Code review optimization method, system and device

Abstract

This application is applicable to the field of software development technology and provides a code review optimization method, including: parsing the requirement description to generate the requirement analysis results; preprocessing the software code to obtain the static analysis results; running the software code, dynamically analyzing the running software code to obtain the dynamic analysis results; using a deep learning model to integrate the requirement analysis results, static analysis results and dynamic analysis results to identify the vulnerabilities of the software code; generating a comprehensive vulnerability feature library based on historical vulnerability data and expert knowledge; performing risk assessment and vulnerability evolution prediction on the vulnerability points to obtain the analysis risk score and security threat points within a preset time, and generating a code optimization strategy. This application can optimize according to the actual problems encountered by developers during the development process, ensure that code modifications are directly targeted at specific problems, improve the accuracy and efficiency of optimization, and at the same time have a predictive function, thereby improving code security.

Description

Technical Field

[0001] The present application belongs to the field of software development technology, and in particular relates to a code review optimization method, system and device. Background Art

[0002] In current software development practices, especially in highly complex projects like game development, code analysis and optimization remain core components for ensuring software quality and security. However, while traditional code review tools like SonarQube and Checkmarx improve code quality to a certain extent through static code analysis and basic dynamic analysis, their limitations are becoming increasingly apparent in the face of growing code complexity and dynamically changing security threats.

[0003] Specifically, existing code review tools mainly focus on static analysis and some basic dynamic analysis, usually relying on predefined rules and patterns, and are unable to cope with complex, dynamically changing code environments and security threats. For example, static analysis cannot fully reflect the essence of the dynamic characteristics of the code at runtime, while dynamic analysis is difficult to provide in-depth insights into the global structure of the code. Both are difficult to achieve comprehensive and accurate analysis results, especially for complex projects. At the same time, existing code review methods lack the ability to predict possible problems in the future and in-depth security analysis, which leads to the code review and analysis results being not comprehensive and accurate enough, making it difficult to meet the needs of complex projects. Summary of the Invention

[0004] The embodiments of the present application provide a code review optimization method, system, and device, which can solve one of the above-mentioned problems in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a code review optimization method, comprising:

[0006] Obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result;

[0007] Obtaining software code to be reviewed, preprocessing the software code to obtain a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result;

[0008] Running the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results;

[0009] Using a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code;

[0010] Generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0011] Based on the comprehensive vulnerability signature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time;

[0012] A code optimization strategy is generated based on the risk score and the security threat point.

[0013] Furthermore, the obtaining of the software code to be reviewed, preprocessing the software code to obtain a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result includes:

[0014] Parsing the software code using natural language processing technology, and converting the software code into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods;

[0015] Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes abnormal behavior of the software code;

[0016] Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result;

[0017] Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized using a clustering algorithm to obtain different problem types;

[0018] Association rule algorithms are used to prioritize different problem types and generate static analysis results.

[0019] Furthermore, the static analysis technology is used to perform a preliminary analysis on the structured software code to obtain a first analysis result, including:

[0020] Based on the structured representation, obtaining a critical code path of the software code;

[0021] Based on the critical code path, symbolic execution technology is used to simulate the execution path under different inputs to obtain abnormal behaviors of the software code, wherein the abnormal behaviors include memory problems and deadlock problems;

[0022] Insert assertions into the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

[0023] Furthermore, obtaining a key code path of the software code based on the structured representation includes:

[0024] Using program slicing technology to obtain data dependencies and control dependencies of the software code;

[0025] generating a logic unit of the software code based on the data dependency and the control dependency;

[0026] A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

[0027] Furthermore, the running of the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results include:

[0028] Use dynamic instrumentation technology to obtain the control flow and data flow of software in real time during runtime and build a program behavior model;

[0029] Based on the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, which include performance bottlenecks and security vulnerabilities;

[0030] For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs;

[0031] For the security vulnerability, determine the cause and impact of the security vulnerability through data flow analysis and taint analysis;

[0032] The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

[0033] Furthermore, the generation of a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge includes:

[0034] Acquire historical vulnerability data and expert knowledge from an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics;

[0035] Data fusion technology is used to fuse the vulnerability severity features and the exploit difficulty features to generate a comprehensive vulnerability feature library.

[0036] Furthermore, based on the comprehensive vulnerability signature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time, including:

[0037] Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector;

[0038] Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model to obtain a risk score for each vulnerability point;

[0039] Based on the vulnerability feature vector, a long short-term memory network is used to construct a vulnerability evolution model. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk points within a preset time.

[0040] Furthermore, generating a code optimization strategy based on the risk score and the security threat point includes:

[0041] Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score;

[0042] The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

[0043] In a second aspect, an embodiment of the present application provides a code review optimization system, including:

[0044] The first processing module is used to obtain the software requirement description, parse the requirement description, and generate the requirement analysis result;

[0045] The second processing module is configured to obtain software code to be reviewed, pre-process the software code to obtain a structured representation of the software code, and perform static analysis on the structured representation to obtain a static analysis result.

[0046] A third processing module is configured to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results;

[0047] The fourth processing module is configured to use a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code;

[0048] The fifth processing module is used to generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0049] The sixth processing module is used to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability feature library, and obtain an analysis risk score and security threat points within a preset time;

[0050] The seventh processing module is configured to generate a code optimization strategy based on the risk score and the security threat point.

[0051] In a third aspect, an embodiment of the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned code review optimization method when executing the computer program.

[0052] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0053] A code review optimization method of the present application combines the developer's requirement description with the results of static analysis and dynamic analysis, so that the code review optimization method can be optimized according to the actual problems encountered by the developer during the development process, ensuring that code modifications are directly targeted at specific problems, thereby improving the accuracy and efficiency of optimization. In addition, the code review optimization method of the present application also has a prediction function, which can predict the evolution pattern of future vulnerabilities based on the obtained vulnerability points, and thus can effectively prevent and resist a variety of known and unknown attacks, thereby improving code security. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0055] Figure 1 This is a flowchart of a code review optimization method provided by one embodiment of the present invention;

[0056] Figure 2 This is a schematic diagram of the structure of a code review optimization system provided by one embodiment of the present invention;

[0057] Figure 3 It is a structural diagram of the computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0059] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0060] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0061] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0062] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0063] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0064] See also Figure 1 As shown, the present invention is a code review optimization method, comprising the following steps:

[0065] S100, obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result;

[0066] In this embodiment, a requirement input interface, such as a Web form, is provided. When developers encounter bottlenecks during the development process and need to optimize the software code, they can enter the requirement description through the requirement input interface. For example, if the database query efficiency during the runtime of the software code needs to be improved, the requirement description "improve database query efficiency" can be entered through the Web form. In this way, the code review optimization method can be optimized according to the actual problems encountered by developers during the development process, ensuring that code modifications are directly targeted at specific problems, thereby improving the accuracy and efficiency of optimization.

[0067] In this embodiment, natural language processing tools such as spaCy or NLTK are used to perform word segmentation, part-of-speech tagging and syntactic analysis on the requirement description to extract keywords. The extracted keywords are matched with multiple requirement types in the pre-built requirement category knowledge base by cosine similarity. If the similarity matching value between the keywords and the requirement category is higher than the preset matching threshold, the requirement description is classified into the corresponding requirement category, thereby generating a requirement analysis structure and determining the optimization direction of the requirement. It can be understood that a requirement description can be classified into multiple requirement categories, such as performance optimization, security enhancement, etc. The determination of the requirement category is related to the preset matching threshold. Taking the above-mentioned requirement description "improve database query efficiency" as an example, spaCy is used to perform word segmentation and part-of-speech tagging on the requirement, and the keywords "database", "query" and "efficiency" are extracted. The extracted keywords are matched with multiple requirement categories in the requirement category knowledge base in turn, and the matching degree with the "performance optimization" category is calculated to be 9, which is higher than the preset matching threshold of 8. Therefore, it is determined that the requirement belongs to the performance optimization category.

[0068] S200: Obtain software code to be reviewed, preprocess the software code to obtain a structured representation of the software code, and perform static analysis on the structured representation to obtain a static analysis result;

[0069] In this embodiment, the software code is preprocessed, including removing comments, formatting the code, parsing the syntax, etc., so that the original code is converted into a format that is easier to analyze and process. In addition, the structured representation of the software code allows the code's logical structure, function call relationship, data flow and other information to be displayed in a clearer and more intuitive manner, which also facilitates subsequent code review.

[0070] In some embodiments, step S200 includes:

[0071] Parsing the software code using natural language processing technology, and converting the software code into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods;

[0072] Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes abnormal behavior of the software code;

[0073] Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result;

[0074] Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized using a clustering algorithm to obtain different problem types;

[0075] Association rule algorithms are used to prioritize different problem types and generate static analysis results.

[0076] In this embodiment, natural language processing technology is used to parse the software code, and through syntax analysis and semantic analysis, key elements in the code, such as variables, functions, classes, etc., are identified to construct an abstract syntax tree.

[0077] In this embodiment, static analysis techniques are used to perform a preliminary analysis of the structured representation of software code, and further processing is performed in conjunction with a pre-trained static analysis model to improve the accuracy of the software code analysis. Specifically, static analysis techniques are first applied directly to the structured representation of the code, without actually running the code, to quickly and comprehensively identify potential abnormal behaviors, such as memory issues and deadlocks, thereby forming a first analysis result. Subsequently, this first analysis result is input into the pre-trained static analysis model as a training indicator, training the static analysis model to provide it with strong recognition capabilities and thus improve the accuracy of abnormal behavior detection.

[0078] In this embodiment, the first analysis result is input into the static analysis model to obtain a second analysis result. Based on the second analysis result, static issues in the software code are identified. A clustering algorithm is used to classify each static issue into different issue types. An association rule algorithm is then used to determine different priority levels, enhancing the adaptability and flexibility of static analysis. As new issues emerge and existing ones are gradually resolved, the association rule algorithm can automatically adjust its association rules and priority allocation strategy, making the static analysis more tailored to actual development scenarios and improving the accuracy and effectiveness of the analysis.

[0079] In some embodiments, performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result includes:

[0080] Based on the structured representation, obtaining a critical code path of the software code;

[0081] Based on the critical code path, symbolic execution technology is used to simulate the execution path under different inputs to obtain abnormal behaviors of the software code, wherein the abnormal behaviors include memory problems and deadlock problems;

[0082] Insert assertions into the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

[0083] In this embodiment, by identifying and extracting critical code paths in the software code, which are the core of program logic and high-incidence areas of abnormal behavior, the redundancy and blindness of analysis are effectively reduced. By using symbolic execution technology to conduct in-depth analysis of critical code paths, the efficiency and accuracy of problem discovery can be significantly improved. Specifically, symbolic execution technology is used to simulate execution paths under different inputs, which can handle a large number of possible input conditions. By simulating program execution, complex problems such as memory leaks and deadlocks that are difficult to trigger in conventional testing can be discovered, thereby broadening the coverage of the test. It can also predict and locate potential abnormal behaviors without actually running the program, greatly improving the efficiency and depth of testing.

[0084] Furthermore, assertions are inserted into the code and key conditions in the simulation process are verified to ensure that the program's simulated execution behavior meets expectations. Specifically, assertions, as a lightweight testing method, can set checkpoints at key points in the program's execution, issuing immediate warnings if the program state deviates from expectations. Secondly, continuous monitoring of the simulation process through invariants ensures that the program remains in a safe and stable state throughout its execution, preventing erroneous behavior caused by inconsistent states.

[0085] In summary, this method achieves comprehensive and in-depth analysis and testing of software code through a series of technical means such as structured representation, symbolic execution, assertion verification, and invariant monitoring, obtains the potential abnormal behavior of software code, and provides a basis for subsequent code optimization.

[0086] In some embodiments, obtaining a critical code path of the software code based on the structured representation includes:

[0087] Using program slicing technology to obtain data dependencies and control dependencies of the software code;

[0088] generating a logic unit of the software code based on the data dependency and the control dependency;

[0089] A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

[0090] In this embodiment, program slicing technology is used to analyze structured software code. Through data flow analysis and control flow analysis, the data dependencies and control dependencies of the software code are obtained. For example, a slicing algorithm based on the PDG (Program Dependence Graph) is used to construct a program dependency graph of the software code, where nodes represent statements and directed edges represent data dependencies and control dependencies between statements. Based on the obtained data dependencies and control dependencies, a complete logical unit is generated. A program dependency graph is constructed based on the generated logical units, and a control flow graph is generated based on the program dependency graph. Each node in the control flow graph is traversed, and for each node, the path expression is extracted. Based on the path expression, symbolic execution technology is used to obtain path constraints. The path constraints are input into a constraint solver to determine whether the constraints are satisfied. If the path constraints are satisfied, the path is determined to be a sensitive path and added to the sensitive path set. If the path constraints are not satisfied, the path is determined to be an insensitive path and is not considered. The execution is repeated until all nodes in the control flow graph are traversed, and a complete sensitive path set is obtained, where the sensitive path set includes all critical code paths.

[0091] In summary, by comprehensively applying program slicing, path-sensitive analysis, and program dependency graph analysis techniques, we can fully understand the logical structure and execution behavior of complex code, obtain critical code paths, and provide strong support for code optimization and error detection.

[0092] S300: Run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results;

[0093] In some embodiments, step S300 includes:

[0094] Use dynamic instrumentation technology to obtain the control flow and data flow of software in real time during runtime and build a program behavior model;

[0095] Based on the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, which include performance bottlenecks and security vulnerabilities;

[0096] For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs;

[0097] For the security vulnerability, determine the cause and impact of the security vulnerability through data flow analysis and taint analysis;

[0098] The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

[0099] In this embodiment, dynamic instrumentation technology is employed to insert monitoring code into the critical code paths obtained in step S200 above, capturing function call sequences and parameter information during software execution in real time and obtaining control flow information. Simultaneously, a dynamic binary instrumentation framework, such as Intel Pin, is overlaid into the software code to obtain the program's data flow information at the instruction level. This data flow information includes variable definitions and usage. This control flow and data flow information is then input into a program behavior model. Formal methods, such as priority state automata, are then used to abstract and model the input control flow and data flow information, thereby obtaining the program's behavior patterns and transition relationships under different states.

[0100] In this embodiment, a performance bottleneck signature library and a security vulnerability signature library are pre-built. The performance bottleneck signature library contains common performance anti-patterns, such as frequent disk I / O, unnecessary memory copies, and deadlocks. Each signature is described by a set of temporal logic expressions. The security vulnerability signature library contains common vulnerability types, such as buffer overflows, SQL injections, and cross-site scripting. Each vulnerability is characterized by a set of data flow patterns.

[0101] In this embodiment, the Boyer-Moore string matching algorithm is used to detect the program behavior model, detect subsequences that meet the characteristics of performance bottlenecks and security vulnerabilities, and calculate their frequency and location. For suspected performance bottlenecks detected, the function call stack information is analyzed to determine the corresponding code file and line number when the performance bottleneck occurs. At the same time, resource occupancy analysis is used to count indicators such as the CPU occupancy time, I / O waiting time, and memory allocation of the bottleneck function to determine the type and severity of the bottleneck. For suspected security vulnerabilities detected, taint analysis technology is used to track the propagation and use of user input data in the program and identify dangerous data flows.

[0102] In this example, during the dynamic analysis process, the program's resource usage, such as CPU usage, memory usage, and I / O throughput, as well as execution information such as function call counts and error logs, are continuously recorded at one-second intervals. This information is stored in a MySQL database in timestamp order, and a multidimensional index is created to facilitate subsequent query and analysis.

[0103] In this embodiment, the dynamic analysis results include all performance bottlenecks and security vulnerabilities, their severity levels, occurrence locations, context information, etc., as well as control flow information and data flow information, to facilitate developers in obtaining execution processes and data dependencies.

[0104] S400: Using a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code;

[0105] In this embodiment, the static analysis results and the dynamic analysis results are fused based on the demand analysis results, and the weight of the demand analysis results is explicitly considered in the fusion process. For example, the vector representation of the demand analysis results is used as a major factor in the fusion process by adopting the weighted sum or weighted connection method. Specifically, before feature fusion, each demand category in the demand analysis results is converted into a unique code, and the codes of the demand analysis results are screened and weighted for relevance with the static analysis results and the dynamic analysis results. For example, if the demand analysis is about security enhancement, then static anomalies related to security will be given a higher weight. Similarly, the performance bottlenecks and security vulnerabilities in the dynamic analysis results are screened and weighted, giving priority to issues that match the demand analysis results. In addition, the numerical features of the static analysis results and the dynamic analysis results are standardized to ensure that their weights are consistent during the feature fusion process.

[0106] In this embodiment, the weights of the various questions in the static and dynamic analysis results are dynamically adjusted based on the weights of the requirement categories in the requirements analysis results. For example, a multi-layer neural network is designed, where the first layer receives the encoding of the requirements analysis results, and the second layer receives the features of the static and dynamic analysis results. A comprehensive feature vector is generated by adjusting the weights and activation functions of the network layers.

[0107] In this embodiment, a deep learning model is trained using a training dataset containing software code with known vulnerabilities and its corresponding requirements analysis, static analysis, and dynamic analysis results. During the training process, model parameters and optimizer configurations are continuously adjusted to improve the model's recognition accuracy and generalization capabilities. The trained deep learning model is then applied to new software code analysis results to identify potential vulnerabilities. Specifically, the deep information model generates a comprehensive feature vector based on the input requirements analysis results, static analysis results, and dynamic analysis results, and then outputs each potential vulnerability.

[0108] S500, generates a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0109] In some embodiments, step S500 includes:

[0110] Acquire historical vulnerability data and expert knowledge from an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics;

[0111] Data fusion technology is used to fuse the vulnerability severity features and the exploit difficulty features to generate a comprehensive vulnerability feature library.

[0112] In this embodiment, historical vulnerability data and expert knowledge in the expert knowledge base are obtained, the data is pre-processed, key features such as vulnerability severity and difficulty of exploitation are extracted, and data fusion technology is used to fuse historical vulnerability data and expert knowledge to generate a comprehensive vulnerability feature library. Specifically, 1,000 vulnerability data that occurred in the past five years are obtained from channels such as the National Information Security Vulnerability Sharing Platform, and 500 vulnerability-related knowledge are extracted from the security expert knowledge base. These 1,500 data are pre-processed by cleaning and deduplication to extract 10 key features such as vulnerability severity, difficulty of exploitation, and scope of impact. Then, a weighted average fusion algorithm is used, such as assigning a weight of 6 to historical vulnerability data and a weight of 4 to expert knowledge, to generate a comprehensive vulnerability feature library.

[0113] S600: Based on the comprehensive vulnerability feature library, perform risk assessment and vulnerability evolution prediction on the vulnerability points to obtain analysis risk scores and security threat points within a preset time;

[0114] In this embodiment, by predicting vulnerability evolution, the code review optimization method also has a prediction function, which can predict the evolution pattern of future vulnerabilities based on the obtained vulnerability points, and thus can effectively prevent and resist various known and unknown attacks, thereby improving code security.

[0115] In some embodiments, the above step S600 includes:

[0116] Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector;

[0117] Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model to obtain a risk score for each vulnerability point;

[0118] Based on the vulnerability feature vector, a long short-term memory network is used to construct a vulnerability evolution model. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk points within a preset time.

[0119] In this embodiment, the vulnerability points are matched with the vulnerabilities in the neutralization feature library to obtain vulnerability features related to the vulnerability points, and a vulnerability feature vector is constructed using methods such as One-Hot encoding.

[0120] In this embodiment, based on the vulnerability feature vector, a machine learning algorithm such as a support vector machine and a decision tree is used to train a vulnerability risk assessment model, and the vulnerability feature vector of each vulnerability point is input into the trained risk assessment model to obtain a risk score for each vulnerability point.

[0121] In this embodiment, a time window partitioning method is used to segment historical vulnerability data to generate a time series vulnerability dataset, and the vulnerabilities in the time series vulnerability dataset are synchronously converted into vulnerability feature vectors. A long short-term memory network is used to input the corresponding vulnerability feature vectors in the time series vulnerability dataset into a vulnerability evolution model for training to learn the time series patterns and laws of vulnerability evolution. During the model training process, a loss function such as mean square error is used, and the model parameters are optimized through a back propagation algorithm.

[0122] S700: Generate a code optimization strategy based on the risk score and the security threat point.

[0123] In some embodiments, step S700 includes:

[0124] Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score;

[0125] The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

[0126] In this embodiment, a multi-dimensional reward function is constructed to evaluate the effectiveness of code optimization. Specifically, each security threat point is quantified to obtain the threat level, and weights are assigned to the risk score and threat level. A comprehensive score is calculated and trained based on the comprehensive score using Q-learning or Policy Gradient algorithms to obtain the optimal code optimization strategy. Specifically, the reinforcement learning model selects an action in the predefined code refactoring and optimization operation space based on the current code state, modifies the code, and the modified code is re-analyzed by static and dynamic analysis to calculate a comprehensive score. The comprehensive score before and after the modification and the selected optimization operation are used as an experience sample and stored in the experience replay pool. A batch of experience samples are randomly sampled from the experience replay pool, and the parameters of the reinforcement learning model are updated using optimization algorithms such as gradient descent, so that the reinforcement learning model learns a better code optimization strategy. The above operation is repeated until the preset number of iterations is reached, and the optimized code and the changes in quality, performance, and security indicators during the optimization process are output.

[0127] In this embodiment, the calculation weight is determined by the requirement category in the requirements analysis results. For example, for a requirement category of security enhancement, the risk score has a higher weight. For the performance optimization requirement category, which directly affects business continuity and user satisfaction, the weights of the risk score and security threat points are also different from the calculation weights of the security enhancement requirement category. In a preferred embodiment, the calculation weight can be evaluated based on the requirement category through expert review.

[0128] See also Figure 2 As shown, the present invention also provides a code review optimization system, the system comprising:

[0129] The first processing module 201 is used to obtain a software requirement description, parse the requirement description, and generate a requirement analysis result;

[0130] The second processing module 202 is configured to obtain software code to be reviewed, pre-process the software code to obtain a structured representation of the software code, and perform static analysis on the structured representation to obtain a static analysis result.

[0131] The third processing module 203 is used to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results;

[0132] The fourth processing module 204 is configured to use a deep learning model to perform a fusion analysis on the demand analysis results, the static analysis results, and the dynamic analysis results to identify vulnerabilities in the software code;

[0133] The fifth processing module 205 is used to generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge;

[0134] The sixth processing module 206 is configured to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability signature library, and obtain an analysis risk score and security threat points within a preset time;

[0135] The seventh processing module 207 is configured to generate a code optimization strategy based on the risk score and the security threat point.

[0136] It is understandable that if Figure 1 The contents of the code review optimization method embodiment shown in the figure are applicable to the code review optimization system embodiment. The functions specifically implemented by the code review optimization system embodiment are similar to those in the example shown in the figure. Figure 1 The code review optimization method embodiment shown is the same as that shown in FIG. Figure 1 The beneficial effects achieved by the illustrated code review optimization method embodiment are also the same.

[0137] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0138] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0139] See also Figure 3 As shown, an embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored on the memory 302. When the computer program 303 is executed on the processor 301, a code review optimization method as described in any one of the above methods is implemented.

[0140] The computer device 3 may be a desktop computer, a notebook computer, a PDA, a cloud server or other computing devices. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that Figure 3 This is merely an example of the computer device 3 and does not constitute a limitation on the computer device 3 . The computer device 3 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the computer device 3 may also include input and output devices, network access devices, etc.

[0141] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0142] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. equipped on the computer device 3. Furthermore, the memory 302 may include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 302 may also be used to temporarily store data that has been output or is about to be output.

[0143] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the code review optimization method as described in any one of the above methods is implemented.

[0144] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device capable of carrying computer program code to a camera / computer device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard drive, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0145] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A code review optimization method, characterized in that: include: Obtaining a software requirement description, parsing the requirement description, and generating a requirement analysis result; Obtaining software code to be reviewed, preprocessing the software code to obtain a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result; Running the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results; Using a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code; Generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge; Based on the comprehensive vulnerability signature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time; generating a code optimization strategy based on the risk score and the security threat point; The generation of a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge includes: Acquire historical vulnerability data and expert knowledge from an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics; Adopting data fusion technology, the vulnerability severity feature and the exploit difficulty feature are integrated to generate a comprehensive vulnerability feature library; The fusion analysis of the demand analysis results, static analysis results and dynamic analysis results includes: Convert each requirement category in the requirements analysis results into a unique code, and screen and weight the correlation between the codes of the requirements analysis results and the static analysis results and dynamic analysis results; The weights of each problem in the static analysis results and the dynamic analysis results are dynamically adjusted according to the weights of the demand categories in the demand analysis results to generate a comprehensive feature vector.

2. The method according to claim 1, wherein The step of obtaining the software code to be reviewed, preprocessing the software code, obtaining a structured representation of the software code, and performing static analysis on the structured representation to obtain a static analysis result includes: Parsing the software code using natural language processing technology, and converting the software code into a structured representation of an abstract syntax tree through lexical analysis and syntax analysis methods; Performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result, wherein the first analysis result includes abnormal behavior of the software code; Inputting the first analysis result into a pre-trained static analysis model for training, so that the static analysis model outputs a second analysis result; Based on the first analysis result and the second analysis result, static problems of the software code are obtained, and the static problems are classified and summarized using a clustering algorithm to obtain different problem types; Association rule algorithms are used to prioritize different problem types and generate static analysis results.

3. The method according to claim 2, wherein The step of performing a preliminary analysis on the structured software code using a static analysis technique to obtain a first analysis result includes: Based on the structured representation, obtaining a critical code path of the software code; Based on the critical code path, symbolic execution technology is used to simulate the execution path under different inputs to obtain abnormal behaviors of the software code, wherein the abnormal behaviors include memory problems and deadlock problems; Insert assertions into the code to verify key conditions in the simulation process and continuously monitor the simulation process through invariants.

4. The method according to claim 3, wherein Obtaining a key code path of the software code based on the structured representation includes: Using program slicing technology to obtain data dependencies and control dependencies of the software code; generating a logic unit of the software code based on the data dependency and the control dependency; A sensitive path analysis method is adopted to construct a program dependency graph based on the logic unit, and a critical code path is obtained based on the program dependency graph.

5. The method according to claim 1, wherein The running of the software code, performing dynamic analysis on the running software code, and obtaining dynamic analysis results includes: Use dynamic instrumentation technology to obtain the control flow and data flow of software in real time during runtime and build a program behavior model; Based on the pre-built performance bottleneck feature library and security vulnerability feature library, a pattern matching algorithm is used to perform real-time detection on the program behavior model to obtain detection results, which include performance bottlenecks and security vulnerabilities; For the performance bottleneck, abnormal code location information is obtained through call stack analysis and resource usage analysis, where the abnormal code location information is the code location where the performance bottleneck occurs; For the security vulnerability, determine the cause and impact of the security vulnerability through data flow analysis and taint analysis; The operation log of the software is recorded in real time, and a dynamic analysis result is generated based on the operation log, the performance bottleneck, the security vulnerability and the abnormal code location information.

6. The method according to claim 1, wherein Based on the comprehensive vulnerability signature library, risk assessment and vulnerability evolution prediction are performed on the vulnerability points to obtain analysis risk scores and security threat points within a preset time, including: Extracting vulnerability features from the vulnerability points according to the comprehensive vulnerability feature library and constructing a vulnerability feature vector; Using a machine learning algorithm to build a vulnerability risk assessment model, input the vulnerability feature vector into the vulnerability risk assessment model to obtain a risk score for each vulnerability point; Based on the vulnerability feature vector, a long short-term memory network is used to construct a vulnerability evolution model. The vulnerability evolution model is used to learn the time evolution pattern of the vulnerability and predict the security risk points within a preset time.

7. The method according to claim 6, wherein Generating a code optimization strategy based on the risk score and the security threat point includes: Calculating the risk score and the security threat point based on preset calculation weights to obtain a comprehensive score; The comprehensive score, the risk score and the security threat point are input into a reinforcement learning algorithm for iterative training, so that the reinforcement information algorithm outputs a code optimization strategy.

8. A code review optimization system, characterized in that: include: The first processing module is used to obtain the software requirement description, parse the requirement description, and generate the requirement analysis result; The second processing module is configured to obtain software code to be reviewed, pre-process the software code to obtain a structured representation of the software code, and perform static analysis on the structured representation to obtain a static analysis result. A third processing module is configured to run the software code, perform dynamic analysis on the running software code, and obtain dynamic analysis results; The fourth processing module is configured to use a deep learning model to perform a fusion analysis on the demand analysis results, static analysis results, and dynamic analysis results to identify vulnerabilities in the software code; The fifth processing module is used to generate a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge; The sixth processing module is used to perform risk assessment and vulnerability evolution prediction on the vulnerability points based on the comprehensive vulnerability feature library, and obtain an analysis risk score and security threat points within a preset time; A seventh processing module: configured to generate a code optimization strategy based on the risk score and the security threat point; The generation of a comprehensive vulnerability signature library based on historical vulnerability data and expert knowledge includes: Acquire historical vulnerability data and expert knowledge from an expert knowledge base, preprocess the historical vulnerability data and the expert knowledge, and obtain vulnerability severity characteristics and exploitation difficulty characteristics; Adopting data fusion technology, the vulnerability severity feature and the exploit difficulty feature are integrated to generate a comprehensive vulnerability feature library; The fusion analysis of the demand analysis results, static analysis results and dynamic analysis results includes: Convert each requirement category in the requirements analysis results into a unique code, and screen and weight the correlation between the codes of the requirements analysis results and the static analysis results and dynamic analysis results; The weights of each problem in the static analysis results and the dynamic analysis results are dynamically adjusted according to the weights of the demand categories in the demand analysis results to generate a comprehensive feature vector.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images