Code static inspection method, system and device and medium

Abstract

The invention belongs to the technical field of code processing, and particularly relates to a code static checking method, system and device and a medium, and the code static checking method comprises the steps that a code is checked through a static checking tool, and a code problem and a corresponding source code are positioned; obtaining a preset code rule, and generating a corresponding prompt corpus based on the preset code rule and the source code; and generating a risk analysis result corresponding to the prompt corpus based on the prompt corpus. According to the method, the problems of low efficiency and poor accuracy of code static checking are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of code processing, and in particular relates to a code static checking method, system, device and medium. Background Art

[0002] As the complexity and scale of software development continue to increase, static code analysis or inspection has become an important quality management tool to ensure code quality, improve development efficiency, and reduce maintenance costs. Traditional static code inspection tools focus mainly on the syntax and specifications of the code, and have limited ability to understand the semantics of the code. However, correct understanding and accurate analysis of the code requires deeper semantic understanding and context inference capabilities.

[0003] Static code checking is the first checking step after code submission and plays an important role in many fields or links, such as the integration and release of autonomous driving software. Static code checking can help developers follow coding standards and best practices, improve code readability and maintainability, and help developers find hidden errors and defects in the code, such as syntax errors, type errors, unused variables, potential null pointer references, etc., thereby improving code quality and reducing runtime problems and failures caused by code errors. By discovering problems in advance in the static checking step, the cost and time of fixing errors later can be effectively reduced.

[0004] In the prior art, the static checking of codes often relies on built-in and customized rule sets in third-party tools to detect potential programming errors, unused code, duplicate code, and bad programming practices. This method is a fixed and inherent way of solving problems in the rule set itself, and it is more dependent on third-party testing agencies. Since third-party testing agencies cannot be updated in a timely manner and cannot be adapted according to the specific needs of users, not all problems of static checking can be solved. In addition, since the rule set itself is not easy to read, its detection results often only contain one or two sentences of error information and simple example demonstrations, and cannot be explained in conjunction with the actual error code paragraphs. For users, especially new users, it is slow to get started and the usage efficiency is low, which affects the efficiency and accuracy of code static checking. Summary of the invention

[0005] In view of the above-mentioned shortcomings of the prior art, the present invention provides a code static checking system, method, device and medium, which solve the problems of low efficiency and poor accuracy of code static checking.

[0006] To achieve the above purpose, the present invention adopts the following technical solution.

[0007] A first aspect of the present invention provides a code static checking method, comprising: Use static checking tools to check the code and locate code problems and corresponding source codes; Obtain preset code rules, and generate corresponding prompt corpus based on the preset code rules and source code; A risk analysis result corresponding to the prompt corpus is generated based on the prompt corpus.

[0008] Optionally, generating a risk analysis result corresponding to the prompt corpus based on the prompt corpus includes: Configure the inference path model; The reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path.

[0009] Optionally, the configuration reasoning path model includes: Choose a large model; Build a prompt word template library; Build a dataset; Freeze the pre-trained parameters of each module of the attention layer, inject the trainable rank decomposition matrix, and only select the newly added bypass matrix parameters for training to train the dataset.

[0010] Optionally, constructing a data set includes: Get data; Cleaning and restructuring data, including: Clean the data from different sources and only keep the codes in the preset required areas; Get static check rule violation cases; Configure tag sets; Extract and randomly combine elements in the prompt word template library with elements in the static check rule violation cases to generate multiple sets of "prompt word + problem analysis"; Label each group of "prompt word + question analysis" based on the label set to obtain a training data hash table; The training data hash table is used as a data set to participate in training.

[0011] Optionally, the reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path, including: The reasoning path generates a plurality of reasoning paths based on the prompt context corresponding to the prompt corpus; On each reasoning path, the prompt corpus is vectorized to obtain a prompt corpus vector; The vectorized prompt corpus is processed through a multi-head self-attention mechanism to obtain a deep prompt corpus vector; Send the deep prompt corpus vector into the feedforward neural network to obtain the deep prompt corpus feature vector; Inferring subsequent words and the probability of occurrence of subsequent words based on the feature vector of the depth prompt corpus; Generate corresponding risk analysis results based on subsequent words and the probability of occurrence of subsequent words.

[0012] Optionally, the vectorization of the prompt corpus to obtain the prompt corpus vector includes: The prompt corpus is mapped into a dense vector in the high-dimensional vector through the word embedding layer, and the position encoding is superimposed on the dense vector mapped into the high-dimensional vector to obtain the prompt corpus vector.

[0013] Optionally, after the reasoning path model independently generates each risk analysis result according to the reasoning path corresponding to each prompt context, it includes: Summarize the results of each risk analysis; The static checking analysis result is determined based on a preset voting strategy, and the static checking analysis result at least includes a predicted category of code problems in this static code checking.

[0014] Optionally, after determining the static check analysis result based on a preset voting strategy, the method further includes: generating a risk level and / or modification suggestion based on the code problem based on the static check analysis result.

[0015] A second aspect of the present invention provides a code static checking system, comprising: A code problem locating unit, at least used to check the code through a static checking tool to locate the code problem and the corresponding source code; A prompt corpus generating unit, at least used to obtain preset code rules, and generate corresponding prompt corpus based on the preset code rules and source code; The risk result generating unit is at least used to generate a risk analysis result corresponding to the prompt corpus based on the prompt corpus.

[0016] A third aspect of the present invention provides a code static checking device, comprising: A first input module is at least used to directly input the code into the static inspection tool and output the static inspection result; A second input module is at least used to directly process the code according to the code static checking method described in the first aspect of the present invention to generate a risk analysis result; A report sending module is used to at least integrate the static inspection results and risk analysis results, generate a comprehensive report and send it to relevant parties; The feedback optimization module is at least used to selectively optimize the generation process of the prompt corpus based on the content of the comprehensive report.

[0017] A fourth aspect of the present invention provides an electronic device, comprising: At least one processor; and at least one memory in communication with the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the steps of the method described in the first aspect of the present invention.

[0018] A fifth aspect of the present invention provides a readable storage medium storing a computer program, wherein the computer program is executed by a processor to perform the steps of the method described in the first aspect of the present invention.

[0019] The present invention reduces the burden of code review and does not rely on preset rule sets and recognition patterns. Instead, it combines prompt corpora to generate risk analysis results corresponding to the prompt corpora, which can help developers fix potential problems, improve code quality, and provide better maintenance and expansion suggestions, thereby reducing false positive and missed positive rates, avoiding long-tail problems, and improving development efficiency and quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 It is a flowchart of a code static checking method in a specific embodiment of the present invention.

[0022] Figure 2 It is a flowchart of another code static checking method in a specific embodiment of the present invention.

[0023] Figure 3 It is a flowchart of another code static checking method in a specific embodiment of the present invention.

[0024] Figure 4 It is a flowchart of another code static checking method in a specific embodiment of the present invention.

[0025] Figure 5 It is a block diagram of a code static checking system according to a specific embodiment of the present invention.

[0026] Figure 6 It is a block diagram of a code static checking device according to a specific embodiment of the present invention.

[0027] Figure 7 FIG. 1 is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application. In addition, it should be understood that the specific implementation methods described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0029] It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments of the present application. In addition, in the following embodiments, the description of each embodiment has its own emphasis, and for parts not described in detail in one embodiment, reference can be made to the relevant description of other embodiments.

[0030] Existing static checking tools locate and list the sections in the code that violate the specifications by matching the specification set with the code line by line, provide a fixed description of the problem, and then let the user understand the problem and make corrections on their own. Limited by the characteristics of the tool, it has at least the following problems: False positives: Problems can only be located by matching line by line. Due to overly strict coding standard matching, insufficient understanding of specific contexts, or limitations of the rules themselves, static checking tools sometimes mistakenly mark code snippets that do not actually affect program correctness or performance as problems, thereby increasing the review burden and distracting attention from key issues. Missed detection issues: Static checking tools rely on predefined rule sets and pattern recognition, which may lead to the neglect of certain complex logic errors, design flaws, or abnormal behaviors in specific scenarios.

[0031] like Figure 1-4 As shown, the first aspect of the present invention provides a code static checking method, comprising the following steps.

[0032] Step S110: Check the code through a static checking tool to locate code problems and corresponding source codes; specifically, the code to be checked may be code submitted by a developer or a system customization, and a preliminary check is performed on the code through a static checking tool, so that code problems captured and located are violation information extracted by the static checking tool.

[0033] Step S120: Obtain preset code rules, and generate corresponding prompt corpus based on the preset code rules and source code; the preset code rules refer to the violation information initially located by the static inspection tool, that is, the specific static inspection rule number and description violated, such as A2-7-3, Function'bool is_string_array()const'does not have an identifiable documentation comment. The preset code rules will participate in the generation of risk analysis results together with the code. The type of prompt corpus can be obtained according to the actual situation.

[0034] In one embodiment of the present invention, five different prompt corpora are generated based on preset code rules and source code.

[0035] Step S130: generating a risk analysis result corresponding to the prompt corpus based on the prompt corpus.

[0036] Here, the submitted code is first reviewed by a static checking tool, and the review result and source code are used as input for further review and checking by the present invention, thereby improving the accuracy of the code static checking.

[0037] In one embodiment of the present invention, the step of generating a risk analysis result corresponding to the prompt corpus based on the prompt corpus in step S130 includes: Step S131: configuring the reasoning path model; Step S132: the reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path.

[0038] Specifically, in step S131, the configuration of the reasoning path model includes the following steps.

[0039] Step S1311: Select a large model, specifically a language large model or a large language model, which includes a word embedding layer, a position encoding layer, a (multi-head) self-attention layer, a feedforward neural network layer, a normalization layer, a residual connection, and an output layer. Among them, the word embedding layer is a layer in the large model, which is the front-end word embedding layer and is responsible for vectorizing the input corpus. In combination with the technical solution of the present invention, the preset code rules will be input into the large model together with the code, and the large model will determine whether it is violated and the size of the risk.

[0040] Construct a prompt word template library PROMPT = {prom1, prom2, prom3...promN}. The prompt word template library contains knowledge guidance, such as prom1 = "As a static analysis expert, please deeply understand the code logic according to the rules, and classify the severity of the code problems into serious problems and optimization problems." Among them, the "serious problems" category mainly covers problems that directly affect the correctness, security and stability of program functions, such as memory leaks, resource competition, potential null pointer access, etc. These problems may directly cause runtime errors or security vulnerabilities; the "non-serious problems" category mainly involves guidance on code readability, maintainability and performance fine-tuning, such as code comments, code initialization and other non-serious problems, which have relatively low priority and can be optimized later.

[0041] Step S1312: Construct a prompt word template library, wherein the prompt word template library contains multiple prompt corpora constructed for this static inspection large model, which are used to be combined with the data set for model training. Specifically, each time the prompt corpus is input to the model, the model is guided to give a text answering in a specific direction. The prompt word template library contains multiple prompt corpora constructed for this static inspection large model, which are used to be combined with the data set for model training.

[0042] Step S1313: construct a data set.

[0043] In one embodiment of the present invention, the step of constructing a data set includes the following steps.

[0044] Step ①: Obtain data; specifically, the sources of data at least include: Data source 1: Specific requirements of the software team, such as specific naming conventions and specific annotation standards. For example, the algorithm module name must start with "AB". Although the data of specific naming conventions is not included in the specifications of static checking tools, adding this content to the training set allows the model to have the ability to check this naming constraint. Data source 2: Official information on static checking, such as the AUTOSAR_RS_CPP14 code specification, which contains various static checking issues, explanations, and examples; Data source 3: open source database, including open source code, annotations, and problem explanations; Data source 4: Experience content generated by daily static checks, which are long-tail problems that frequently occur in specific development teams.

[0045] Step 2: Clean and reconstruct data, including: Clean data from different sources and use methods such as regular matching, large model annotation, and manual review to retain only the code in the preset demand areas, where the preset demand areas include areas related to autonomous driving, etc. Obtain static check rule violation cases from the problem instance library. Specifically, the problem instance library is PROBLEM = {"codel:explan1", "code2:explan2"...}. The problem instance library collects various static check rule violation cases. Each case contains sufficient context information, namely, the relevant source code snippet and the violated static check rule. At the same time, it is confirmed that the source code format of each case is unified to facilitate model understanding and processing; Configure a label set, where the label set has only two categories, classifying different problems into "serious problems" and "non-serious problems", represented by L, L = {"serious problems", "non-serious problems"}; Freely extract and randomly combine elements in the prompt word template library PROMPT with elements in the static check rule violation cases collected by the problem instance library PROBLEM to generate multiple sets of "prompt words + problem analysis" so that the model can activate the capabilities in the private domain knowledge base after receiving such prompt words; After generating multiple groups of "prompt words + problem analysis", each group of "prompt words + problem analysis" will be labeled based on the label set to obtain the training data hash table TRAIN = {"prom1+code1: "serious problem"+"explan1"", "prom1+code1+explan2: "non-serious problem"+"explan2""...}. The training data hash table is used as a data set to participate in training.

[0046] In addition, when constructing the data set, the present invention controls the number of samples of "serious problems" and "non-serious problems" in the data set within a balanced range based on the principle of balance to avoid the model from being biased due to the skewness of the training data. In addition, when performing data set segmentation, the present invention divides the sorted data set into a training set, a validation set, and a test set, wherein 60% of the data set is used for training, 20% of the data set is used for validation, and 20% of the data set is used for testing.

[0047] Step S1314: Freeze the pre-trained parameters of each module of the attention layer, and inject a trainable rank decomposition matrix, which is used to construct a newly added bypass matrix, and only select the newly added bypass matrix parameters for training.

[0048] Specifically, considering that the size of the data set constructed in step S1313 is far from enough to train all the parameters of the model, it will cause the model to catastrophically forget the original knowledge. Therefore, the present invention performs fine-tuning through step S1314, adding private domain knowledge while retaining the original knowledge of the model, while reducing the training cost.

[0049] Specifically, the present invention freezes the main layers of the model, retains only the self-attention layer for training and adjusting weights, freezes the pre-trained parameters of each module (Q, K, V) of the self-attention layer, injects a trainable rank decomposition matrix, and only trains the newly added bypass matrix parameters. The rank decomposition matrix is ​​used to construct a newly added bypass matrix. In this way, the output of the model can be regarded as a superposition of the original output and the low-rank matrix output.

[0050] Specifically, during the use of the model, the prompt corpus input by the user is processed layer by layer by multi-head self-attention layers, and the dot product operation is used to capture the dependencies between elements in the sequence. Subsequently, the residual connection and layer normalization steps are used to enhance the expressiveness of the model, and the features are further refined through a deep feedforward neural network. Finally, with the help of activation functions such as the softmax function, the model outputs confidence probabilities for different classifications.

[0051] Specifically, by comparing with the real label data and calculating the loss function, the model adjusts the parameters of the newly injected low-rank decomposition matrix of the self-attention layer through the gradient descent method until the preset performance convergence standard is reached. When adjusting the parameters, the parameter matrix W in the self-attention layer remains unchanged, and only the injected low-rank decomposition matrices A and B are adjusted. The input feature vector is x, and the output h of the model is: h=Wx+BAx=W+∑BAx.

[0052] Here, based on this approach, low-rank approximation adjustment is achieved.

[0053] In step S132, the reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path, including: The reasoning path generates a plurality of reasoning paths based on the prompt context corresponding to the prompt corpus; On each reasoning path, the prompt corpus is vectorized to obtain a prompt corpus vector; The vectorized prompt corpus is processed through a multi-head self-attention mechanism to obtain a deep prompt corpus vector; Send the deep prompt corpus vector into the feedforward neural network to obtain the deep prompt corpus feature vector; Inferring subsequent words and the probability of occurrence of subsequent words based on the feature vector of the depth prompt corpus; Generate corresponding risk analysis results based on subsequent words and the probability of occurrence of subsequent words.

[0054] In one embodiment of the present invention, the prompt corpus is vectorized to obtain a prompt corpus vector, including: mapping the prompt corpus into a dense vector in a high-dimensional vector through a word embedding layer, and superimposing position encoding in the dense vector mapped into the high-dimensional vector to obtain the prompt corpus vector.

[0055] Specifically, the prompt is expected to be mapped into a dense vector in a high-dimensional vector space through the word embedding layer. Each word is first mapped to a high-dimensional vector space through the word embedding layer, denoted as e i =E(w i ), where w i represents the i-th word, E() is the word embedding function, generating the vector e i .

[0056] In order to preserve the order information of the words in the prompt corpus, position encoding is superimposed on the prompt corpus vector to ensure that the model can distinguish the difference in meaning of the same words in different positions, so as to help the model better understand the meaning of the prompt corpus. Specifically, position encoding P(i) is introduced. Therefore, the input vector is finally x i =e i +P(i).

[0057] In one embodiment of the present invention, after the prompt corpus vector is processed by the multi-head self-attention mechanism, multiple attention heads examine the prompt corpus vector from different angles, thereby extracting the complex interdependence between each word and capturing the local and global context associations, thereby enhancing the model's ability to understand information for longer prompt corpora. 1 ,…,x n} is transformed into Q, K, V, namely the query matrix, key matrix and value matrix, where n is the sequence length. The deep prompt corpus vector can be expressed as follows after multi-head attention calculation: This process is executed in parallel in several different "heads", each of which focuses on a different subspace of the input, enhancing the model's ability to capture complex dependencies.

[0058] After the deep interaction of the multi-head attention layer, the deep prompt corpus feature vector is sent to the feedforward neural network, which includes two linear interaction layers and an activation function such as ReLU. After the deep prompt corpus vector processed by the multi-head attention is input into the feedforward neural network, the deep prompt corpus feature vector is obtained as follows: FFN(x)=W 2 (σ(W 1 x+b1))+b 2 ; This process further enhances the learning of subtle semantic features in cue engineering by performing deep feature extraction.

[0059] In one embodiment of the present invention, the feature vector of the deep cue corpus processed by the feedforward neural network is sent to the input layer, and the probability distribution of subsequent words, such as the next word, is inferred by the softmax function: p(wt+1|w1:t)=softmax(W y z t +b y ); Among them, zt is the output of the feedforward neural network, Wy and by are the weight matrix and bias term of the output layer, and p(wt+1|w1:t) represents the generation probability of the t+1th word given the first t words. This process is based on the features extracted from the prompt corpus and can accurately estimate the probability of each possible subsequent word appearing, so that the model outputs results that are consistent with the contextual logic and semantic coherence.

[0060] like Figure 4 As shown, in one embodiment of the present invention, after the reasoning path model independently generates each risk analysis result according to the reasoning path corresponding to each prompt context, it includes: Summarize the results of each risk analysis; The static checking analysis result is determined based on a preset voting strategy, and the static checking analysis result at least includes a predicted category of code problems in this static code checking. Specifically, in an application scenario of the present invention, when a developer submits code, the code is first preliminarily checked using a static checking tool, and the located code problems and corresponding source code are captured. According to the code rules and source code, several prompt corpora are generated and input into the large model, so that the model can generate different risk analysis results according to different reasoning paths, and the results are voted and summarized, and the risk level of the problem and the output analysis and modification suggestions are determined according to the majority voting principle. Considering the balance between task complexity and time cost, five prompt corpora are selected. It has been tested and verified that the number of prompt corpora can cope with the current task complexity and will not significantly increase the time cost.

[0061] Those skilled in the art may also increase or decrease the number of prompt corpora according to actual needs.

[0062] Specifically, during each evaluation process, the model will show a variety of reasoning paths based on different prompt contexts, thereby deriving different classification conclusions. In order to enhance the robustness and generalization performance of the model when dealing with complex problems, an integrated learning voting strategy is adopted, that is, five unique prompt corpora are used to drive the model, allowing the model to perform independent prediction and classification tasks for each set of prompts.

[0063] For example, Figure 4 As shown, the five prompt corpora can be expressed as: Tip 1: {"You are a QAC conclusion review expert. Please review the source code content and its context, QAC rule information and violation information. Source code content: "xx", two lines of context: "xx", QAC rule information: "xx", QAC violation information: "xx", please review the source code content based on the rule information to see if it actually needs to be optimized immediately or later? What is the reason? How to modify it based on the C++11 standard?"}; Hint 2: {"You are a QAC conclusion review expert. Please help review based on the source code content and its context, QAC rule information and violation information. Source code content: "xx", the context content of the first and second lines: "xx", QAC rule information: "xx", QAC violation information: "xx", the code has been tested on a real vehicle and no serious problems have been found in the function. Please help judge based on the source code content and context, QAC rule information and violation information: Is this source code a serious problem or a non-serious problem? What are the reasons? How to modify it based on the C++11 standard?"}; Hint 3: {"You are a QAC conclusion review expert. Please help review based on the source code content and its contextual content, QAC rule information, and violation information. Source code content: "xx", the contextual content of the first and second lines: "xx", QAC rule information: "xx", QAC violation information: "xx", the code has been tested on a real vehicle and no serious functional problems have been found. Please help judge based on the source code content and contextual content, QAC rule information, and violation information: Is this source code content an urgent issue or a non-urgent issue? What are the reasons? How to modify it based on the C++11 standard?"}. Hint 4: {"You are a QAC conclusion review expert. Please help review based on the source code content and its contextual content, QAC rule information and violation information. Source code content: "xx", the contextual content of the first and second lines: "xx", QAC rule information: "xx", QAC violation information: "xx", the code has been tested on a real vehicle and no serious functional problems have been found. Please help judge based on the source code content and contextual content, QAC rule information and violation information: What is the risk of this source code content? Is it high risk or low risk? What are the risks respectively? How to modify it based on the C++11 standard?"}. Hint 5: {"You are a QAC conclusion review expert. Please help review based on the source code content and its contextual content, QAC rule information and violation information. Source code content: "xx", contextual content of the first and second lines: "xx", QAC rule information: "xx", QAC violation information: "xx". When the code has been tested on a real vehicle and no serious functional problems have been found, please help judge based on the source code content and contextual content, QAC rule information and violation information: Is the violation of this source code a high priority, medium or low priority? What are the reasons for each? Does it need to be modified immediately? How to modify it based on the C++11 standard?"}.

[0064] To ensure the robustness and accuracy of subsequent results, all classification results are mapped to the 0-1 space, X = [x 1 ,x 2 ,x 3 ,x 4 ,x 5 ], for example: For each classification result X = [x 1 ,x 2 ,x 3 ,x 4 ,x 5 ] to summarize and determine the final static inspection analysis result x based on the majority voting principle n :

[0065] In one embodiment of the present invention, after determining the static check analysis result based on the preset voting strategy, it also includes: generating a risk level and / or modification suggestion based on the code problem based on the static check analysis result.

[0066] like Figure 5 As shown, the second aspect of the present invention provides a code static checking system, comprising: A code problem locating unit 210 is at least used to check the code through a static checking tool to locate the code problem and the corresponding source code; The prompt corpus generating unit 220 is at least used to obtain preset code rules and generate corresponding prompt corpus based on the preset code rules and source code; The risk result generating unit 230 is at least configured to generate a risk analysis result corresponding to the prompt corpus based on the prompt corpus.

[0067] like Figure 2 and Figure 6 As shown, the third aspect of the present invention provides a code static checking device, comprising: A first input module 310 is at least used to directly input the code into the static inspection tool and output the static inspection result; The second input module 320 is at least used to directly process the code according to the code static checking method described in the first aspect of the present invention to generate a risk analysis result; A report sending module 330 is at least used to integrate the static inspection results and risk analysis results, generate a comprehensive report and send it to relevant parties; The feedback optimization module 340 is at least used to selectively optimize the generation process of the prompt corpus based on the content of the comprehensive report.

[0068] like Figure 7 As shown, the fourth aspect of the present invention provides an electronic device, including: At least one processor; and at least one memory in communication with the processor, wherein: the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the steps of the method described in any one of the above embodiments.

[0069] A fifth aspect of the present invention discloses a readable storage medium storing a computer program, wherein the computer program is executed by a processor to perform the steps of the method described in any one of the above embodiments.

[0070] Computer-readable storage media may include: any entity or device capable of carrying a computer program, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc. A computer program includes a computer program code. The computer program code may be in source code form, object code form, an executable file, or some intermediate form, etc. A computer-readable storage medium may include: any entity or device capable of carrying a computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), and a software distribution medium, etc.

[0071] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0072] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processing module, or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0073] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A code static checking method, characterized in that: include: Use static checking tools to check the code and locate code problems and corresponding source codes; Obtain preset code rules, and generate corresponding prompt corpus based on the preset code rules and source code; A risk analysis result corresponding to the prompt corpus is generated based on the prompt corpus.

2. The code static checking method according to claim 1, characterized in that: The generating a risk analysis result corresponding to the prompt corpus based on the prompt corpus includes: Configure the inference path model; The reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path.

3. The code static checking method according to claim 2, characterized in that: The configuration reasoning path model includes: Select a large model, wherein the large model includes an attention layer; Build a prompt word template library; Constructing a data set, wherein the data set and the prompt word template library are combined to participate in model training; Freeze the pre-trained parameters of each module of the attention layer, inject the trainable rank decomposition matrix, and only select the newly added bypass matrix parameters for training.

4. The code static checking method according to claim 3, characterized in that: The constructing of the data set comprises: Get data; Cleaning and restructuring data, including: Clean the data from different sources and only keep the codes in the preset required areas; Get static check rule violation cases; Configure tag sets; Extract and randomly combine the elements in the prompt word template library with the elements in the static check rule violation cases to generate multiple groups of "prompt words + problem analysis"; Label each group of "prompt word + question analysis" based on the label set to obtain a training data hash table; The training data hash table is used as a data set to participate in training.

5. The code static checking method according to claim 2, characterized in that: The reasoning path model generates multiple reasoning paths based on the prompt corpus, and independently generates corresponding risk analysis results according to each reasoning path, including: The reasoning path generates a plurality of reasoning paths based on the prompt context corresponding to the prompt corpus; On each reasoning path, the prompt corpus is vectorized to obtain a prompt corpus vector; The vectorized prompt corpus is processed through a multi-head self-attention mechanism to obtain a deep prompt corpus vector; Send the deep prompt corpus vector into the feedforward neural network to obtain the deep prompt corpus feature vector; Inferring subsequent words and the probability of occurrence of subsequent words based on the feature vector of the depth prompt corpus; Generate corresponding risk analysis results based on subsequent words and the probability of occurrence of subsequent words.

6. The code static checking method according to claim 5, characterized in that: The step of vectorizing the prompt corpus to obtain a prompt corpus vector includes: The prompt corpus is mapped into a dense vector in the high-dimensional vector through the word embedding layer, and the position encoding is superimposed on the dense vector mapped into the high-dimensional vector to obtain the prompt corpus vector.

7. The code static checking method according to claim 2, characterized in that: After the reasoning path model independently generates each risk analysis result according to the reasoning path corresponding to each prompt context, it includes: Summarize the results of each risk analysis; The static checking analysis result is determined based on a preset voting strategy, and the static checking analysis result at least includes a predicted category of code problems in this static code checking.

8. The code static checking method according to claim 7, characterized in that: After determining the static check analysis result based on the preset voting strategy, the method further includes: generating a risk level and / or modification suggestion based on the code problem based on the static check analysis result.

9. A code static checking system, characterized in that: include: A code problem locating unit, at least used to check the code through a static checking tool to locate the code problem and the corresponding source code; A prompt corpus generating unit, at least used to obtain preset code rules, and generate corresponding prompt corpus based on the preset code rules and source code; The risk result generating unit is at least used to generate a risk analysis result corresponding to the prompt corpus based on the prompt corpus.

10. A code static checking device, characterized in that: include: A first input module is at least used to directly input the code into the static inspection tool and output the static inspection result; A second input module is at least used to directly process the code according to the code static checking method according to any one of claims 1 to 8 to generate a risk analysis result; A report sending module is used to at least integrate the static inspection results and risk analysis results, generate a comprehensive report and send it to relevant parties; The feedback optimization module is at least used to selectively optimize the generation process of the prompt corpus based on the content of the comprehensive report.

11. An electronic device, characterized in that: include: at least one processor; And at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the steps of the code static checking method as described in any one of claims 1-8.

12. A readable storage medium storing a computer program, characterized in that: The computer program is used by a processor to execute the steps of the code static checking method as described in any one of claims 1 to 8.

Images