Multi-granularity software defect detection method and system based on software level information

Abstract

The invention relates to the technical field of software development and maintenance, in particular to a multi-granularity software defect detection method and system based on software level information. The invention discloses a multi-granularity software defect detection method based on software level information, which is used for performing word-level defect detection on a target software code. According to the method, the effective code sub-word information in the target software code and the corresponding syntax tree path information are combined, detail information related to code defects can be deeply detected, code detection can be lowered to a word level, and a better and more flexible detection result is achieved. The method solves the problems that the detection of the existing method is limited to coarseness and only software code text information is utilized.

Description

Technical Field

[0001] The present invention relates to the technical field of software development and maintenance, and more specifically to: 1. a multi-granularity software defect detection method based on software hierarchical information; 2. a multi-granularity software defect detection system based on software hierarchical information. Background Art

[0002] As software complexity continues to increase, software defect detection becomes increasingly important in software development and maintenance.

[0003] Software defect detection methods have gone through three stages:

[0004] 1. Phase 1: Static Code Analysis

[0005] Static code analysis techniques assess software quality by checking source code for potential defects. These methods are usually based on rules or grammar analyzers, which are computationally efficient but cannot effectively identify complex logical errors.

[0006] 2. Stage 2: Traditional Machine Learning Methods

[0007] Traditional machine learning methods based on specific feature extraction (such as random forests and support vector machines) have been applied to software defect detection. These methods usually require manual design of features, have limited feature expression capabilities, and are difficult to capture code context and complex semantic relationships.

[0008] 3. Stage 3: Deep Learning Methods

[0009] Deep learning methods have gradually developed in recent years. Among them, the more representative one is: deep neural networks based on code snippets (such as LSTM, Transformer) to automatically extract code features.

[0010] However, most deep learning methods only rely on flat code representation and fail to fully utilize the hierarchical structure and grammatical information of the code. At the same time, they only use simple deep learning models such as LSTM, CNN, etc., which makes it difficult to achieve good detection results.

[0011] In summary, the existing methods have the following problems:

[0012] (1) Detection is still limited to coarse-grained, focusing only on predicting whether a given program fragment or file is vulnerable;

[0013] (2) Only the text information of the software code is used; the hierarchical structure information of the code is not fully utilized. According to experience, code defects often occur in specific hierarchical structures, such as for loop structures, if branch structures, exception capture related code structures, etc. Summary of the invention

[0014] Based on this, it is necessary to provide a multi-granularity software defect detection method and system based on software hierarchical information to address the problem that existing methods are limited to coarse-grained detection and only use software code text information.

[0015] The present invention is implemented by the following technical solutions:

[0016] In a first aspect, the present invention discloses a multi-granularity software defect detection method based on software hierarchical information, which is used for performing word-level defect detection on target software code.

[0017] The multi-granularity software defect detection method based on software hierarchical information includes the following steps:

[0018] Step 1: preprocessing the target software code to eliminate information interference and obtain the preprocessed software code;

[0019] Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ;

[0020] Among them, M code subwords token1~token M The order is consistent with the preprocessed software code;

[0021] The mth syntax tree path Path m Represents the mth code subword token m The grammatical structure of

[0022] The mth syntax tree path Path m Contains m Path nodes node1~node lm ; m∈[1,M];

[0023] Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process it and get the mth word embedding representation e m ;

[0024] Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Processing is performed to obtain the mth path embedding representation en m ;

[0025] Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into representation e m , the mth path embedding representation enm Fusion into the mth code feature expression C m ;

[0026] Step 5: Use the code scoring model Model3 to express C for the mth code feature m Process and get the mth score value P m ;

[0027] Step 6: Based on the mth score value P m Defect determination;

[0028] If the mth rating value P m is greater than the preset threshold P0, then the mth code subword token m It is a defective subword.

[0029] This multi-granularity software defect detection method based on software hierarchical information implements the method or process according to the embodiment of the present disclosure.

[0030] In a second aspect, the present invention discloses a multi-granularity software defect detection system based on software hierarchy information, which uses the multi-granularity software defect detection method based on software hierarchy information disclosed in the first aspect.

[0031] The multi-granularity software defect detection system based on software hierarchical information includes: code preprocessing module, word segmentation and path extraction module, embedding conversion module, feature fusion module, code scoring module and defect judgment module.

[0032] The code preprocessing module is used to preprocess the target software code to eliminate information interference and obtain the preprocessed software code.

[0033] The word segmentation and path extraction module is used to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .

[0034] The embedding conversion module is used to: 1. Use the embedding conversion model Model1 to convert the mth code subword token m Process it and get the mth word embedding representation e m ; 2. Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Processing is performed to obtain the mth path embedding representation en m .

[0035] The feature fusion module is used to embed the mth word into the representation e using the attention-based feature fusion model Model2 m, the mth path embedding representation en m Fusion into the mth code feature expression C m .

[0036] The code scoring module is used to express C of the mth code feature using the code scoring model Model3 m Process and get the mth score value P m .

[0037] The defect judgment module is used to determine the defect based on the mth score value P m Defect determination.

[0038] The multi-granularity software defect detection system based on software hierarchical information implements the method or process according to the embodiment of the present disclosure.

[0039] In a third aspect, the present invention discloses a computer program product, including a computer program. When the computer program is executed by a processor, the steps of the multi-granularity software defect detection method based on software hierarchical information disclosed in the first aspect are implemented.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. The present invention proposes a multi-granularity software defect detection method, which combines the valid code sub-word information in the target software code and its corresponding syntax tree path information, and can deeply detect the detailed information about the code defects, so that the code detection can be carried out down to the word level, achieving better and more flexible detection results.

[0042] 2. The present invention innovatively introduces a syntax tree path, and utilizes the precise hierarchical structure of code subwords in the entire code to improve the effect of software defect detection.

[0043] 3. The present invention preferably adopts a method of combining the codeBERT model, the dot product attention mechanism model and the multi-layer perceptron model to perform word-level defect detection; simulation experiments show that this method is superior to the existing deep learning method not only in terms of granularity processing level, but also in terms of some performance indicators. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1A data flow diagram of a multi-granularity software defect detection method based on software hierarchical information provided in Embodiment 1 of the present invention;

[0046] Figure 2 This is a structural diagram of a multi-granularity software defect detection system based on software hierarchy information provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] It should be noted that when a component is referred to as being "mounted on" another component, it may be directly on the other component or there may be a central component. When a component is considered to be "set on" another component, it may be directly set on the other component or there may be a central component at the same time. When a component is considered to be "fixed to" another component, it may be directly fixed on the other component or there may be a central component at the same time.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "or / and" used herein includes any and all combinations of one or more of the related listed items.

[0050] Example 1

[0051] See also Figure 1 , Figure 1 A data flow diagram of a multi-granularity software defect detection method based on software hierarchical information is shown, which actually also shows a flow chart of the multi-granularity software defect detection method based on software hierarchical information.

[0052] First of all, it should be noted that the multi-granularity software defect detection method based on software hierarchical information proposed in this embodiment 1 is used to perform word-level defect detection on the target software code, that is, it can realize defect detection from the lower level to the word level.

[0053] like Figure 1 As shown, the multi-granularity software defect detection method based on software hierarchical information includes the following steps:

[0054] Step 1: preprocess the target software code to eliminate information interference and obtain the preprocessed software code.

[0055] The target software code is generally stored in the form of a code file. Then, after obtaining the target software code from the code file, the first thing to do is to preprocess the code to eliminate information interference. This is because when the target software code is built, there will be code comments, special symbols (such as "{}, (), <>"), etc., which will interfere with subsequent processing.

[0056] For the above interference content, the general preprocessing method is:

[0057] 1. Delete the comments of the target software code;

[0058] 2. Use spaces to replace special symbols in the target software code.

[0059] Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .

[0060] Step 2, on the one hand, divides the preprocessed software code into more fine-grained sub-word units to facilitate the subsequent model to capture the semantic information in the code and reduce the processing difficulties caused by vocabulary size limitations. On the other hand, it extracts the grammatical structure information of the sub-word units in the preprocessed software code to provide software hierarchy information.

[0061] Specifically, a word segmenter is used to segment the preprocessed software code to obtain M code subwords token1 to token M Among them, the word segmenter is recommended to use a space word segmenter, which uses spaces as identification for word segmentation. Of course, other word segmentation processing methods can also be used, but the effect of code subword processing should be guaranteed to meet the requirements.

[0062] Use the syntax tree analysis tool to extract the syntax tree path of the preprocessed software code, and obtain M syntax tree paths Path1~Path M Among them, the syntax tree analysis tool recommended is: TreeSitter syntax tree extractor, and combine it with the depth-first search algorithm to achieve the best extraction effect. Of course, other word segmentation processing methods can also be used, but the effect of syntax tree path extraction should be guaranteed to meet the requirements.

[0063] In addition, it should be noted that each code subword is a subword unit; each syntax tree path is composed of several path nodes - the mth syntax tree path Path m Contains mPath nodes node1~node lm .

[0064] Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process it and get the mth word embedding representation e m ;

[0065] Use the embedded transformation model Model1 to transform the mth syntax tree path Node m Processing is performed to obtain the mth path embedding representation en m .

[0066] The embedding conversion model Model1 aims to convert the input object into an embedded representation for vectorization.

[0067] For e m For example, m =Model1(token m );

[0068] For m For example, m =Model1(Path m );

[0069] In the formula, Model1(.) represents the processing process of the vector embedding conversion model Model1

[0070] In addition, since Node m Contains m Path nodes node1~node lm , then m In fact, it is obtained by converting the path nodes and finding the average value, which can be written as:

[0071]

[0072] In the formula, AVG(.) means finding the average value.

[0073] Generally, the embedding conversion model Model1 can adopt any one of the codeBERT model, the BERT model, and the ALBERT model. However, it should be emphasized that in this embodiment 1, the codeBERT model is selected as the embedding conversion model Model1.

[0074] Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m .

[0075] Step 4 is the key point of this method: on the one hand, e m 、en m Feature fusion is performed to integrate code syntax and semantic information to provide a more comprehensive code feature expression; on the other hand, the attention-based feature fusion model Model2 is used to perform feature fusion to ensure the effect of feature fusion.

[0076] For Cm, C m = Model2(e m ,en m );

[0077] In the formula, Model2(.) represents the processing process of the attention-based feature fusion model Model2.

[0078] It should be emphasized that in this embodiment 1, the dot product attention mechanism model is selected as the attention-based feature fusion model Model 2, which can be used in conjunction with the codeBERT model and the subsequent multi-layer perceptron model to achieve a good effect.

[0079] For the dot product attention mechanism model, the processing process includes: 1. Calculating the attention weight, 2. Weighted fusion of feature vectors based on the attention weight; the whole process can be expressed as:

[0080]

[0081] Where softmax(.) is the softmax activation function; W Q , W K , W V represents the learnable weight matrix; d K is the embedding vector dimension.

[0082] C after the dot product attention mechanism model fusion m Combining subword text and hierarchical structure information, although it is still a local feature, it already reflects comprehensive code information.

[0083] Step 5: Use the code scoring model Model3 to express C for the mth code feature m Process and get the mth score value P m .

[0084] Step 5 aims to convert C m Quantified into a scoring value, so that defects can be judged by threshold comparison.

[0085] For Pm, P m =Model3(C m );

[0086] Wherein, Model3(.) represents the processing process of code scoring model Model3.

[0087] It should be emphasized that in this embodiment 1, the multi-layer perceptron model is selected as the code scoring model Model 3, which can achieve a good coordinated use effect with the codeBERT model and the dot product attention mechanism model.

[0088] For the multi-layer perceptron model, it includes: input layer, hidden layer, and output layer. The processing process of the multi-layer perceptron model includes: 1. Calculating the risk score; 2. Converting the risk score into a probability value as a scoring value; the whole process can be expressed as:

[0089]

[0090] In the formula, h i is the weight of the i-th neuron in the hidden layer connected to the output layer neuron; v i Represents C m The i-th component input to the input layer; H represents the total number of neurons in the hidden layer; c is the bias term of the output layer; sigmoid(.) represents the sigmoid activation function. After being processed by the multi-layer perceptron model, the score falls between 0 and 1.

[0091] Step 6: Based on the mth score value P m Defect determination;

[0092] If the mth rating value P m is greater than the preset threshold P0, then the mth code subword token m It is a defective subword.

[0093] Of course, if the mth rating value P m If it is not greater than the preset threshold P0, it can be identified as: the mth code subword token m Not a defective subword; can also be identified as: the mth code subword token m The possibility that it is not a defective subword is low, and manual review is performed later.

[0094] Because P m falls between 0 and 1, so P0 is generally taken as 0.5. m > 0.5, then the mth code subword token m It is identified as a defective subword.

[0095] In addition, based on the results of word-level defect detection, a more coarse-grained judgment can be made upward: if there is a defect subword, the code line containing the defect subword is a defective code line, and the code file containing the defective code line is a defective code file. In this way, a more flexible software defect detection result can be provided.

[0096] In addition, it should be noted that in order to ensure the detection effect of the above model, a sample data set should be used in advance for model training to ensure optimal model parameters and performance.

[0097] Comparative Verification

[0098] This embodiment 1 introduces four existing deep learning methods: 1. A method for software defect detection based on CNN (referred to as CNN); 2. A method for software defect detection based on DBN (referred to as DBN); 3. A method for software defect detection based on Bow (referred to as Bow); 4. A method for software defect detection based on Bi-LSTM (referred to as Bi-LSTM), and compares them with the above-mentioned multi-granularity software defect detection method based on software hierarchical information (which adopts a combination of codeBERT model, dot product attention mechanism model, and multi-layer perceptron model, referred to as Ours), and examines relevant performance indicators. The results are shown in Table 1 below.

[0099] Table 1 Performance comparison table

[0100] method AUC Balanced Accuracy MCC CNN 76％ 53％ 6％ DBN 63％ 61％ 18％ Bow 54％ 62％ 14％ Bi-LSTM 52％ 50％ 3％ Ours 87％ 73％ 19％

[0101] It should be noted that the existing four deep learning methods can only achieve row-level defect detection, and the granularity of the results is inferior to the multi-granularity software defect detection method based on software hierarchical information proposed in the embodiment.

[0102] Looking at Table 1 again, AUC is the area under the ROC curve (the classification effect of the characterization method, ranging from 0.5 to 1). The closer its value is to 1, the better the result; Balanced Accuracy is the balanced accuracy (the classification performance of the characterization method, ranging from 0 to 1). The closer its value is to 1, the better the result; MCC is the Matthews correlation coefficient (the comprehensive performance of the characterization method, ranging from -1 to 1). The closer its value is to 1, the better the result.

[0103] It can be seen from Table 1 that the multi-granularity software defect detection method based on software hierarchical information proposed in Example 1 is better than the existing deep learning method and has certain advantages.

[0104] Example 2

[0105] This embodiment 2 provides a multi-granularity software defect detection system based on software level information, which uses the multi-granularity software defect detection method based on software level information disclosed in embodiment 1.

[0106] See also Figure 2 ,The multi-granularity software defect detection system based on software hierarchical ,information includes: code preprocessing module, word segmentation and path extraction ,module, embedding conversion module, feature fusion module, code scoring module, and defect judgment ,module.

[0107] The code preprocessing module is configured to preprocess the target software code to eliminate information interference and obtain the preprocessed software code.

[0108] The word segmentation and path extraction module is configured to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .

[0109] The embedding conversion module is configured as follows: 1. Use the embedding conversion model Model1 to convert the mth code subword token m Process it and get the mth word embedding representation e m ; 2. Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Processing is performed to obtain the mth path embedding representation en m .

[0110] The feature fusion module is configured to use the attention-based feature fusion model Model2 to embed the mth word into representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m .

[0111] The code scoring module is configured to use the code scoring model Model3 to express C for the mth code feature m Process and get the mth score value P m .

[0112] The defect judgment module is configured based on the mth score value P m Defect determination.

[0113] Since this system uses the multi-granularity software defect detection method based on software hierarchy information in Example 1, it also has the same effect and will not be repeated here.

[0114] Example 3

[0115] This embodiment 3 discloses a computer device, including a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in embodiment 1 are implemented.

[0116] This embodiment 3 also discloses a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in embodiment 1 are executed.

[0117] This embodiment 3 also discloses a computer program product, including a computer program. When the computer program is executed by a processor, the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in embodiment 1 are implemented.

[0118] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A multi-granularity software defect detection method based on software hierarchical information, characterized in that: Used to perform word-level defect detection on target software code; The multi-granularity software defect detection method based on software hierarchical information comprises the following steps: Step 1: preprocessing the target software code to eliminate information interference and obtain the preprocessed software code; Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ; Among them, M code subwords token1~token M The order is consistent with the preprocessed software code; The mth syntax tree path Path m Represents the mth code subword token m The grammatical structure of The mth syntax tree path Path m Contains m Path nodes node1~node lm ; m∈[1,M]; Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process it and get the mth word embedding representation e m ; Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Processing is performed to obtain the mth path embedding representation en m ; Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m ; Step 5: Use the code scoring model Model3 to express C for the mth code feature m Process and get the mth score value P m ; Step 6: Based on the mth score value P m Defect determination; If the mth rating value P m is greater than the preset threshold P0, then the mth code subword token m It is a defective subword.

2. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 1, the pre-processing method includes: Delete comments from target software code; Use spaces to replace special symbols in the target software code.

3. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 2, a word segmenter is used to segment the preprocessed software code to obtain M code subwords token1 to token M ; Use the syntax tree analysis tool to extract the syntax tree path of the preprocessed software code, and obtain M syntax tree paths Path1~Path M .

4. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 3, the vector embedding conversion model Model1 is any one of the codeBERT model, BERT model, and ALBERT model; Among them, e m = Model1(token m ) ; one m =Model1(Path m )=AVG[Model1(node1),...,Model1(node lm )]; Where Model1(.) represents the processing process of the vector embedding conversion model Model1.

5. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 4, the attention-based feature fusion model Model2 is a dot product attention mechanism model; Among them, C m = Model2(e m ,en m ); Where Model2(.) represents the processing process of the attention-based feature fusion model Model2.

6. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 5, the code scoring model Model3 is a multi-layer perceptron model; Among them, P m =Model3(C m ); Wherein, Model3(.) represents the processing process of code scoring model Model3.

7. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 6, if the mth score value P m is not greater than the preset threshold P0, then the mth code subword token m Not a defective sub-word.

8. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step six, if there is a defective sub-word, the code line containing the defective sub-word is a defective code line, and the code file containing the defective code line is a defective code file.

9. A multi-granularity software defect detection system based on software hierarchical information, characterized in that: It uses the multi-granularity software defect detection method based on software hierarchical information as described in any one of claims 1 to 8; The multi-granularity software defect detection system based on software hierarchical information includes: A code preprocessing module, which is used to preprocess the target software code to eliminate information interference and obtain the preprocessed software code; The word segmentation and path extraction module is used to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ; Embedding conversion module, which is used to use the embedding conversion model Model1 to convert the mth code subword token m Process it and get the mth word embedding representation e m ; It is also used to use the embedded transformation model Model1 to transform the mth syntax tree path Path m Processing is performed to obtain the mth path embedding representation en m ; The feature fusion module is used to embed the mth word into the representation e using the attention-based feature fusion model Model2 m , the mth path embedding representation en m Fusion into the mth code feature expression C m ; The code scoring module is used to express C of the mth code feature using the code scoring model Model3. m Process and get the mth score value P m ; as well as The defect judgment module is used to determine the defect based on the mth score value P m Defect determination.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the multi-granularity software defect detection method based on software hierarchical information are implemented as described in any one of claims 1 to 8.

Images