Auxiliary code review method and system based on large language model

Abstract

The invention discloses an auxiliary code review method and system based on a large language model, and the method comprises the steps: analyzing a submitted code file based on a static analysis technology and an abstract syntax tree AST extraction tool, and extracting key elements; reviewing the code through a pre-constructed company internal and external knowledge base by relying on a knowledge graph technology to obtain a reviewing result; performing context analysis on the code by adopting a large language model to obtain an analysis result; integrating the review result and the analysis result, and generating a review report through NLP; a containerization technology is adopted to be integrated with plug-ins of mainstream development tools, and private deployment is supported. According to the method, the efficiency, accuracy and safety of code review can be greatly improved, the workload of manual review is reduced, and automation and intelligentization of the code review process are realized.

Description

Technical Field

[0001] The present invention relates to the field of code review, and in particular to an auxiliary code review method and system based on a large language model. Background Art

[0002] In the process of modern software development, code review is one of the core links to ensure code quality, improve development efficiency, and reduce security vulnerabilities. Through code review, the development team can identify potential problems in the code, such as logical errors, performance bottlenecks, security vulnerabilities, etc., and improve the consistency and maintainability of the code through peer review. However, the traditional code review process mainly relies on manual operations, and there are several key problems:

[0003] 1) Inefficiency and time-consuming: As the amount and complexity of code grows, manual review becomes more and more time-consuming and inefficient. Developers need to analyze the code line by line and give feedback after discovering problems, which often delays the development progress.

[0004] 2) Inconsistent review standards: Different reviewers will conduct code reviews based on their own experience and habits, resulting in inconsistent review standards. It is often difficult to maintain consistency and coherence in review results between different projects and teams.

[0005] 3) Increased security risks: In complex projects, security vulnerabilities in the code or code segments that do not comply with industry standards may be overlooked, leading to security risks in the future and may even cause serious problems such as information leakage.

[0006] 1. Disadvantages of the prior art:

[0007] 1) Inefficiency:

[0008] Existing code review methods mainly rely on manual review or simple static code analysis tools, both of which are inefficient. Manual review takes a lot of time and effort, especially when dealing with large-scale code bases, the workload of reviewers is huge. Although static analysis tools can improve efficiency to a certain extent, they are often unable to cope with complex code structures and business logic due to their limited rule bases.

[0009] 2). Inconsistent review results:

[0010] Different reviewers have different understandings of the code, resulting in inconsistent review standards and uneven code quality. Existing static analysis tools only provide limited code style checks and error detection, and cannot cover the code design specifications and business logic consistency.

[0011] 3) Security and compliance risks:

[0012] During the code review process, data security and compliance issues involved are often difficult to detect in a timely manner using traditional methods. For example, manual reviewers may overlook potential security vulnerabilities in the code, such as data leakage, unauthorized access, etc., while static analysis tools have difficulty detecting complex security issues and industry compliance issues due to their lack of understanding of the context.

[0013] 4). Lack of intelligence and flexibility:

[0014] Although some machine learning-based code review tools can automatically generate code snippets or provide suggestions, the functions of these tools are mainly focused on code completion and preliminary error checking, and lack the ability to understand and handle complex business logic. Most existing tools rely on fixed rule sets and cannot be flexibly adjusted according to project requirements, and cannot handle project-specific development specifications or industry standards.

[0015] 5). Lack of continuous updating and self-learning capabilities:

[0016] Existing code review tools usually rely on static rule sets and are difficult to update dynamically. When new industry specifications or internal company development standards are released, these tools often cannot update their review rules in a timely manner, causing them to fail when dealing with new problems. At the same time, they also lack self-learning capabilities and cannot optimize their own review capabilities through the accumulation of historical review cases. Summary of the invention

[0017] In view of the above problems, the present invention is proposed to provide an auxiliary code review method and system based on a large language model to overcome the above problems or at least partially solve the above problems.

[0018] According to one aspect of the present invention, an auxiliary code review method based on a large language model is provided, and the code review method comprises:

[0019] Based on static analysis technology and abstract syntax tree (AST) extraction tools, the submitted code files are parsed and key elements are extracted;

[0020] Relying on knowledge graph technology, the code is reviewed through the pre-built internal and external knowledge base of the company to obtain the review results;

[0021] Use a large language model to perform contextual analysis of the code and obtain analysis results;

[0022] Integrate the review result and the analysis result to generate a review report through NLP;

[0023] It uses containerization technology and plug-in integration with mainstream development tools to support private deployment.

[0024] Optionally, the key elements include variable name, function name, class name, and comment content.

[0025] Optionally, the knowledge base includes internal enterprise coding specifications, industry standards, and compliance requirements.

[0026] Optionally, the code review based on knowledge graph technology through pre-built internal and external knowledge bases of the company specifically includes: using semantic matching and logical reasoning technology to compare the parsed code with the knowledge base rules to obtain code style issues and potential security risks.

[0027] Optionally, the using of a large language model to perform context analysis of the code specifically includes:

[0028] Use deep learning models to review the code's syntax structure, business logic, and hidden errors to identify logical problems;

[0029] Jointly reason with a large language model and knowledge base to obtain review suggestions.

[0030] Optionally, the review report includes a description of the problem, modification suggestions, the number of relevant code lines, and a link to the coding standard.

[0031] Optionally, the plug-in integration of the containerization technology and mainstream development tools specifically includes: elastic expansion through automated operation and maintenance tools.

[0032] The present invention also provides an auxiliary code review system based on a large language model, applying the above-mentioned auxiliary code review method based on a large language model, the code review system includes:

[0033] The code parsing module is used to parse the submitted code files and extract key elements based on static analysis technology and abstract syntax tree (AST) extraction tools;

[0034] The knowledge base matching module is used to review the code through the pre-built internal and external knowledge bases of the company based on the knowledge graph technology to obtain the review results;

[0035] A large language model processing module is used to use a large language model to perform context analysis of the code and obtain analysis results;

[0036] An audit report generation module, used to integrate the audit results and the analysis results, and generate an audit report through NLP;

[0037] The system integration and deployment module is used to integrate plug-ins of mainstream development tools using containerization technology and supports private deployment.

[0038] The present invention provides an auxiliary code review method and system based on a large language model, the code review method includes: parsing submitted code files and extracting key elements based on static analysis technology and abstract syntax tree AST extraction tools; relying on knowledge graph technology, reviewing the code through pre-built internal and external knowledge bases of the company to obtain review results; using a large language model to perform contextual analysis of the code to obtain analysis results; integrating the review results and the analysis results, and generating a review report through NLP; using containerization technology and plug-in integration of mainstream development tools to support private deployment. The present invention can greatly improve the efficiency, accuracy and security of code review, reduce the workload of manual review, and realize the automation and intelligence of the code review process.

[0039] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0041] Figure 1 A flowchart of an auxiliary code review method based on a large language model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] The terms "comprises" and "having" and any variations thereof in the description embodiments, claims and drawings of the present invention are intended to cover non-exclusive inclusions, for example, including a series of steps or units.

[0044] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0045] like Figure 1 As shown, an auxiliary code review method based on a large language model includes:

[0046] Step S1: Collect the company's internal coding specifications, industry standards, and security compliance requirements to build a knowledge base for code review.

[0047] By collecting the coding specifications and industry standards used in the enterprise development process, especially security compliance requirements, a knowledge base including code style, business logic rules, and security requirements is formed.

[0048] Step S2: Based on the knowledge base constructed in step S1, a large language model is trained to understand and apply these norms and rules.

[0049] The large language model is trained with domain-specific data sets to ensure that the model can generate compliant review results based on actual coding standards, business logic, and security requirements.

[0050] Step S3: Analyze the code using the trained large language model in combination with the code parsing module to extract the structure and grammatical information in the code.

[0051] The submitted code is parsed to extract important code elements such as variables, functions, classes, loop structures, etc., and this structured information is passed as input to the large language model.

[0052] Step S4: Compare the parsed code information with the coding standards and security rules in the knowledge base one by one to identify code segments that do not meet the standards.

[0053] The system uses the rules in the knowledge base to compare the naming rules, function definitions, business logic, etc. in the code, identify potential problems, and generate modification suggestions.

[0054] Step S5: Analyze the complex logic of the code through the context understanding capability of the large language model to detect potential logic errors or parts that violate business rules.

[0055] For complex business logic, the large language model can understand the contextual relationship between code snippets and identify potential logical errors or business inconsistencies.

[0056] Step S6: Generate code review suggestions and generate a complete review report through the review report generation module.

[0057] Integrate the results from knowledge base comparison and large language model analysis to generate a detailed review report, including problem description, solution suggestions and reference specifications.

[0058] Step S7: Feedback the review report to the developer through the integrated plug-in, and the developer receives the review suggestions in real time during the process of writing code.

[0059] After the review report is generated, the system will directly feedback the review results to the developer through the integrated development tool plug-in (such as the VS Code plug-in), making it easier for the developer to modify the code in real time.

[0060] Step S8: Support private deployment to ensure data security and privacy protection during the code review process.

[0061] The present invention supports the deployment of large language models and review systems in enterprise intranets or private clouds to avoid code data leakage and ensure the code security and privacy of the enterprise.

[0062] By combining a large language model with a custom knowledge base, automated code standardization and security reviews can significantly improve code review efficiency, reduce manual involvement, and ensure code compliance and security.

[0063] The following is an example of the specific steps of [SQL code standard review] based on the above large language model assisted code review method:

[0064] 1). Collect relevant specifications and rules for SQL code review:

[0065] Step S1: First, collect the company's internal SQL coding specifications, industry SQL writing standards, and SQL security compliance requirements to build a knowledge base for SQL code review.

[0066] For example, the knowledge base contains rules such as: naming conventions for SQL query statements, standardization of table and column names, index optimization, reasonable use of JOIN statements, and SQL injection protection rules.

[0067] Example rule:

[0068] All table and column names must use snake case.

[0069] It is forbidden to use "SELECT *" in SELECT statements.

[0070] The JOIN operation must explicitly specify the primary key and foreign key.

[0071] SQL injection vulnerabilities must be prevented, which is achieved through parameterized queries.

[0072] 2) Train a large language model to understand SQL rules:

[0073] Step S2: Based on the collected SQL specifications and rules, a large language model is trained using a domain-specific dataset to understand and apply these SQL specifications.

[0074] For example, through training, the large language model learns to recognize naming conventions, query optimization, SQL security issues (such as preventing SQL injection attacks), etc.

[0075] 3) Use the large language model and code parsing module to parse SQL code:

[0076] Step S3: Submit a section of SQL code and parse it through the code parsing module to extract the SQL syntax elements and structure information therein.

[0077] Extract information after parsing:

[0078] Variable names: employees, departments, e, d, salary

[0079] SQL operations: SELECT, JOIN, WHERE

[0080] Logical structure: The main table employees is connected to departments through dept_id.

[0081] 4). Compare the SQL code with the rules in the knowledge base:

[0082] Step S4: Compare the parsed SQL codes one by one with the coding standards and security rules in the knowledge base to identify the parts that do not meet the standards.

[0083] During the comparison process, the system may find:

[0084] An irregular "SELECT *" query was used. The required column names should be explicitly specified.

[0085] There is no proper index optimization for employees.dept_id and departments.id in the JOIN statement, which may affect query performance.

[0086] 5) Large language model analysis of complex logic problems:

[0087] Step S5: Analyze the complex business logic in SQL through the context understanding capability of the large language model to detect potential logical errors or SQL performance risks.

[0088] Large language models may discover:

[0089] The condition e.salary>5000 used in the WHERE clause does not take into account index optimization and may result in a full table scan.

[0090] The connection table is not optimized, which affects performance. It is recommended to optimize or add indexes.

[0091] 6). Generate code review suggestions and generate review reports:

[0092] Step S6: Integrate the comparison and analysis results to generate a complete SQL code review report.

[0093] Example of review report:

[0094] Question 1: "SELECT *" is used. It is recommended to replace it with an explicit column name list to improve code readability and performance.

[0095] Question 2: The JOIN statement does not add an index. It is recommended to create indexes on the employees.dept_id and departments.id columns.

[0096] 7). Real-time feedback review suggestions:

[0097] Step S7: Feedback the above SQL code review suggestions to developers in real time through an integrated development tool plug-in (such as a VS Code plug-in).

[0098] During the SQL code editing process, the plug-in can remind developers of existing problems and modification suggestions through pop-ups or comments.

[0099] 8). Private deployment ensures data security:

[0100] Step S8: Support the deployment of a code review system in an enterprise intranet or private cloud environment to ensure that the privacy of SQL code data is protected during the review process and to avoid code leakage.

[0101] The entire system consists of the following core modules: code parsing module, knowledge base matching module, large language model processing module, review report generation module, and system integration and deployment module. These modules achieve efficient, automated, and intelligent code review functions through precise technical collaboration.

[0102] The overall system architecture is divided into five main parts, based on the microservice architecture design to achieve efficient and flexible code review:

[0103] Code parsing module: Based on static analysis technology and abstract syntax tree (AST) extraction tools, it is used to parse submitted code files and extract key elements, including variable names, function names, class names, comment content, etc. This module provides basic data for subsequent review by analyzing the code structure and hierarchical relationships.

[0104] Knowledge base matching module: Relying on knowledge graph technology, the code is reviewed through the pre-built internal and external knowledge base of the company. The knowledge base contains internal coding specifications, industry standards, compliance requirements, etc. The module uses semantic matching and logical reasoning technology to compare the parsed code with the knowledge base rules to discover code style problems and potential security risks.

[0105] Large language model processing module: Uses large language models (such as Qwen2 or Deepseek) to perform contextual analysis of the code. This module uses deep learning models to review the grammatical structure, business logic, and hidden errors of the code, and finds logical problems that are difficult to identify with traditional static analysis tools. The large language model also performs joint reasoning with the knowledge base to provide accurate review suggestions.

[0106] Review report generation module: This module integrates the results from the knowledge base matching module and the large language model processing module, and generates a detailed and structured review report through NLP, including problem description, modification suggestions, relevant code lines and coding standard links, so that developers can quickly fix problems.

[0107] System Integration and Deployment Module: It uses containerization technology (such as Docker) and plug-in integration of mainstream development tools (such as VS Code), supports private deployment, and ensures data security and privacy during code review. This module is elastically expanded through automated operation and maintenance tools (such as Kubernetes) to meet the review needs of enterprises of different sizes.

[0108] 2. Detailed function implementation

[0109] 2.1 Code parsing module

[0110] This module deeply analyzes the code submitted by developers based on AST and static analysis tools (such as Pylint or SonarQube) to extract the key elements and structural information of the code.

[0111] Implementation technology:

[0112] Use AST to extract code structure and key elements, such as variables, functions, classes, comments, etc.

[0113] Identify logical structures such as loops and conditional statements in the code through pattern matching technology.

[0114] The parsing results serve as input to subsequent modules to ensure correctness at the semantic level.

[0115] 2.2 Knowledge Base Matching Module

[0116] Through knowledge graphs and semantic analysis tools (such as SpaCy and Word2Vec), code standards and security are automatically compared based on code parsing results.

[0117] Implementation technology:

[0118] The knowledge base is built based on industry standards and internal enterprise specifications, and uses graph databases (such as Neo4j) for storage and retrieval.

[0119] Use semantic similarity calculation tools (such as BERT) to semantically match the code with the rules in the knowledge base to find code that violates the specifications.

[0120] Through logical reasoning algorithms, potential risks in the code are analyzed and preliminary modification suggestions are generated.

[0121] 2.3 Large Language Model Processing Module

[0122] Large language models based on deep learning technology (such as the GPT series models) perform high-level semantic understanding and business logic analysis of the code, especially complex cross-module dependencies and implicit logic errors.

[0123] Implementation technology:

[0124] The Transformer model is used to perform in-depth understanding and feature extraction of code context, and self-supervised learning technology is combined to improve the model's code comprehension ability.

[0125] The model is pre-trained with a large number of programming language corpora (such as CodeSearchNet) and has the ability to handle multiple programming languages.

[0126] The review suggestions generated based on the model are combined with the code review data in the actual project, and adaptive optimization is performed through reinforcement learning to provide more accurate correction suggestions.

[0127] 2.4 Review report generation module

[0128] Combined with natural language generation (NLG) technology, structured review reports are automatically generated, integrating the analysis results of knowledge base matching and large language models.

[0129] Implementation technology: Use NLP technology (such as OpenAI GPT-4) to generate natural language descriptions and automatically generate readable reports. Through rule-based post-processing algorithms, duplicate review results are removed to ensure that the report content is concise and accurate. Output in Markdown or HTML format is easy to integrate into various development environments or continuous integration systems.

[0130] 2.5 System Integration and Deployment Module

[0131] The system is integrated into the editors commonly used by developers in the form of plug-ins, and flexible deployment is achieved through containerization technology to ensure that the code review process is safe and efficient.

[0132] Implementation technology:

[0133] Use Electron or VS Code plug-in mechanism to develop a real-time code review assistant that supports multi-language review.

[0134] Containerized deployment uses Docker and Kubernetes and supports private cloud and local deployment.

[0135] Encrypted communications (such as SSL / TLS) ensure that data is not leaked during transmission, ensuring the privacy and security of the company's code.

[0136] Through advanced technical solutions, the system deeply integrates artificial intelligence with enterprise development processes to achieve an intelligent, efficient and secure code review process.

[0137] Beneficial effects:

[0138] Intelligent code review based on large language model:

[0139] By using a large language model to deeply understand the code context, it is possible to identify logical errors, business rule violations, and complex structural problems in the code. This method breaks through the limitations of traditional static code analysis tools and can provide intelligent review suggestions for multiple programming languages ​​and complex business logic.

[0140] Construction and dynamic update of custom knowledge base:

[0141] The knowledge base integrates industry standards, internal company coding standards, and security compliance requirements, and supports dynamic updates based on project needs. Through this flexible and customizable knowledge base, the review system can adapt to the specific needs of different projects and industries, ensuring that the code complies with the latest development specifications and security standards.

[0142] Automated code analysis and review process:

[0143] The code parsing module of the present invention can automatically extract code structure information, and combine with the knowledge base and large language model to automatically perform code compliance inspection and logic review, which greatly improves the efficiency of code review and reduces manual intervention.

[0144] Automatic generation of review reports and real-time feedback:

[0145] Through the review report generation module, the system can automatically integrate the review results, generate a detailed report containing problem descriptions, improvement suggestions and code segment locations, and provide real-time feedback on the review results in the development environment through integrated plug-ins.

[0146] Private deployment and data security assurance:

[0147] The present invention supports private deployment, ensuring that the code and review data involved in the code review process are not leaked to the external environment. The system runs on the enterprise intranet or private cloud to ensure the security and privacy of the code.

[0148] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An auxiliary code review method based on a large language model, characterized in that: The code review method includes: Based on static analysis technology and abstract syntax tree (AST) extraction tools, the submitted code files are parsed and key elements are extracted; Relying on knowledge graph technology, the code is reviewed through the pre-built internal and external knowledge base of the company to obtain the review results; Use a large language model to perform contextual analysis of the code and obtain analysis results; Integrate the review result and the analysis result to generate a review report through NLP; It uses containerization technology and plug-in integration with mainstream development tools to support private deployment.

2. According to claim 1, the auxiliary code review method based on a large language model is characterized in that: The key elements include variable name, function name, class name, and comment content.

3. The method for assisting code review based on a large language model according to claim 1, characterized in that: The knowledge base includes internal enterprise coding specifications, industry standards, and compliance requirements.

4. The method for assisting code review based on a large language model according to claim 1, characterized in that: The code review based on knowledge graph technology through pre-built internal and external knowledge bases of the company specifically includes: using semantic matching and logical reasoning technology to compare the parsed code with the knowledge base rules to obtain code style issues and potential security risks.

5. The method for assisting code review based on a large language model according to claim 1, characterized in that: The use of a large language model to perform context analysis of the code specifically includes: Use deep learning models to review the code's syntax structure, business logic, and hidden errors to identify logical problems; Jointly reason with a large language model and knowledge base to obtain review suggestions.

6. The method for assisting code review based on a large language model according to claim 1, characterized in that: The review report includes a description of the problem, modification suggestions, the number of relevant code lines, and a link to the coding standard.

7. The method for assisting code review based on a large language model according to claim 1, characterized in that: The plug-in integration using containerization technology and mainstream development tools specifically includes: elastic expansion through automated operation and maintenance tools.

8. An auxiliary code review system based on a large language model, applying an auxiliary code review method based on a large language model as described in any one of claims 1 to 7, characterized in that: The code review system includes: The code parsing module is used to parse the submitted code files and extract key elements based on static analysis technology and abstract syntax tree (AST) extraction tools; The knowledge base matching module is used to review the code through the pre-built internal and external knowledge bases of the company based on the knowledge graph technology to obtain the review results; A large language model processing module is used to use a large language model to perform context analysis of the code and obtain analysis results; An audit report generation module, used to integrate the audit results and the analysis results, and generate an audit report through NLP; The system integration and deployment module is used to integrate plug-ins of mainstream development tools using containerization technology and supports private deployment.

Images