Multi-granularity software defect detection method and system based on software hierarchical information
Through a multi-granularity software defect detection method based on software hierarchical information, combined with preprocessing, word segmentation, syntax tree path extraction and feature fusion model, the problem of unutilized code hierarchical structure information in the existing technology is solved, and more efficient word-level defect detection is achieved.
Patent Information
- Application Number
- CN202411938894.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-26
- Publication Date
- 2025-10-10
- Estimated Expiration
- 2044-12-26
AI Technical Summary
Existing software defect detection methods are limited to coarse granularity and fail to fully utilize the hierarchical structure information of the code, resulting in poor detection results, especially insufficient detection of complex logical errors and defects in specific hierarchies.
A multi-granularity software defect detection method based on software hierarchical information is adopted to achieve word-level defect detection by preprocessing, word segmentation and syntax tree path extraction of the target software code, combined with the embedding conversion model, feature fusion model and code scoring model.
It achieves finer-grained defect detection and improves detection results. It outperforms existing deep learning methods in performance indicators such as AUC, Balanced Accuracy, and MCC, and can flexibly identify defect details in the code.
Smart Images
Figure CN119883856B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of software development and maintenance, more particularly, it relates to: 1. A multi-granularity software defect detection method based on software hierarchical information; 2. A multi-granularity software defect detection system based on software hierarchical information. BACKGROUND
[0002] With the continuous improvement of software complexity, software defect detection is increasingly important in software development and maintenance.
[0003] Software defect detection methods have gone through three stages:
[0004] 1. Stage one: static code analysis
[0005] Static code analysis techniques assess software quality by checking potential defects in source code. These methods are usually based on rules or syntax analyzers, although they are computationally efficient, they cannot effectively identify complex logical errors.
[0006] 2. Stage two: traditional machine learning methods
[0007] Traditional machine learning methods based on specific feature extraction (such as random forests, support vector machines) have been applied to software defect detection. These methods usually require manual feature design, and the feature expression ability is limited, making it difficult to capture code context and complex semantic relationships.
[0008] 3. Stage three: deep learning methods
[0009] Deep learning methods have gradually developed in recent years, among which the most representative are deep neural networks based on code snippets (such as LSTM, Transformer) to automatically extract code features.
[0010] However, most deep learning methods rely only on flattened code representations, failing to fully utilize the hierarchical structure and syntax information of the code, and only using simple deep learning models such as LSTM, CNN, etc., making it difficult to achieve better detection results.
[0011] In summary, the existing methods have the following problems:
[0012] (1) Detection is still limited to coarse granularity, only focusing on predicting whether a given program snippet or file is vulnerable;
[0013] (2) Only software code text information is used; the hierarchical structure information of the code is not fully utilized. According to experience, code defects often occur in specific hierarchical structures, such as for loop structures, if branch structures, and exception capture related code structures. SUMMARY
[0014] Based on this, it is necessary to provide a multi-granularity software defect detection method and system based on software hierarchical information to address the problem that existing methods are limited to coarse-grained detection and only use software code text information.
[0015] The present invention is achieved by adopting the following technical solutions:
[0016] In a first aspect, the present invention discloses a multi-granularity software defect detection method based on software hierarchical information, which is used to perform word-level defect detection on target software code.
[0017] The multi-granularity software defect detection method based on software hierarchical information includes the following steps:
[0018] Step 1: preprocessing the target software code to eliminate information interference and obtain preprocessed software code;
[0019] Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ;
[0020] Among them, M code subwords token1~token M The order is consistent with the pre-processed software code;
[0021] The mth syntax tree path Path m Represents the mth code subword token m The grammatical structure of
[0022] The mth syntax tree path Path m Contains m Path nodes node1~node lm ;m∈[1,M];
[0023] Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process and get the mth word embedding representation e m ;
[0024] Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Process and get the mth path embedding representation en m ;
[0025] Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into the representation e m , the mth path embedding representation enm Fusion into the mth code feature expression C m ;
[0026] Step 5: Use code scoring model Model3 to express C m Process and get the mth score value P m ;
[0027] Step 6: Based on the mth score value P m Conduct defect assessment;
[0028] If the mth rating value P m If it is greater than the preset threshold P0, then the mth code subword token m It is a defective subword.
[0029] This multi-granularity software defect detection method based on software hierarchical information implements the method or process according to the embodiment of the present disclosure.
[0030] In a second aspect, the present invention discloses a multi-granularity software defect detection system based on software hierarchical information, which uses the multi-granularity software defect detection method based on software hierarchical information disclosed in the first aspect.
[0031] The multi-granularity software defect detection system based on software hierarchical information includes: code preprocessing module, word segmentation and path extraction module, embedding conversion module, feature fusion module, code scoring module, and defect judgment module.
[0032] The code preprocessing module is used to preprocess the target software code to eliminate information interference and obtain the preprocessed software code.
[0033] The word segmentation and path extraction module is used to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .
[0034] The embedding conversion module is used to: 1. Use the embedding conversion model Model1 to convert the mth code subword token m Process and get the mth word embedding representation e m ; 2. Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Process and get the mth path embedding representation en m .
[0035] The feature fusion module is used to embed the mth word into the representation e using the attention-based feature fusion model Model2 m, the mth path embedding representation en m Fusion into the mth code feature expression C m .
[0036] The code scoring module is used to express C of the mth code feature using the code scoring model Model3 m Process and get the mth score value P m .
[0037] The defect judgment module is used to determine the defect based on the mth score value P m Defect judgment.
[0038] The multi-granularity software defect detection system based on software hierarchical information implements the method or process according to the embodiment of the present disclosure.
[0039] In a third aspect, the present invention discloses a computer program product, comprising a computer program. When the computer program is executed by a processor, the computer program implements the steps of the multi-granularity software defect detection method based on software hierarchical information disclosed in the first aspect.
[0040] Compared with the prior art, the present invention has the following beneficial effects:
[0041] 1. The present invention proposes a multi-granularity software defect detection method, which combines the valid code sub-word information and its corresponding syntax tree path information in the target software code, and can deeply detect detailed information about code defects, so that code detection can be carried out down to the word level, achieving better and more flexible detection results.
[0042] 2. The present invention innovatively introduces a syntax tree path, which uses the precise hierarchical structure of code subwords in the entire code to improve the effect of software defect detection.
[0043] 3. The present invention preferably proposes a method for word-level defect detection that combines the codeBERT model, the dot-product attention mechanism model, and the multi-layer perceptron model. Simulation experiments show that this method is superior to existing deep learning methods not only in terms of granularity processing level, but also in some performance indicators. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0045] Figure 1A data flow diagram of the multi-granularity software defect detection method based on software hierarchical information provided in Example 1 of the present invention;
[0046] Figure 2 This is a structural diagram of a multi-granularity software defect detection system based on software hierarchy information provided in Example 1 of the present invention. DETAILED DESCRIPTION
[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0048] It should be noted that when a component is referred to as being "mounted on" another component, it may be directly on the other component or there may be a central component. When a component is considered to be "set on" another component, it may be directly set on the other component or there may be a central component. When a component is considered to be "fixed to" another component, it may be directly fixed to the other component or there may be a central component.
[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.
[0050] Example 1
[0051] See Figure 1 , Figure 1 A data flow diagram of a multi-granularity software defect detection method based on software hierarchical information is shown, which actually also shows a flowchart of the multi-granularity software defect detection method based on software hierarchical information.
[0052] First of all, it should be noted that the multi-granularity software defect detection method based on software hierarchical information proposed in this embodiment 1 is used to perform word-level defect detection on target software code, that is, it can realize defect detection from the lower level to the word level.
[0053] like Figure 1 As shown in FIG, the multi-granularity software defect detection method based on software hierarchical information includes the following steps:
[0054] Step 1: preprocess the target software code to eliminate information interference and obtain the preprocessed software code.
[0055] The target software code is typically stored in the form of a code file. After obtaining the target software code from the code file, the first step is to preprocess the code to eliminate information interference. This is because the target software code may contain code comments and special symbols (such as "{}, (), <>") during construction, which can interfere with subsequent processing.
[0056] For the above interference content, the generally adopted pre-processing method is:
[0057] 1. Delete the comments of the target software code;
[0058] 2. Use spaces to replace special symbols in the target software code.
[0059] Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .
[0060] Step 2, on the one hand, divides the preprocessed software code into finer-grained sub-word units to facilitate the subsequent model to capture the semantic information in the code and reduce the processing difficulties caused by vocabulary size limitations. On the other hand, it extracts the grammatical structure information of the sub-word units in the preprocessed software code to provide software hierarchical information.
[0061] Specifically, a word segmenter is used to segment the preprocessed software code to obtain M code subwords token1 to token M The recommended word segmenter is the space segmenter, which uses spaces as identifiers for word segmentation. Of course, other word segmentation methods can also be used, but the effect of code sub-word processing should be guaranteed to meet the requirements.
[0062] Use the syntax tree analysis tool to extract the syntax tree path of the preprocessed software code and obtain M syntax tree paths Path1~Path M The recommended syntax tree analysis tool is the TreeSitter syntax tree extractor, combined with a depth-first search algorithm to achieve optimal extraction results. Other word segmentation methods can also be used, but the syntax tree path extraction must meet the requirements.
[0063] In addition, it should be noted that each code subword is a subword unit; each syntax tree path is composed of several path nodes - the mth syntax tree path Path m Contains mPath nodes node1~node lm .
[0064] Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process and get the mth word embedding representation e m ;
[0065] Use the embedded transformation model Model1 to transform the mth syntax tree path Node m Process and get the mth path embedding representation en m .
[0066] The embedding conversion model Model1 is designed to convert the input object into an embedded representation for vectorization.
[0067] For e m For example, e m =Model1(token m );
[0068] For en m For example, m =Model1(Path m );
[0069] In the formula, Model1(.) represents the processing process of the vector embedding conversion model Model1
[0070] In addition, since Node m Contains m Path nodes node1~node lm , then en m In fact, it is obtained by converting the path nodes and taking the average value, which can be written as:
[0071]
[0072] In the formula, AVG(.) means finding the average value.
[0073] Generally, the embedding conversion model Model 1 can adopt any one of the codeBERT model, the BERT model, and the ALBERT model. However, it should be emphasized that in this embodiment 1, the codeBERT model is selected as the embedding conversion model Model 1.
[0074] Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into the representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m .
[0075] Step 4 is the key point of this method: on the one hand, e m 、en m Feature fusion is performed to integrate code syntax and semantic information to provide a more comprehensive code feature expression; on the other hand, the attention-based feature fusion model Model2 is used to perform feature fusion to ensure the effect of feature fusion.
[0076] For Cm, C m =Model2(e m ,en m );
[0077] Where Model2(.) represents the processing process of the attention-based feature fusion model Model2.
[0078] It should be emphasized that in this embodiment 1, the dot product attention mechanism model is selected as the attention-based feature fusion model Model 2, which can be used in conjunction with the codeBERT model and the subsequent multi-layer perceptron model to achieve a good effect.
[0079] For the dot product attention mechanism model, its processing process includes: 1. Calculating attention weights, 2. Weighted fusion of feature vectors based on attention weights; the whole process can be expressed as:
[0080]
[0081] Where softmax(.) is the softmax activation function; W Q 、W K 、W V represents the learnable weight matrix; d K is the embedding vector dimension.
[0082] C after the dot product attention mechanism model fusion m Combining subword text and hierarchical structure information, although it is still a local feature, it already reflects comprehensive code information.
[0083] Step 5: Use code scoring model Model3 to express C m Process and get the mth score value P m .
[0084] Step 5 aims to convert C m It is quantified into a scoring value, so that defect judgment can be made by comparing the threshold.
[0085] For Pm, P m =Model3(C m );
[0086] Where Model3(.) represents the processing process of code scoring model Model3.
[0087] It should be emphasized that in this embodiment 1, the multi-layer perceptron model is selected as the code scoring model Model 3, which can be used in conjunction with the codeBERT model and the dot product attention mechanism model to achieve a good effect.
[0088] For the multi-layer perceptron model, it includes: input layer, hidden layer, and output layer. The processing process of the multi-layer perceptron model includes: 1. Calculating the risk score; 2. Converting the risk score into a probability value as a scoring value. The whole process can be expressed as follows:
[0089]
[0090] Where h i is the weight of the i-th neuron in the hidden layer connected to the output layer neuron; v i Indicates C m The i-th component of the input layer; H represents the total number of neurons in the hidden layer; c is the bias term of the output layer; sigmoid(.) represents the sigmoid activation function. After processing by the multilayer perceptron model, the score falls between 0 and 1.
[0091] Step 6: Based on the mth score value P m Conduct defect assessment;
[0092] If the mth rating value P m If it is greater than the preset threshold P0, then the mth code subword token m It is a defective subword.
[0093] Of course, if the mth rating value P m If it is not greater than the preset threshold P0, it can be identified as: the mth code subword token m Not a defective subword; can also be identified as: the mth code subword token m The possibility of it not being a defective subword is low, and manual review will be performed later.
[0094] Because P m Falls between 0 and 1, so P0 is generally taken as 0.5. m >0.5, then the mth code subword token m It is identified as a defective subword.
[0095] Furthermore, based on the results of word-level defect detection, we can also make more coarse-grained decisions: if a defective subword exists, then the code line containing the defective subword is a defective code line, and the code file containing the defective code line is a defective code file. This provides more flexible software defect detection results.
[0096] In addition, it should be noted that in order to ensure the detection effect of the above model, a sample data set should be used in advance to train the model to ensure optimal model parameters and performance.
[0097] Comparative Verification
[0098] This embodiment 1 introduces four existing deep learning methods: 1. A method for software defect detection based on CNN (referred to as CNN); 2. A method for software defect detection based on DBN (referred to as DBN); 3. A method for software defect detection based on Bow (referred to as Bow); 4. A method for software defect detection based on Bi-LSTM (referred to as Bi-LSTM), and compares them with the above-mentioned multi-granularity software defect detection method based on software hierarchical information (which uses a combination of codeBERT model, dot product attention mechanism model, and multi-layer perceptron model, referred to as Ours), and examines relevant performance indicators. The results are shown in Table 1 below.
[0099] Table 1 Performance comparison table
[0100] method AUC Balanced Accuracy MCC CNN 76％ 53％ 6％ DBN 63％ 61％ 18％ Bow 54％ 62％ 14％ Bi-LSTM 52％ 50％ 3％ Ours 87％ 73％ 19％
[0101] It should be noted that the existing four deep learning methods can only achieve row-level defect detection, and the granularity of the results is inferior to the multi-granularity software defect detection method based on software hierarchical information proposed in the embodiment.
[0102] Looking at Table 1 again, AUC is the area under the ROC curve (representing the classification effect of the method, with a value range of 0.5 to 1). The closer its value is to 1, the better the result; Balanced Accuracy is the balanced accuracy (representing the classification performance of the method, with a value range of 0 to 1). The closer its value is to 1, the better the result; MCC is the Matthews correlation coefficient (representing the comprehensive performance of the method, with a value range of -1 to 1). The closer its value is to 1, the better the result.
[0103] As can be seen from Table 1, the multi-granularity software defect detection method based on software hierarchical information proposed in Example 1 is better than the existing deep learning method and has certain advantages.
[0104] Example 2
[0105] This embodiment 2 provides a multi-granularity software defect detection system based on software hierarchical information, which uses the multi-granularity software defect detection method based on software hierarchical information disclosed in embodiment 1.
[0106] See Figure 2 ,The multi-granularity software defect detection system based on software hierarchical ,information includes: code preprocessing module, word segmentation and path extraction ,module, embedding conversion module, feature fusion module, code scoring module, and ,defect judgment module.
[0107] The code preprocessing module is configured to preprocess the target software code to eliminate information interference and obtain the preprocessed software code.
[0108] The word segmentation and path extraction module is configured to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M .
[0109] The embedding conversion module is configured as follows: 1. Use the embedding conversion model Model1 to convert the mth code subword token m Process and get the mth word embedding representation e m ; 2. Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Process and get the mth path embedding representation en m .
[0110] The feature fusion module is configured to use the attention-based feature fusion model Model2 to embed the mth word into the representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m .
[0111] The code scoring module is configured to use the code scoring model Model3 to express C for the mth code feature m Process and get the mth score value P m .
[0112] The defect judgment module is configured based on the mth score value P m Defect judgment.
[0113] Since this system uses the multi-granularity software defect detection method based on software hierarchical information in Example 1, it also has the same effect and will not be repeated here.
[0114] Example 3
[0115] The embodiment 3 discloses a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor executes the computer program to realize the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in the embodiment 1.
[0116] The embodiment 3 further discloses a readable storage medium, which stores computer program instructions, and the computer program instructions are read and executed by a processor to perform the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in the embodiment 1.
[0117] The embodiment 3 further discloses a computer program product, which comprises a computer program. The computer program is executed by a processor to realize the steps of the multi-granularity software defect detection method based on software hierarchy information disclosed in the embodiment 1.
[0118] The above-mentioned embodiments only express several embodiments of the present application, which are described in detail and specifically, but cannot be understood as the limitation of the patent scope of the present application. It should be pointed out that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, which all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.
Claims
1. A multi-granularity software defect detection method based on software hierarchical information, characterized in that: Used to perform word-level defect detection on target software code; The multi-granularity software defect detection method based on software hierarchical information comprises the following steps: Step 1: preprocessing the target software code to eliminate information interference and obtain preprocessed software code; Step 2: Segment the preprocessed software code and extract the syntax tree path to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ; Among them, M code subwords token1~token M The order is consistent with the pre-processed software code; The mth syntax tree path Path m Represents the mth code subword token m The grammatical structure of The mth syntax tree path Path m Contains m Path nodes node1~node lm ;m∈[1,M]; Step 3: Use the embedding conversion model Model1 to transform the mth code subword token m Process and get the mth word embedding representation e m ; Use the embedded transformation model Model1 to transform the mth syntax tree path Path m Process and get the mth path embedding representation en m ; Step 4: Use the attention-based feature fusion model Model2 to embed the mth word into the representation e m , the mth path embedding representation en m Fusion into the mth code feature expression C m ; Step 5: Use code scoring model Model3 to express C m Process and get the mth score value P m ; Step 6: Based on the mth score value P m Conduct defect assessment; If the mth rating value P m Greater than the preset threshold P0, then the mth code subword token m It is a defective subword.
2. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 1, the pre-processing method includes: Delete comments from target software code; Use spaces to replace special symbols in the target software code.
3. The multi-granularity software defect detection method based on software hierarchical information according to claim 1, characterized in that: In step 2, the pre-processed software code is segmented using a word segmenter to obtain M code subwords token1 to token M ; Use the syntax tree analysis tool to extract the syntax tree path of the preprocessed software code and obtain M syntax tree paths Path1~Path M .
4. The multi-granularity software defect detection method based on software hierarchical information according to claim 1, characterized in that: In step 3, the vector embedding conversion model Model1 is any one of the codeBERT model, BERT model, and ALBERT model; Among them, e m = Model1(token m ); one m =Model1(Path m )=AVG[Model1(node1),...,Model1(node lm )]; Where Model1(.) represents the processing process of the vector embedding conversion model Model1.
5. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 4, the attention-based feature fusion model Model2 is a dot product attention mechanism model; Among them, C m =Model2(e m ,en m ); Where Model2(.) represents the processing process of the attention-based feature fusion model Model2.
6. The multi-granularity software defect detection method based on software hierarchical information according to claim 1, characterized in that: In step 5, the code scoring model Model3 is a multi-layer perceptron model; Among them, P m =Model3(C m ); Where Model3(.) represents the processing process of code scoring model Model3.
7. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step 6, if the mth score value P m is not greater than the preset threshold P0, then the mth code subword token m Not a defective subword.
8. The multi-granularity software defect detection method based on software hierarchical information according to claim 1 is characterized in that: In step six, if the defective subword exists, the code line containing the defective subword is a defective code line, and the code file containing the defective code line is a defective code file.
9. A multi-granularity software defect detection system based on software hierarchical information, characterized in that: It uses the multi-granularity software defect detection method based on software hierarchical information as described in any one of claims 1 to 8; The multi-granularity software defect detection system based on software hierarchical information includes: A code preprocessing module is used to preprocess the target software code to eliminate information interference and obtain preprocessed software code; The word segmentation and path extraction module is used to perform word segmentation on the preprocessed software code and perform syntax tree path extraction to obtain M code subwords token1 to token M And the corresponding M syntax tree paths Path1~Path M ; Embedding conversion module, which is used to use the embedding conversion model Model1 to convert the mth code subword token m Process and get the mth word embedding representation e m ; It is also used to use the embedded transformation model Model1 to transform the mth syntax tree path Path m Process and get the mth path embedding representation en m ; The feature fusion module is used to embed the mth word into the representation e using the attention-based feature fusion model Model2 m , the mth path embedding representation en m Fusion into the mth code feature expression C m ; The code scoring module is used to express C of the mth code feature using the code scoring model Model3. m Process and get the mth score value P m ; as well as Defect judgment module, which is used to judge the defect according to the mth score value P m Defect judgment.
10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the multi-granularity software defect detection method based on software hierarchical information are implemented as described in any one of claims 1 to 8.