this embodiment, the vulnerability points are matched with the vulnerabilities in the neutralization feature library to obtain vulnerability features related to the vulnerability points, and a vulnerability feature vector is constructed using methods such as One-Hot encoding.

[0120] In this embodiment, based on the vulnerability feature vector, a machine learning algorithm such as a support vector machine, a decision tree, etc. is used to train a vulnerability risk assessment model, and the vulnerability feature vector of each vulnerability point is input into the trained risk assessment model to obtain a risk score for each vulnerability point.

[0121] In this embodiment, a time window partitioning method is used to segment historical vulnerability data to generate a time series vulnerability data set, and the vulnerabilities in the time series vulnerability data set are synchronously converted into vulnerability feature vectors; a long short-term memory network is used to input the corresponding vulnerability feature vectors in the time series vulnerability data set into the vulnerability evolution model for training, and the time series patterns and laws of vulnerability evolution are learned; in the model training process, the mean square error is used as the loss function, and the model parameters are optimized through the back propagation algorithm.

[0122] S700: Generate a code optimization strategy based on the risk score and the security threat point.

[0123] In some embodiments, the step S700 includes:

[0124] Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score;

[0125] The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

[0126] In this embodiment, a multidimensional reward function is constructed to evaluate the effect of code optimization. Specifically, each security threat point is quantified to obtain the threat level, and weights are assigned to the risk score and the threat level. A comprehensive score is calculated and obtained. The reinforcement learning model is trained based on the comprehensive score through the Q-learning or Policy Gradient algorithm to obtain the optimal code optimization strategy. Specifically, the reinforcement learning model selects an action in the predefined code reconstruction and optimization operation space according to the current code state, modifies the code, and the modified code is re-analyzed by static analysis and dynamic analysis to calculate the comprehensive score. The comprehensive score before and after the modification and the selected optimization operation are stored as an experience sample in the experience replay pool. A batch of experience samples are randomly sampled from the experience replay pool, and the parameters of the reinforcement learning model are updated through optimization algorithms such as gradient descent, so that the reinforcement learning model learns a better code optimization strategy. The above operation is repeated until the preset number of iterations is reached, and the optimized code and the changes in quality, performance and security indicators during the optimization process are output.

[0127] In this embodiment, the calculation weight is determined by the requirement category in the requirement analysis result. For example, for the requirement category of security enhancement, the risk score has a higher weight. For the requirement category of performance optimization that directly affects business continuity and user satisfaction, the weights of the risk score and security threat points are also different from the calculation weights of the requirement category of security enhancement. In a preferred embodiment, the calculation weight can be evaluated on the basis of the requirement category through expert review.

[0128] See also Figure 2 As shown, the present invention also provides a code review optimization system, the system comprising:

[0129] The first processing module 201 is used to obtain a software requirement description, parse the requirement description, and generate a requirement analysis result;

[0130] The second processing module 202 is used to obtain the software code to be reviewed, pre-process the software code, obtain the structured representation of the software code, perform static analysis on the structured representation, and obtain the static analysis result;

[0131] The third processing module 203 is used to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results;

[0132] The fourth processing module 204 is used to use a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results and dynamic analysis results to identify the vulnerability points of the software code;

[0133] The fifth processing module 205 is used to generate a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge;

[0134] The sixth processing module 206 is used to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability feature library, and obtain analysis risk scores and security threat points within a preset time;

[0135] The seventh processing module 207 is used to generate a code optimization strategy based on the risk score and the security threat point.

[0136] It is understandable that if Figure 1 The contents of the code review optimization method embodiment shown in the figure are applicable to the code review optimization system embodiment. The functions specifically implemented by the code review optimization system embodiment are similar to those in the example Figure 1 The code review optimization method embodiment shown is the same as that shown in FIG. Figure 1 The beneficial effects achieved by the code review optimization method embodiment shown are also the same.

[0137] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0138] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0139] See also Figure 3 As shown, an embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, a code review optimization method as described in any one of the above methods is implemented.

[0140] The computer device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of computer device 3 and does not constitute a limitation on computer device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0141] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0142] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 3. Further, the memory 302 may also include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0143] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the code review optimization method as described in any one of the above methods is implemented.

[0144] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / computer device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0145] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A code review optimization method, characterized in that: include: Obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result; Acquire software code to be reviewed, preprocess the software code to obtain a structured representation of the software code, perform static analysis on the structured representation, and obtain a static analysis result; Running the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results; A deep learning model is used to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify the vulnerabilities of the software code; Generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge; Based on the comprehensive vulnerability feature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time; A code optimization strategy is generated based on the risk score and the security threat point.

2. The method according to claim 1, characterized in that The obtaining of the software code to be reviewed, preprocessing the software code, obtaining a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result includes: The software code is parsed using natural language processing technology, and the software code is converted into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods; Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes an abnormal behavior of the software code; Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result; Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized by using a clustering algorithm to obtain different problem types; Association rule algorithms are used to prioritize different problem types and generate static analysis results.

3. The method according to claim 2, characterized in that The using of static analysis technology to perform preliminary analysis on the structured software code to obtain a first analysis result includes: Based on the structured representation, obtaining a critical code path of the software code; Based on the critical code path, symbolic execution technology is used to obtain abnormal behaviors of the software code by simulating execution paths under different inputs, wherein the abnormal behaviors include memory problems and deadlock problems; Insert assertions in the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

4. The method according to claim 3, characterized in that The obtaining a key code path of the software code based on the structured representation includes: Using program slicing technology to obtain data dependencies and control dependencies of the software code; Based on the data dependency and the control dependency, generate a logic unit of the software code; A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

5. The method according to claim 1, characterized in that The running of the software code, performing dynamic analysis on the running software code, and obtaining a dynamic analysis result includes: Use dynamic instrumentation technology to obtain the control flow and data flow of the software in real time during runtime and build a program behavior model; According to the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, wherein the detection results include performance bottlenecks and security vulnerabilities; For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs; For the security vulnerability, determine the cause and impact scope of the security vulnerability through data flow analysis and taint analysis; The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

6. The method according to claim 1, characterized in that The comprehensive vulnerability feature library is generated based on historical vulnerability data and expert knowledge, including: Acquire historical vulnerability data and expert knowledge in an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics; The data fusion technology is used to fuse the vulnerability severity features and the exploit difficulty features to generate a comprehensive vulnerability feature library.

7. The method according to claim 6, characterized in that Based on the comprehensive vulnerability feature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time, including: Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector; Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model, and obtain a risk score for each vulnerability point; Based on the vulnerability feature vector, a vulnerability evolution model is constructed using a long short-term memory network. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk point within a preset time.

8. The method according to claim 7, characterized in that The generating a code optimization strategy based on the risk score and the security threat point includes: Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score; The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

9. A code review optimization system, characterized in that: include: The first processing module is used to obtain the software requirement description, parse the requirement description, and generate the requirement analysis result; The second processing module is used to obtain the software code to be reviewed, pre-process the software code, obtain a structured representation of the software code, perform static analysis on the structured representation, and obtain a static analysis result; The third processing module is used to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results; The fourth processing module is used to use a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results and dynamic analysis results to identify the vulnerability points of the software code; The fifth processing module is used to generate a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge; The sixth processing module is used to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability feature library, and obtain analysis risk scores and security threat points within a preset time; The seventh processing module is used to generate a code optimization strategy based on the risk score and the security threat point.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images