Software defect report analysis method and device, storage equipment and electronic equipment

Abstract

The invention discloses a software defect report analysis method and device, storage equipment and electronic equipment, and relates to the field of artificial intelligence. The method comprises the steps that a target defect report is obtained, and the target defect report is used for recording defect information of software; according to the target feature parameter combination meeting a preset condition, at least one target feature is extracted from the target defect report, each target feature is converted into a target feature vector, and the preset condition is used for determining feature parameters selected when feature extraction is conducted on the target defect report; and inputting the target feature vector into a target model, determining a probability density value of the target feature vector through the target model, and determining an analysis result of the target defect report according to the probability density value. The technical problem that in the prior art, the security defect detection accuracy is low due to the fact that the security defect in the user defect report depends on manual auditing and detection is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, storage device, and electronic device for analyzing software defect reports. Background Art

[0002] In the current software development and operation environment, the processing of user defect reports and the identification of security defects mainly rely on manual review. When users encounter errors or abnormal behaviors while using the software, they tend to submit detailed defect reports through online platforms. These reports are then transferred to the defect management system and reviewed and classified by dedicated team members.

[0003] However, the existing manual review process has significant limitations and shortcomings. First, since the defect reports submitted by users may lack detailed contextual information or specific technical details, it is difficult for auditors to accurately judge the nature of the defects, especially those complex issues related to security. Second, the manual review process is highly subjective, and the negligence or lack of experience of auditors may cause security-related defects to be misjudged or missed, thereby increasing the risk of software systems being attacked by hackers. In addition, faced with the large number of defect reports generated every day, manual review is inefficient and consumes a lot of manpower. The long-term processing may also lead to delays in critical security issues, leaving hackers with a time window to exploit vulnerabilities.

[0004] Therefore, the detection of security defects in user defect reports relies on manual review, which is not only inefficient, but also leads to low accuracy in identifying security defects due to incomplete information and subjectivity of the review.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The main purpose of the present application is to provide a method, apparatus, storage device and electronic device for analyzing software defect reports, so as to at least solve the technical problem in the prior art of relying on manual review to detect security defects in user defect reports, resulting in low accuracy of security defect detection.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for analyzing software defect reports is provided, including: obtaining a target defect report, wherein the target defect report is used to record defect information of the software; extracting at least one target feature from the target defect report according to a target feature parameter combination that meets preset conditions, and converting each target feature into a target feature vector, wherein the preset conditions are used to determine the feature parameters selected when extracting features from the target defect report; inputting the target feature vector into a target model, determining a probability density value of the target feature vector through the target model, and determining an analysis result of the target defect report based on the probability density value, wherein the probability density value is used to characterize distribution change information of the feature value of the target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports based on different feature combinations.

[0008] Optionally, the target model is obtained by the following steps: extracting N feature vectors from historical security defect reports and historical non-security defect reports, where N is an integer greater than 1; selecting M feature vectors corresponding to the security defect reports from the N feature vectors as M first feature vectors, where M is a positive integer less than N; constructing an initial model according to the target algorithm and the M first feature vectors, wherein the target algorithm is used to determine the security defect information in the security defect report by calculating the probability density value of the first feature vector; inputting the feature vectors other than the first feature vector of the N feature vectors into the initial model, and performing multiple target operations on the initial model to obtain the target model, wherein each target operation is used to select at least one feature parameter corresponding to each feature vector input into the initial model as a feature combination, and determine the model performance information after the initial model is trained based on the feature combination.

[0009] Optionally, each feature vector includes T feature parameters, where T is an integer greater than or equal to 1, the weight corresponding to each feature parameter is positively correlated with the importance of the feature parameter in the model training process, the T feature parameters are sorted according to the weight corresponding to each feature parameter, and an initial model is constructed according to the target algorithm and M first feature vectors, including: according to the target algorithm, respectively calculating the expected value and variance of all feature parameters in each of the M first feature vectors to obtain a Gaussian distribution model of the feature parameters; determining the probability density values ​​of the T feature parameters in each of the M first feature vectors according to the Gaussian distribution model; determining M probability density values ​​according to the probability density values ​​of the T feature parameters in each first feature vector; selecting a probability density value less than a first preset threshold from the M probability density values ​​as an initial anomaly threshold of the initial model; and obtaining the initial model according to the Gaussian distribution model, the M probability density values, and the initial anomaly threshold.

[0010] Optionally, feature vectors other than the first feature vector among the N feature vectors are input into the initial model, and multiple target operations are performed on the initial model to obtain a target model, including: performing T target operations on the initial model according to feature vectors other than the first feature vector among the N feature vectors to obtain T first sets, wherein each first set includes model performance information determined according to a selected feature parameter combination for each target operation; determining a target feature parameter combination and a target anomaly threshold in the initial model according to the T first sets, wherein the target anomaly threshold is an anomaly threshold that satisfies a first preset condition, wherein the first preset condition is used to constrain the difference between the detection result of the initial model and the actual result to be less than a third preset threshold; determining the target model according to the initial model, the target feature parameter combination, and the target anomaly threshold.

[0011] Optionally, the target operation includes the following steps: extracting the first X feature parameters from each of the M first feature vectors, forming a second feature vector corresponding to the first feature vector using the first X feature parameters extracted from each first feature vector, and obtaining M second feature vectors, wherein X is a positive integer less than or equal to T, and the value of X used in each target operation is different; using L feature vectors other than the first feature vector in the N feature vectors as L third feature vectors, wherein the sum of L and M is N; extracting the first X feature parameters from each of the L third feature vectors, and extracting the first X feature parameters from each third feature vector. The first X feature parameters of constitute a fourth feature vector corresponding to the third feature vector, and obtain L fourth feature vectors; calculate the probability density value of each second feature vector in the M second feature vectors, and obtain M first probability density values; take the first probability density value that is less than the fourth preset threshold value in the M first probability density values ​​as the first abnormality threshold; determine the model score of the initial model when the first X feature parameters are selected as the input feature combination according to the first abnormality threshold and the L fourth feature vectors, wherein the model score is used to evaluate the performance index of the initial model in identifying security defect reports; associate the model score with the first abnormality threshold to obtain a first set.

[0012] Optionally, the target feature parameter combination and the target anomaly threshold in the initial model are determined based on T first sets, including: selecting a model score whose model score is greater than a fifth preset threshold from the T first sets as the target model score; using the feature parameter combination corresponding to the target model score as the target feature parameter combination; and using the first anomaly threshold associated with the target model score as the target anomaly threshold.

[0013] Optionally, determining the analysis result of the target defect report based on the probability density value includes: when the probability density value of the target feature vector is greater than or equal to the target abnormality threshold, treating the target defect report as a safety defect report; when the probability density value of the target feature vector is less than the target abnormality threshold, treating the target defect report as a non-safety defect report. Optionally, determining the target feature parameter combination and the target abnormality threshold in the initial model based on T first sets includes: selecting a model score whose model score is greater than a fifth preset threshold from the T first sets as the target model score; using the feature parameter combination corresponding to the target model score as the target feature parameter combination; and using the first abnormality threshold associated with the target model score as the target abnormality threshold.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, there is also provided an analysis device for software defect reports, comprising: an acquisition unit, which acquires a target defect report, wherein the target defect report is used to record defect information of the software; an extraction unit, which extracts at least one target feature from the target defect report according to a target feature parameter combination that satisfies preset conditions, and converts each target feature into a target feature vector, wherein the preset conditions are used to determine the feature parameters selected when extracting features from the target defect report; a determination unit, which inputs the target feature vector into a target model, determines a probability density value of the target feature vector through the target model, and determines an analysis result of the target defect report according to the probability density value, wherein the probability density value is used to characterize distribution change information of the feature value of the target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports according to different feature combinations.

[0015] According to another aspect of the present application, a computer-readable storage medium is provided, which includes a stored executable program, wherein when the executable program runs, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned software defect report analysis method.

[0016] According to another aspect of the present application, an electronic device is provided, including: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned software defect report analysis method is executed when the program is running.

[0017] According to another aspect of the present application, a computer program product is also provided, including computer instructions, which implement the steps of the above-mentioned software defect report analysis method when executed by a processor.

[0018] In the present application, a target defect report is first obtained, wherein the target defect report is used to record the defect information of the software, and then at least one target feature is extracted from the target defect report according to a target feature parameter combination that meets preset conditions, and each target feature is converted into a target feature vector, wherein the preset conditions are used to determine the feature parameters selected when extracting features from the target defect report, and finally the target feature vector is input into a target model, and the probability density value of the target feature vector is determined by the target model, and the analysis result of the target defect report is determined according to the probability density value, wherein the probability density value is used to characterize the distribution change information of the feature value of the target feature corresponding to the target feature vector, and the target model is a neural network model obtained by training for software defect reports according to different feature combinations, that is, through data-driven automatic feature extraction and model recognition, the purpose of automatically identifying and accurately classifying software security defects is achieved, thereby achieving the technical effect of improving the accuracy of security defect detection, thereby solving the technical problem of low accuracy of security defect detection in the prior art due to reliance on manual review to detect security defects in user defect reports. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 A hardware structure block diagram of a computer terminal for implementing a method for analyzing software defect reports is shown;

[0021] Figure 2 is a flowchart of an optional software defect report analysis method according to an embodiment of the present application;

[0022] Figure 3 It is a schematic diagram of an optional software defect report analysis device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0026] According to an embodiment of the present application, an embodiment of a method for analyzing software defect reports is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] It should be noted that a data processing system can be used as the execution subject of the software defect report analysis method of the embodiment of the present application. It is understandable that the software defect report analysis method provided in the embodiment of the present application can also be executed by other systems or devices, and the embodiment of the present application does not specifically limit this.

[0028] The method embodiments provided in the present application may be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing the analysis method of software defect report is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0029] It should be noted that the above-mentioned one or more processors 102 and / or other data processing circuits may generally be referred to as "data processing circuits" in this article. The data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit may be a single independent processing module, or may be fully or partially integrated into any of the other components in the computer terminal 10 (or mobile device). As in the analysis method of software defect reports involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0030] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the analysis method of the software defect report in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the analysis method of the software defect report described above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0031] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0033] Under the above operating environment, this application provides Figure 2 The analysis method of software defect reports shown. Figure 2 FIG. 1 is a flowchart of an optional method for analyzing software defect reports according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0034] Step S201, obtaining a target defect report.

[0035] In step S201, the target defect report is used to record defect information of the software.

[0036] Optionally, a defect report is a report submitted by a user (non-tester) when a problem or defect is found when using the software in production. Defect reports include, but are not limited to, the following key contents: user information (including the name of the user submitting the report, contact information or account information of the software, so that the development team can communicate with the user and confirm the problem), defect description (the problem or defect encountered, including the scenario where the problem occurs, operation steps, trigger conditions, etc.), actual performance (the actual performance of the software when the problem occurs, such as interface anomalies, functional failures, performance degradation, etc.), expected performance (the functions and performance that the software is expected to have), usage environment and conditions (the environment and conditions when using the software, such as operating system version, device model, network status, etc.), and problem impact (whether it affects work efficiency, whether it causes data loss, etc.).

[0037] Optionally, the data processing system obtains a defect report from a user for analysis.

[0038] Step S202: extract at least one target feature from the target defect report according to a target feature parameter combination that meets a preset condition, and convert each target feature into a target feature vector.

[0039] In step S202, the preset conditions are used to determine the feature parameters selected when extracting features from the target defect report.

[0040] Optionally, the data processing system extracts key information (target features) from the target defect report based on a combination of target feature parameters that meet preset conditions. This information can describe the characteristics of the software defect, such as the functional module to which the defect belongs, the priority of the defect, etc., and converts the target features into a quantitative representation suitable for input into a neural network model to obtain a target feature vector.

[0041] Step S203: input the target feature vector into the target model, determine the probability density value of the target feature vector through the target model, and determine the analysis result of the target defect report according to the probability density value.

[0042] In step S203, the probability density value is used to characterize the distribution change information of the feature value of the target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports based on different feature combinations.

[0043] Optionally, the data processing system inputs the target feature vector into the target model to obtain a probability density value corresponding to the target feature vector, and finally determines the analysis result of the target defect report according to the probability density value.

[0044] It can be seen from the contents of steps S201 to S203 that in the present application, a target defect report is first obtained, wherein the target defect report is used to record the defect information of the software, and then at least one target feature is extracted from the target defect report according to a target feature parameter combination that meets preset conditions, and each target feature is converted into a target feature vector, wherein the preset conditions are used to determine the feature parameters selected when extracting features from the target defect report, and finally the target feature vector is input into the target model, the probability density value of the target feature vector is determined by the target model, and the analysis result of the target defect report is determined according to the probability density value, wherein the probability density value is used to characterize the distribution change information of the feature value of the target feature corresponding to the target feature vector, and the target model is a neural network model obtained by training the software defect report according to different feature combinations, that is, through data-driven automatic feature extraction and model recognition, the purpose of automatically identifying and accurately classifying software security defects is achieved, thereby achieving the technical effect of improving the accuracy of security defect detection, thereby solving the technical problem of low accuracy of security defect detection in the prior art due to relying on manual review to detect security defects in user defect reports.

[0045] In an optional embodiment, the data processing system first extracts N feature vectors from historical security defect reports and historical non-security defect reports, where N is an integer greater than 1, and then selects M feature vectors corresponding to the security defect reports from the N feature vectors as M first feature vectors, where M is a positive integer less than N, and then constructs an initial model based on the target algorithm and the M first feature vectors, wherein the target algorithm is used to determine the security defect information in the security defect report by calculating the probability density value of the first feature vector, and finally inputs the feature vectors other than the first feature vector of the N feature vectors into the initial model, and performs multiple target operations on the initial model to obtain the target model, wherein each target operation is used to select at least one feature parameter corresponding to each feature vector input into the initial model as a feature combination, and determine the model performance information after the initial model is trained based on the feature combination.

[0046] Optionally, security defects involve software security risks and data leakage and other issues, and non-security defects include but are not limited to functional defects (mainly affecting important features of the software, user interface and product interface. Specifically, they may manifest as functional errors, missing functions and ambiguous understanding of requirements, etc.), logical defects (when the software does not conform to the business logic, logical defects will occur, such as incorrect branches, ignoring extreme conditions, unnecessary functions, conditional test errors, incorrect loops, incorrect calculation order or logical order errors, etc.), data problems (mainly affecting the validity, boundaries and scope of data), interface problems (involving human-computer interaction of the software, such as screen display format, confirmation of user input, functional validity and page layout defects), performance defects (the software has performance bottlenecks during operation, such as long response time or slow processing speed), compatibility defects (when the software has problems in different operating systems, hardware platforms or browsers, the software cannot run normally), maintainability defects (the software code is highly coupled and difficult to maintain or expand, resulting in increased difficulty and cost of subsequent software maintenance).

[0047] Optionally, the data processing system obtains different security defect reports and non-security defect reports from the information security vulnerability library and defect management system, and then uses natural language processing tools to extract N feature vectors from the security defect reports and non-security defect reports, where one security defect report corresponds to one feature vector, and one non-security defect report corresponds to one feature vector.

[0048] It should be noted that the information security vulnerability database is a platform for centrally collecting, organizing, analyzing and publishing information on information security vulnerabilities. It is usually built and operated by a professional information security organization or team. It collects vulnerability information through various channels, including from software developers, security researchers, etc. After being organized and analyzed, these vulnerability information will be classified, rated and published so that relevant units and individuals can promptly understand and respond to potential security risks.

[0049] It should be noted that the defect management system is a process used to manage any defects in the software life cycle to ensure that defects are not lost. This system mainly relies on tracking management tools. The main functions include but are not limited to:

[0050] 1) Defect collection: Whether it is feedback from users in production or problems found by testers when executing security defects, the defect management system can effectively receive and process them;

[0051] 2) Defect assignment and follow-up: The defect management system can assign the collected defects and follow up according to the roles and permissions of team members. For example, testers can test defects, developers are responsible for fixing defects, and team administrators are responsible for monitoring the progress of the whole process;

[0052] 3) Improve the quality of defect reports: The system can provide accurate defect data for defect reports or directly generate defect reports with unified format and content.

[0053] Optionally, the data processing system uses natural language processing tools to perform preliminary checks on all acquired security defect reports and non-security defect reports, including but not limited to detecting whether there is a clear end edge between each security defect; detecting whether each security defect is written based on a fixed format and meets the most basic structure, such as user information, defect description, actual performance, expected performance, usage environment and conditions, and problem impact; removing illegal characters and unnecessary spaces and special symbols.

[0054] Optionally, the data processing system uses a natural language processing tool to extract the same features in each security defect report and non-security defect report, and compose corresponding feature vectors to obtain N feature vectors.

[0055] Optionally, for the feature extraction process, taking a security defect report as an example, if T features are extracted from the security defect report, the data processing system first extracts keywords from the security defect report using a natural language processing tool, calculates the number of keywords hit by the security defect report text, and assigns the number of keywords to the first feature parameter, then extracts the syntactic structure in the security defect report, numbers all syntactic structures, and assigns the syntactic structure number hit by the security defect report text to the second feature parameter, and so on, according to the features to be extracted, the assignment of the remaining feature parameters is completed, and finally the feature vector corresponding to the security defect report is obtained as [x1, x2…x T ], where x represents the characteristic parameter.

[0056] Optionally, the data processing system selects M feature vectors corresponding to security defect reports from N feature vectors as M first feature vectors, wherein the M first feature vectors are all feature vectors corresponding to security defect reports from the information security vulnerability library.

[0057] Optionally, the first eigenvector is labeled X (i) , where 1≤i≤M, then the set of M first eigenvectors is represented as Dataset X {X (1) , X (2) , X (3) , …, X (M)}.

[0058] Optionally, the target algorithm is a density-based anomaly detection algorithm, such as Gaussian distribution, which is used to determine whether the report is a security defect report by calculating the probability density value of each feature vector.

[0059] Optionally, the data processing system constructs an initial model according to the target algorithm and the M first feature vectors.

[0060] Optionally, the data processing system inputs feature vectors other than the first feature vector among the N feature vectors into the initial model, and performs multiple target operations on the initial model, each target operation is used to select at least one feature parameter corresponding to each feature vector input into the initial model as a feature combination, and determine the model performance information after the initial model is trained based on the feature combination, and finally obtain the target model.

[0061] From the above content, it can be seen that the data processing system extracts N feature vectors from a large number of historical reports, and further selects M feature vectors that are particularly related to security defects, which improves the pertinence and effectiveness of the model in identifying security defects. The model is constructed and optimized through a specific target algorithm, so that the model can automatically learn and identify security defects based on the probability density value of the feature vector, thereby improving the automation and accuracy of defect detection, and using the remaining vectors in the N feature vectors to perform multiple target operations (such as training and verification) on the initial model, which helps to continuously improve and optimize the performance of the model and ensure that the model has a high detection accuracy when facing new defect reports. Through automated feature extraction and model training, the data processing system reduces the reliance on manual review, overcomes the subjectivity, omissions and misjudgments that may exist in manual review, and improves the objectivity and reliability of security defect detection.

[0062] In an optional embodiment, the data processing system calculates the expected value and variance of all characteristic parameters in each of the M first eigenvectors according to the target algorithm to obtain a Gaussian distribution model of the characteristic parameters, and then determines the probability density values ​​of the T characteristic parameters in each of the M first eigenvectors according to the Gaussian distribution model, and then determines M probability density values ​​according to the probability density values ​​of the T characteristic parameters in each first eigenvector, and then selects a probability density value less than a first preset threshold from the M probability density values ​​as an initial abnormality threshold of the initial model, and finally obtains the initial model according to the Gaussian distribution model, the M probability density values ​​and the initial abnormality threshold.

[0063] Optionally, each feature vector includes T feature parameters, which are arranged in order, with the feature parameters with higher priority being at the front. Different feature parameters are independent of each other and all obey Gaussian distribution, where Gaussian distribution refers to the distribution probability of a value. The shape of Gaussian distribution is a bell-shaped curve. If the random variable x obeys a mathematical expectation of μ and variance of σ 2 The Gaussian distribution of μ determines the position of the bell curve, and its standard deviation σ determines the amplitude of the distribution. The Gaussian distribution when μ = 0 and σ = 1 is the standard distribution.

[0064] Optionally, the first eigenvector X( i ) is shown in formula (1):

[0065]

[0066] Among them, X (i) represents the i-th security defect report, x T It is represented as the Tth feature parameter in the feature vector corresponding to the i-th security defect report, and 1≤i≤M.

[0067] Optionally, the characteristic parameters are known It follows a Gaussian distribution and has M sample values ​​(M security defect reports). The jth characteristic parameter is The mean (or expected value) μ of the Gaussian distribution curve xj and variance The calculation formulas are shown in formula (2) and formula (3) respectively:

[0068]

[0069] Where i represents the i-th security defect report, M is the number of security defect reports, It is represented as the jth characteristic parameter in the characteristic vector corresponding to the i-th security defect report, 1≤j≤T, μ xj for The expected value of for The variance of Represents the sum of the j-th feature parameters in each of the M feature vectors.

[0070] Optionally, the jth feature parameter in the feature vector corresponding to the i-th security defect report The probability density value of is shown in formula (4):

[0071]

[0072] in, Represents characteristic parameters The probability density value of .

[0073] Optionally, for the feature vector X of the i-th security defect report (i) The probability density value of is the product of the probability density values ​​of T feature parameters, as shown in formula (5):

[0074]

[0075] Among them, p(X (i) ) represents the feature vector X of the i-th security defect report (i) The probability density value of represents the probability density value of the first feature parameter in the feature vector corresponding to the i-th security defect report, Represents the probability density value of the Tth feature parameter in the feature vector corresponding to the i-th security defect report.

[0076] Optionally, formula (5) is expanded to become formula (6):

[0077]

[0078] in, Represents the product of the probability density values ​​of the T feature parameters in the feature vector corresponding to the i-th security defect report.

[0079] Optionally, the data processing system selects the minimum probability density value from the M probability density values ​​as the abnormality threshold of the initial model, and obtains the initial model according to the Gaussian distribution model of all characteristic parameters and the abnormality threshold.

[0080] From the above content, it can be seen that the data processing system provides a basis for subsequent model training by sorting the feature parameters according to the weight size, thereby improving the model training efficiency. The data processing system uses the statistical characteristics of the feature parameters to construct a Gaussian distribution model, which can more accurately identify the key features in the security defect report, thereby improving the accuracy of defect identification. The model based on Gaussian distribution can adapt to the distribution changes of the feature parameters in the defect report, and even when the feature parameter value deviates from the normal range, it can accurately judge the abnormality by calculating the probability density value.

[0081] In an optional embodiment, the data processing system first performs T target operations on the initial model based on the feature vectors other than the first feature vector in the N feature vectors to obtain T first sets, wherein each first set includes model performance information determined for each target operation based on the selected feature parameter combination, and then determines the target feature parameter combination and the target abnormality threshold in the initial model based on the T first sets, wherein the target abnormality threshold is an abnormality threshold that satisfies a first preset condition, wherein the first preset condition is used to constrain the difference between the detection result of the initial model and the actual result to be less than a third preset threshold, and finally determines the target model based on the initial model, the target feature parameter combination and the target abnormality threshold.

[0082] Optionally, the data processing system first performs T target operations on the initial model, which involve all feature vectors except the first feature vector from the N feature vectors. In each target operation, the system selects a set of feature parameter combinations to evaluate the performance of the model in identifying security defects. After each target operation, the system calculates the performance indicators of the model, such as precision, recall, etc., based on the selected feature parameter combination. This information constitutes a first set. After T operations, we get T first sets, each of which reflects the performance of the model under a specific feature combination. Next, the data processing system selects the feature parameter combination and abnormality threshold corresponding to the optimal model performance from the T first sets. Finally, the data processing system determines the final target model based on the selected feature parameter combination, abnormality threshold and the structure of the initial model.

[0083] Optionally, the feature vectors other than the first feature vector in the N feature vectors include K positive samples, i.e., security defect reports, and S negative samples, i.e., non-security defect reports. The feature vectors corresponding to the positive samples are recorded as Y (i) , where 1≤i≤K, then Y (i) As shown in formula (7):

[0084]

[0085] Among them, y1 is the first feature parameter in the feature vector corresponding to the positive sample, y T is the Tth feature parameter in the feature vector corresponding to the positive sample.

[0086] It should be noted that positive samples and negative samples are statistical samples in the binary classification problem. Positive samples refer to samples belonging to a certain category, and negative samples refer to samples that do not belong to a certain category. A sample is either a positive sample or a negative sample. In this embodiment, the security defects belong to positive samples, while the non-security defects belong to negative samples.

[0087] Optionally, the eigenvector corresponding to the negative sample is recorded as Z (i) , where 1≤i≤S, Z (i) As shown in formula (8):

[0088]

[0089] Among them, z1 is the first feature parameter in the feature vector corresponding to the positive sample, z T is the Tth feature parameter in the feature vector corresponding to the positive sample.

[0090] From the above content, it can be seen that through multiple rounds of testing, the data processing system can screen out the best feature parameter combinations. These combinations best represent the characteristics of security defect reports, thereby significantly improving the detection accuracy of the model and reducing false positives and negatives. Based on the selected target anomaly threshold, it can ensure that the deviation between the model's detection results and the actual results is within an acceptable range, thereby optimizing the overall performance of the model.

[0091] In an optional embodiment, the data processing system extracts the first X feature parameters from each of the M first feature vectors, and uses the first X feature parameters extracted from each of the first feature vectors to form a second feature vector corresponding to the first feature vector, thereby obtaining M second feature vectors, wherein X is a positive integer less than or equal to T, and the value of X used in each target operation is different, and L feature vectors other than the first feature vector in the N feature vectors are used as L third feature vectors, wherein the sum of L and M is N, and the first X feature parameters are extracted from each of the L third feature vectors, and the first X feature parameters extracted from each of the third feature vectors are used as X feature parameters constitute a fourth feature vector corresponding to the third feature vector, and L fourth feature vectors are obtained. Then, the probability density value of each second feature vector in the M second feature vectors is calculated to obtain M first probability density values. Then, the first probability density value that is less than the fourth preset threshold value in the M first probability density values ​​is used as the first abnormality threshold. Then, according to the first abnormality threshold and the L fourth feature vectors, the model score of the initial model when the first X feature parameters are selected as the input feature combination is determined, wherein the model score is used to evaluate the performance indicators of the initial model in identifying security defect reports. Finally, the model score is associated with the first abnormality threshold to obtain a first set.

[0092] Optionally, when X is 1, that is, each eigenvector has only one eigenvalue, the first eigenvector is represented by X (i) =[x1], then the feature vector X of the i-th security defect report (i) The probability density value of is shown in formula (9):

[0093]

[0094] Among them, p(X (i) ) is the probability density value of the first eigenvector corresponding to the i-th security defect report, μ x1 is the expected value of x1, is the variance of x1, Represents the value of x1.

[0095] Optionally, the M first eigenvectors may obtain M probability density values, and the minimum probability density value among the M probability density values ​​is taken as the first abnormality threshold ε1.

[0096] Optionally, the data processing system takes all feature vectors except the first feature vector among the N feature vectors as third feature vectors to obtain L third feature vectors, and then extracts the first X feature parameters from each feature vector of the L third feature vectors to form a fourth feature vector corresponding to the third feature vector to obtain L fourth feature vectors, and then determines the model score of the initial model when one feature parameter is selected as the input feature combination based on the first abnormality threshold and the L fourth feature vectors, and finally associates the model score with the first abnormality threshold to obtain a first set.

[0097] Optionally, when X is 2, that is, each eigenvector has two eigenparameters (x1, x2), then the first eigenvector X (i) It is expressed as shown in formula (10):

[0098]

[0099] Optionally, the feature vector X of the i-th security defect report text (i) The probability density value of is shown in formula (11):

[0100]

[0101] in, Represents the product of the probability density values ​​of the two feature parameters in the first feature vector corresponding to the i-th security defect report, 1≤i≤M, 1≤j≤2.

[0102] Optionally, when the characteristic parameter is 2, M probability density values ​​are obtained by the same logic, and the minimum probability density value among the M probability density values ​​is taken as the first abnormal threshold corresponding to the characteristic parameter 2. When X is other values, the same logic can be used.

[0103] Optionally, the data processing system determines the precision and recall of the initial model according to the first abnormality threshold and the L fourth eigenvectors, and then determines the model score of the initial model when the first X feature variables are selected as the input feature combination according to the precision and the recall.

[0104] Optionally, when X is 1, the data processing system determines the precision (denoted as P) and recall (denoted as R) of the initial model according to the first abnormal threshold and the L fourth eigenvectors, and then determines the model score of the initial model when selecting one feature parameter as the input feature combination according to the precision and recall, i.e., the F1 value. The calculation formula is shown in (12):

[0105]

[0106] Among them, F11 is the model score when one feature parameter is selected as the input feature combination, P is the model precision when one feature parameter is selected as the input feature combination, and R is the model recall when one feature parameter is selected as the input feature combination.

[0107] It should be noted that the F1 value is a comprehensive indicator for evaluating the performance of a classification model. It represents the weighted harmonic mean of precision and recall. The core idea of ​​the F1 value is to maximize the precision and recall while minimizing the difference between the two.

[0108] Optionally, after obtaining the model score, the data processing system will associate the model score with the first abnormal threshold to obtain a first set represented as (F11, ε1), which is the first set of the model when X is 1.

[0109] Optionally, the L fourth eigenvectors include K fifth eigenvectors and S sixth eigenvectors, wherein the fifth eigenvector is a eigenvector corresponding to a security defect report but different from the second eigenvector, and the sixth eigenvector is a eigenvector corresponding to a non-security defect report. The data processing system first calculates the probability density value of each fifth eigenvector in the K fifth eigenvectors, and obtains K second probability density values ​​based on the probability density value of each fifth eigenvector, then calculates the probability density value of each sixth eigenvector in the S sixth eigenvectors, and obtains S third probability density values ​​based on the probability density value of each sixth eigenvector, and then determines the precision and recall of the initial model based on the first abnormality threshold, the K second probability density values, and the S third probability density values.

[0110] Optionally, when X is 1, the fifth eigenvector is represented by Y (i) =[y1], then the feature vector Y of the i-th positive sample (i) The probability density value of is shown in formula (13):

[0111]

[0112] Among them, p(Y (i) ) is the probability density value of the feature vector of the i-th positive sample, 1≤i≤K.

[0113] Optionally, given that there are K positive samples, substituting them into the above formula, we can get a set of K probability density values ​​for the feature variable y1, which is represented as Dataset1{p (1) , p (2) , p (3) ,…,p (k)}.

[0114] Optionally, the sixth eigenvector is denoted as Z (i)=[z1], then the feature vector Z of the i-th negative sample (i) The probability density value of is shown in formula (14):

[0115]

[0116] Among them, p(Z (i) ) is the probability density value of the feature vector of the i-th negative sample, 1≤i≤S.

[0117] Optionally, given that there are S positive samples, substitute into the above formula to obtain the characteristic variable Z (i) The set of S probability density values ​​is represented as Dataset1{p (1) , p (2) , p (3) ,…,p (S)}.

[0118] Optionally, the data processing system determines the precision and recall of the initial model based on the first abnormality threshold, K second probability density values, and S third probability density values.

[0119] Optionally, if the i-th second probability density value among the K second probability density values ​​is greater than or equal to the first abnormal threshold, the data processing system uses the security defect report corresponding to the i-th second probability density value as the first sample, wherein the first sample is used to characterize the security defect report correctly identified by the initial model, wherein i is an integer greater than or equal to 1; if the i-th second probability density value among the K second probability density values ​​is less than the first abnormal threshold, the data processing system uses the security defect report corresponding to the i-th second probability density value as the second sample, wherein the second sample is used to characterize the security defect report incorrectly identified by the initial model; if the j-th third probability density value among the S third probability density values ​​is greater than or equal to the first abnormal threshold, the data processing system uses the non-security defect report corresponding to the j-th third probability density value as the third sample, wherein the third sample is used to characterize the non-security defect report correctly identified by the initial model, wherein j is an integer greater than or equal to 1; and then the data processing system determines the precision of the initial model based on the number of first samples and the number of second samples, and determines the recall of the initial model based on the number of first samples and the number of third samples.

[0120] Optionally, the data processing system compares the probability density value corresponding to each sample in the K positive samples with the first abnormal threshold, accumulates the positive samples greater than or equal to the first abnormal threshold into TP (first sample), and accumulates the positive samples less than the first abnormal threshold into FP (second sample), as shown in formula (15):

[0121]

[0122] Among them, p (i) Represents the probability density value corresponding to the i-th sample.

[0123] Optionally, the data processing system compares the probability density value corresponding to each sample in the S negative samples with the first abnormal threshold, accumulates the positive samples greater than or equal to the first abnormal threshold into TN (third sample), and accumulates the positive samples less than the first abnormal threshold into FN (fourth sample), as shown in formula (16):

[0124]

[0125] Among them, p (i) Represents the probability density value corresponding to the i-th sample.

[0126] It should be noted that TP samples refer to samples that are actually security defects and are judged as security defects by the model; FP samples refer to samples that are actually security defects but are judged as non-security defects by the model; TN samples refer to samples that are actually non-security defects but are judged as security defects by the model; FN samples refer to samples that are actually non-security defects and are judged as non-security defects by the model.

[0127] Optionally, the data processing system calculates the accuracy of the model according to the obtained TP and FP, as shown in formula (17):

[0128]

[0129] Among them, P is the precision of the model, TP is the number of true positive samples, and FP is the number of false positive samples.

[0130] Optionally, the data processing system calculates the recall rate of the model according to the obtained TP and FN, as shown in formula (18):

[0131]

[0132] Among them, R is the recall rate of the model, TP is the number of true samples, and FN is the number of false negative samples.

[0133] From the above content, it can be seen that the data processing system can more accurately identify which feature parameter combinations are most suitable for the identification of security defect reports by dynamically adjusting the number of feature parameters (i.e., the value of X), and the system evaluates the model recognition performance through model scoring to ensure the accuracy and efficiency of the model, and the data processing system optimizes the model performance by quantitatively evaluating the precision and recall of the model, and determining the score of the model under different feature variable combinations, thereby improving the accuracy of security defect detection. The data processing system can quantitatively evaluate the precision of the model by identifying the report with a second probability density value greater than or equal to the first abnormal threshold as the first sample, and identifying the report with a second probability density value less than the first abnormal threshold as the second sample. At the same time, by identifying the report with a third probability density value greater than or equal to the first abnormal threshold as the third sample, the system can calculate the recall rate of the model. This evaluation mechanism provides an intuitive quantitative indicator for the performance of the model, which helps to continuously optimize the recognition ability of the model.

[0134] In an optional embodiment, the data processing system selects a model score whose model score is greater than a fifth preset threshold from the T first sets as the target model score, then uses the feature parameter combination corresponding to the target model score as the target feature parameter combination, and then uses the first anomaly threshold associated with the target model score as the target anomaly threshold.

[0135] Optionally, the data processing system performs T target operations again to obtain T first sets, selects the largest model score from the T first sets as the target model score, and then uses the feature parameter combination corresponding to the obtained target model score as the target feature parameter combination (including the feature combination of the first r feature parameters, where r is a positive integer less than or equal to T), and uses the first abnormality threshold associated with the target model score as the target abnormality threshold (denoted as ε optimal ).

[0136] From the above content, it can be seen that the data processing system can determine the target feature parameter combination and target anomaly threshold of the model through the T first sets obtained according to the target operation. This not only improves the recognition accuracy of the model, but also reduces the false alarm rate, ensures the reliability of the detection results, helps to reduce the burden of manual review, and improves the efficiency of automated detection.

[0137] In an optional embodiment, the data processing system treats the target defect report as a safety defect report when the probability density value of the target feature vector is greater than or equal to the target abnormality threshold, and treats the target defect report as a non-safety defect report when the probability density value of the target feature vector is less than the target abnormality threshold. Target feature parameter combination.

[0138] Optionally, after the data processing system obtains one or a series of defect reports from the target user, the system then extracts feature parameters of the obtained target defect report based on the target feature parameter combination to obtain a target feature vector. Finally, the extracted target feature vector is input into the target model to detect security defects.

[0139] Optionally, the data processing system obtains s new defect reports from the user, and based on the natural language processing tool, obtains a feature vector set based on r features as Dataset W {W (1) , W (2) , W (3) , …, W (s)}, where each eigenvector W (i) As shown in formula (19):

[0140]

[0141] Among them, W (i) is the feature vector of the i-th defect report in the s new defect reports, w1 is the first feature parameter in the feature vector, and w r is the rth characteristic parameter in the characteristic vector.

[0142] Optionally, based on the above content, the probability density value of each new defect report is calculated as shown in formula (20):

[0143]

[0144] Among them, p(W (i) ) is the probability density value of the i-th defect report in the acquired new defect report, 1≤i≤s, 1≤j≤r, Represents the product of the probability density values ​​of all characteristic parameters in the i-th defect report in the obtained new defect report.

[0145] Optionally, the data processing system obtains the probability density value p(W (i) ) and the optimal anomaly threshold ε optimal Compare, when p(W (i) )>=ε optimal When , the defect report is predicted to be valid security defect data, otherwise it is a suspicious security defect (non-security defect report) and enters the manual review stage. The judgment process is shown in (21):

[0146]

[0147] Among them, ε optimal is the target abnormal threshold.

[0148] Optionally, the data processing system adds 50% of the new security defect reports with valid detection results to the training set of the model, and adds the other 50% to the positive samples of the model test set, and passes the new security defect reports with suspicious detection results to the manual review link, and then adds 50% of the new security defect reports determined by manual review to the training set, and 50% to the positive samples of the test set, and finally adds the new security defect reports determined by manual review to the negative samples of the test set to facilitate subsequent model optimization.

[0149] From the above content, it can be seen that the data processing system can automatically and quickly identify security defects in user defect reports, greatly reducing the workload of manual review and improving identification efficiency and processing speed.

[0150] The embodiment of the present application also provides an analysis device for software defect reports. It should be noted that the analysis device for software defect reports in the embodiment of the present application can be used to execute the analysis method for software defect reports provided in the embodiment of the present application. The analysis device for software defect reports provided in the embodiment of the present application is introduced below.

[0151] According to an embodiment of the present application, a device for implementing the above-mentioned software defect report analysis method is also provided. Figure 3 is a schematic diagram of an optional software defect report analysis device according to an embodiment of the present application, such as Figure 3 As shown, the device includes: an acquisition unit 301, an extraction unit 302, and a determination unit 303.

[0152] Optionally, an acquisition unit 301 acquires a target defect report, wherein the target defect report is used to record defect information of the software; an extraction unit 302 extracts at least one target feature from the target defect report according to a target feature parameter combination that satisfies preset conditions, and converts each target feature into a target feature vector, wherein the preset conditions are used to determine feature parameters selected when performing feature extraction on the target defect report; a determination unit 303 inputs the target feature vector into a target model, determines a probability density value of the target feature vector through the target model, and determines an analysis result of the target defect report based on the probability density value, wherein the probability density value is used to characterize distribution change information of feature values ​​of the target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports based on different feature combinations.

[0153] Optionally, the determination unit 303 includes: a first extraction subunit, a first selection subunit, a first construction subunit, and a first processing subunit. The first extraction subunit is used to extract N feature vectors from historical security defect reports and historical non-security defect reports, where N is an integer greater than 1; the first selection subunit is used to select M feature vectors corresponding to the security defect reports from the N feature vectors as M first feature vectors, where M is a positive integer less than N; the first construction subunit is used to construct an initial model according to the target algorithm and the M first feature vectors, where the target algorithm is used to determine the security defect information in the security defect report by calculating the probability density value of the first feature vector; the first processing subunit is used to input the feature vectors other than the first feature vector from the N feature vectors into the initial model, and perform multiple target operations on the initial model to obtain the target model, where each target operation is used to select at least one feature parameter corresponding to each feature vector input to the initial model as a feature combination, and determine the model performance information after the initial model is trained according to the feature combination.

[0154] Optionally, the first construction subunit includes: a first calculation module, a first determination module, a second determination module, a first selection module, and a third determination module. Among them, the first calculation module is used to calculate the expected value and variance of all characteristic parameters in each of the M first characteristic vectors according to the target algorithm, and obtain the Gaussian distribution model of the characteristic parameters; the first determination module is used to determine the probability density value of the T characteristic parameters in each of the M first characteristic vectors according to the Gaussian distribution model; the second determination module is used to determine the M probability density values ​​according to the probability density values ​​of the T characteristic parameters in each first characteristic vector; the first selection module is used to select a probability density value less than a first preset threshold from the M probability density values ​​as the initial abnormality threshold of the initial model; the third determination module is used to obtain the initial model according to the Gaussian distribution model, the M probability density values ​​and the initial abnormality threshold.

[0155] Optionally, the first processing subunit includes: a first processing module, a fourth determination module, and a fifth determination module. The first processing module is used to perform T target operations on the initial model according to the feature vectors other than the first feature vector in the N feature vectors to obtain T first sets, wherein each first set includes model performance information determined according to the selected feature parameter combination for each target operation; the fourth determination module is used to determine the target feature parameter combination and the target abnormality threshold in the initial model according to the T first sets, wherein the target abnormality threshold is an abnormality threshold that satisfies the first preset condition, wherein the first preset condition is used to constrain the difference between the detection result of the initial model and the actual result to be less than the third preset threshold; the fifth determination module is used to determine the target model according to the initial model, the target feature parameter combination, and the target abnormality threshold.

[0156] Optionally, the first processing module includes: a first extraction submodule, a first determination submodule, a second extraction submodule, a first calculation submodule, a second determination submodule, a third determination submodule, and a first processing submodule. The first extraction submodule is used to extract the first X feature parameters from each of the M first feature vectors, and form the first X feature parameters extracted from each first feature vector into a second feature vector corresponding to the first feature vector, so as to obtain M second feature vectors, wherein X is a positive integer less than or equal to T, and the value of X used in each target operation is different; the first determination submodule is used to use L feature vectors other than the first feature vector in the N feature vectors as L third feature vectors, wherein the sum of L and M is N; the second extraction submodule is used to extract the first X feature parameters from each of the L third feature vectors, and form the first X feature parameters extracted from each third feature vector into a second feature vector corresponding to the first feature vector. The fourth eigenvector corresponding to the third eigenvector is used to obtain L fourth eigenvectors; the first calculation submodule is used to calculate the probability density value of each second eigenvector in the M second eigenvectors to obtain M first probability density values; the second determination submodule is used to use the first probability density value that is less than the fourth preset threshold value among the M first probability density values ​​as the first abnormality threshold; the third determination submodule is used to determine the model score of the initial model when the first X feature parameters are selected as the input feature combination according to the first abnormality threshold and the L fourth eigenvectors, wherein the model score is used to evaluate the performance index of the initial model in identifying security defect reports; the first processing submodule is used to associate the model score with the first abnormality threshold to obtain a first set.

[0157] Optionally, the fourth determination module includes: a first selection submodule, a fourth determination submodule, and a fifth determination submodule. The first selection submodule is used to select a model score whose model score is greater than a fifth preset threshold from the T first sets as the target model score; the fourth determination submodule is used to use the feature parameter combination corresponding to the target model score as the target feature parameter combination; and the fifth determination submodule is used to use the first abnormality threshold associated with the target model score as the target abnormality threshold.

[0158] Optionally, the determination unit 303 includes: a second processing subunit and a third processing subunit. The second processing subunit is used to treat the target defect report as a security defect report when the probability density value of the target feature vector is greater than or equal to the target abnormality threshold; the third processing subunit is used to treat the target defect report as a non-security defect report when the probability density value of the target feature vector is less than the target abnormality threshold.

[0159] According to another aspect of the present application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned software defect report analysis method.

[0160] According to another aspect of the present application, an electronic device is provided, including: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned software defect report analysis method is executed when the program is running.

[0161] According to another aspect of the present application, a computer program product is also provided, including computer instructions, which implement the steps of the above-mentioned software defect report analysis method when executed by a processor.

[0162] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0163] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0165] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0166] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0167] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0168] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for analyzing software defect reports, characterized in that: include: Obtaining a target defect report, wherein the target defect report is used to record defect information of the software; Extracting at least one target feature from the target defect report according to a target feature parameter combination that meets a preset condition, and converting each of the target features into a target feature vector, wherein the preset condition is used to determine the feature parameters selected when extracting features from the target defect report; The target feature vector is input into the target model, the probability density value of the target feature vector is determined by the target model, and the analysis result of the target defect report is determined based on the probability density value, wherein the probability density value is used to characterize the distribution change information of the characteristic value of the target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports based on different feature combinations.

2. The method for analyzing software defect reports according to claim 1, characterized in that: The target model is obtained by the following steps: Extracting N feature vectors from historical security defect reports and historical non-security defect reports, where N is an integer greater than 1; Selecting M feature vectors corresponding to the security defect report from the N feature vectors as M first feature vectors, where M is a positive integer less than N; constructing an initial model according to a target algorithm and the M first feature vectors, wherein the target algorithm is used to determine the security defect information in the security defect report by calculating the probability density value of the first feature vector; The feature vectors other than the first feature vector among the N feature vectors are input into the initial model, and the initial model is subjected to multiple target operations to obtain the target model, wherein each target operation is used to select at least one feature parameter corresponding to each feature vector input into the initial model as a feature combination, and determine the model performance information after the initial model is trained based on the feature combination.

3. The method for analyzing software defect reports according to claim 2, characterized in that: Each of the feature vectors includes T feature parameters, where T is an integer greater than or equal to 1, and the weight corresponding to each feature parameter is positively correlated with the importance of the feature parameter in the model training process. The T feature parameters are sorted according to the weight corresponding to each feature parameter, and an initial model is constructed according to the target algorithm and the M first feature vectors, including: According to the target algorithm, respectively calculate the expected value and variance of all characteristic parameters in each of the M first characteristic vectors to obtain a Gaussian distribution model of the characteristic parameters; Determine, according to the Gaussian distribution model, probability density values ​​of the T characteristic parameters in each of the M first characteristic vectors; Determine M probability density values ​​according to the probability density values ​​of T characteristic parameters in each of the first characteristic vectors; Selecting the probability density value that is less than a first preset threshold value from the M probability density values ​​as the initial abnormality threshold value of the initial model; The initial model is obtained according to the Gaussian distribution model, the M probability density values ​​and the initial abnormality threshold.

4. The method for analyzing software defect reports according to claim 2, characterized in that: Inputting feature vectors other than the first feature vector among the N feature vectors into the initial model, and performing multiple target operations on the initial model to obtain a target model, including: Performing T target operations on the initial model according to feature vectors other than the first feature vector among the N feature vectors, to obtain T first sets, wherein each first set includes model performance information determined according to a selected feature parameter combination for each target operation; Determine a target feature parameter combination and a target abnormality threshold in the initial model according to the T first sets, wherein the target abnormality threshold is an abnormality threshold that satisfies a first preset condition, wherein the first preset condition is used to constrain a difference between a detection result of the initial model and an actual result to be less than a third preset threshold; The target model is determined according to the initial model, the target feature parameter combination and the target abnormality threshold.

5. The method for analyzing software defect reports according to claim 4, characterized in that: The target operation includes the following steps: Extracting the first X feature parameters from each of the M first feature vectors, and forming a second feature vector corresponding to the first feature vector with the first X feature parameters extracted from each first feature vector, to obtain M second feature vectors, where X is a positive integer less than or equal to T, and the value of X used in each target operation is different; Taking L feature vectors other than the first feature vector among the N feature vectors as L third feature vectors, where the sum of L and M is N; Extracting first X feature parameters from each of the L third feature vectors, and forming a fourth feature vector corresponding to the third feature vector using the first X feature parameters extracted from each third feature vector, to obtain L fourth feature vectors; Calculate the probability density value of each of the M second eigenvectors to obtain M first probability density values; Using the first probability density value that is less than a fourth preset threshold value among the M first probability density values ​​as a first abnormality threshold; Determining, according to the first abnormality threshold and the L fourth feature vectors, a model score of the initial model when the first X feature parameters are selected as an input feature combination, wherein the model score is used to evaluate a performance indicator of the initial model in identifying security defect reports; The model score is associated with the first abnormality threshold to obtain a first set.

6. The method for analyzing software defect reports according to claim 5, characterized in that: Determining a target feature parameter combination and a target abnormality threshold in the initial model according to the T first sets includes: Selecting a model score whose model score is greater than a fifth preset threshold from the T first sets as a target model score; Using the feature parameter combination corresponding to the target model score as the target feature parameter combination; A first anomaly threshold associated with the target model score is used as the target anomaly threshold.

7. The method for analyzing software defect reports according to claim 6, characterized in that: Determining the analysis result of the target defect report according to the probability density value includes: When the probability density value of the target feature vector is greater than or equal to the target abnormality threshold, treating the target defect report as a security defect report; When the probability density value of the target feature vector is less than the target abnormality threshold, the target defect report is regarded as a non-safety defect report.

8. A software defect report analysis device, characterized in that: include: An acquisition unit, which acquires a target defect report, wherein the target defect report is used to record defect information of the software; An extraction unit, extracting at least one target feature from the target defect report according to a target feature parameter combination that satisfies a preset condition, and converting each of the target features into a target feature vector, wherein the preset condition is used to determine the feature parameters selected when extracting features from the target defect report; A determination unit inputs the target feature vector into a target model, determines a probability density value of the target feature vector through the target model, and determines an analysis result of the target defect report based on the probability density value, wherein the probability density value is used to characterize distribution change information of a feature value of a target feature corresponding to the target feature vector, and the target model is a neural network model trained for software defect reports based on different feature combinations.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the software defect report analysis method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory storing an executable program; A processor, used to run the program, wherein the program, when running, executes the software defect report analysis method described in any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the software defect report analysis method described in any one of claims 1 to 7 are implemented.

Images