Multi-rule static detection and large-model dynamic repair method for code defects

Abstract

The invention provides a multi-rule static detection and large-model dynamic repair method for code defects. The method comprises the steps that code defect types are summarized and abstracted into a unified defect mode rule set; constructing an abstract syntax tree, a control flow diagram and a data flow diagram of the source code; performing static analysis based on a multi-rule engine to identify potential defects; inputting the defect context into a large language model to generate a repair suggestion; performing semantic consistency verification and integration on the repair suggestions; and executing automatic testing and secondary static analysis to verify a repair result. According to the method, the traditional static analysis technology and the modern large language model capability are combined, accurate recognition and intelligent repair of code defects are achieved, a closed-loop defect processing flow is formed, the defect detection accuracy is improved, intelligent repair is achieved, closed-loop verification is formed, the development efficiency is improved, and man-machine cooperation is supported.

Description

Technical Field

[0001] The present invention relates to the fields of software engineering and artificial intelligence, and particularly to a multi-rule static detection and large model dynamic repair method for code defects, which is used to automatically identify and repair various types of defects in software code. Background Art

[0002] With the continuous growth of the scale and complexity of software systems, code defects have become an important factor affecting software quality and security. Traditional code defect detection methods mainly rely on static analysis tools. Although they can discover potential problems, they often have problems such as high false alarm rates and inaccurate repair suggestions. Manual repair is time-consuming and laborious, and it is difficult to meet the maintenance requirements of large-scale code libraries.

[0003] In the prior art, static analysis tools usually perform defect detection based on predefined rules, lacking flexibility and context understanding capabilities; while machine learning-based methods have certain intelligence, but still have limitations in complex code structures and semantic understanding. In addition, detection and repair are usually two separate processes, lacking an effective integration mechanism.

[0004] Therefore, there is an urgent need for a method that can combine the accuracy of static analysis and the intelligence of large language models to achieve automatic detection and repair of code defects, so as to improve software development efficiency and quality. Summary of the Invention

[0005] The present invention provides a multi-rule static detection and large model dynamic repair method for code defects. By combining traditional static analysis techniques and modern large language model capabilities, it realizes accurate identification and intelligent repair of code defects, forming a closed-loop defect handling process.

[0006] The technical solution of the present invention is as follows:

[0007] A multi-rule static detection and large model dynamic repair method for code defects, characterized in that the method includes the following steps:

[0008] A. Summarize various common code defect types in the program and abstract them into a unified defect pattern rule set;

[0009] B. Construct an abstract syntax tree (AST), a control flow graph (CFG), and a data flow graph (DFG) of the source code, and extract syntax and semantic information;

[0010] C. Perform static analysis based on a multi-rule engine, and use defect pattern matching to identify potential defect points and their contexts;

[0011] D. Input the defect context into a large language model optimized by instructions to generate repair suggestions or repair code for the defect;

[0012] E. Combine the defect pattern and the results generated by the language model to perform semantic consistency verification on the repair suggestions, and perform automatic integration or manual-assisted integration;

[0013] F. Execute automated tests and secondary static analysis to verify and regression evaluate the repair results, forming a repair closed-loop.

[0014] Advantages of the present invention:

[0015] Improve the accuracy of defect detection: By combining multi-rule static analysis and semantic understanding, reduce the false alarm rate and improve the detection accuracy;

[0016] Achieve intelligent repair: Use the large language model to generate context-related repair solutions and reduce manual intervention;

[0017] Form a closed-loop verification: Through automated testing and secondary analysis, ensure the repair quality and avoid introducing new problems;

[0018] Improve development efficiency: Reduce the time cost for developers to handle code defects and accelerate the software development cycle;

[0019] Support human-machine collaboration: Provide an interactive interface, allowing developers to participate in repair decisions and combining human expertise with AI capabilities. Description of the Drawings

[0020] Figure 1 Flow schematic diagram of the defect detection module;

[0021] Figure 2 Flow schematic diagram of the defect repair. Detailed Embodiments

[0022] The multi-rule static detection and large model dynamic repair method for code defects proposed by the present invention mainly includes two major modules: defect detection and defect repair. The defect detection module is responsible for identifying potential problems in the code, and the defect repair module is responsible for generating and verifying repair solutions.

[0023] As Figure 1 shown, the process of the defect detection module includes: establishing a list of files to be scanned according to input parameters, reading the scan configuration database, reading the execution state machine file according to the configuration, determining whether the list of files to be scanned is empty, generating an abstract syntax tree, generating a control flow graph, generating a symbol table, initializing the intervals of each variable in the symbol table, generating a function call graph, and calculating the function intervals in the topological order of the call graph.

[0024] As Figure 2As shown in the figure, the defect repair process includes: defect description information, preprocessing, code representation learning, knowledge base, CodeT5 model, fine-tuning DeepSeek-R1 model and integration optimization module, and finally outputs the final repair solution.

[0025] In step A, the system summarizes various common code defect types in the program in the following way and abstracts them into a unified set of defect pattern rules:

[0026] A1. Summarize defect types such as null pointer dereference, array out-of-bounds, resource leakage, etc. from historical defect samples, open source projects, and security databases;

[0027] A2. Unify the defect patterns into formal rules, including grammatical structure patterns and contextual behavior patterns;

[0028] A3. Define matching conditions and verifiable trigger contexts for each defect pattern for the static analysis engine to use to identify defects.

[0029] In step B, the system constructs the abstract syntax tree, control flow graph, and data flow graph of the source code in the following way:

[0030] B1. Perform lexical and grammatical analysis on the source code and generate an abstract syntax tree;

[0031] B2. Analyze the basic blocks and process jump relationships based on AST and construct a control flow graph (CFG);

[0032] B3. Track variable definitions and usage, build variable flow paths and generate data flow graphs (DFGs).

[0033] In step C, the system performs static analysis based on a multi-rule engine. The specific process is as follows:

[0034] C1. The static rule engine supports plugin-based definition of syntax patterns, variable dependency rules, and code style constraints;

[0035] C2. Combine AST and CFG structures during the analysis process to achieve flow-sensitive and path-sensitive defect detection;

[0036] C3. Output the detection report, including the defect type, location, code snippet and context.

[0037] In step D, the system inputs the defect context into the large language model. The specific process is as follows:

[0038] D1. Intercept the function, class or context code containing the defect as the input fragment and embed it into the prompt template together with the defect type;

[0039] D2. Call the fine-tuned large language model (DeepSeek-R1) to generate optional repair suggestions or code patches;

[0040] D3. Conduct semantic checks and syntax validations on the model output results.

[0041] In step E, the system combines the defect pattern and the language model generation results to perform semantic consistency verification on the repair suggestions. The specific process is as follows:

[0042] E1. According to the original defect point and defect type, use the difference analysis algorithm to compare whether the code behavior before and after repair is consistent;

[0043] E2. Apply the defect recognition pattern to detect the repaired code again to ensure that the defect has been eliminated and no new defects have been introduced;

[0044] E3. Automatically apply the repaired code according to the verification results, or display the candidate results for developers to choose.

[0045] In step F, the system performs automated testing and secondary static analysis. The specific process is as follows:

[0046] F1. Combine the existing unit test set of the project to conduct regression testing to verify that the functional correctness is not affected;

[0047] F2. Execute the automatically constructed supplementary test cases to cover the defect repair path and boundary conditions;

[0048] F3. Use the same rule engine as in step C to perform static analysis again to confirm that there are no new or remaining defects.

[0049] This system supports the human-machine collaborative working mode and provides a graphical user interface to display the detection defects, repair suggestions, difference comparison, and user feedback operation entrances. Developers can view the defect details, choose to accept, modify, or reject the repair suggestions provided by the system, and provide feedback to improve the system performance.

[0050] The above is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A multi - rule static detection and large - model dynamic repair method for code defects, characterized in that The method comprises the following steps: A. Summarize various common code defect types in the program and abstract them into a unified set of defect pattern rules; B. Build the abstract syntax tree (AST), control flow graph (CFG) and data flow graph (DFG) of the source code to extract syntax and semantic information; C. Perform static analysis based on a multi-rule engine and use defect pattern matching to identify potential defect points and their contexts; D. Input the defect context into the large language model after instruction tuning to generate repair suggestions or repair codes for the defect; E. Combine the defect pattern and language model generation results to verify the semantic consistency of the repair suggestions and perform automatic or manual integration; F. Perform automated testing and secondary static analysis to verify and regress the repair results to form a repair closed loop.

2. The method according to claim 1, characterized in that, The specific process of summarizing various common code defect types in the program and abstracting them into a unified defect pattern rule set in step A is as follows: A1. Summarize defect types such as null pointer dereference, array out-of-bounds, resource leakage, etc. from historical defect samples, open source projects, and security databases; A2. Unify the defect patterns into formal rules, including grammatical structure patterns and contextual behavior patterns; A3. Define matching conditions and verifiable trigger contexts for each defect pattern for the static analysis engine to use to identify defects.

3. The method according to claim 1, characterized in that, The specific process of constructing the abstract syntax tree, control flow graph and data flow graph in step B is as follows: B1. Perform lexical and grammatical analysis on the source code and generate an abstract syntax tree; B2. Analyze the basic blocks and process jump relationships based on AST and construct a control flow graph (CFG); B3. Track variable definitions and usage, build variable flow paths and generate data flow graphs (DFGs).

4. The method according to claim 1, wherein The specific process of performing static analysis based on the multi-rule engine in step C is as follows: C1. The static rule engine supports plugin-based definition of syntax patterns, variable dependency rules, and code style constraints; C2. Combine AST and CFG structures during the analysis process to achieve flow-sensitive and path-sensitive defect detection; C3. Output the detection report, including the defect type, location, code snippet and context.

5. The method according to claim 1, wherein The specific process of inputting the defect context into the large language model in step D is as follows: D1. Intercept the function, class or context code containing the defect as the input fragment and embed it into the prompt template together with the defect type; D2. Call the fine-tuned large language model (DeepSeek-R1) to generate optional repair suggestions or code patches; D3. Perform semantic check and grammatical verification on the model output results.

6. The method according to claim 1, wherein The specific process of combining the defect pattern and the language model generation result in step E to verify the semantic consistency of the repair suggestion is as follows: E1. Based on the original defect point and defect type, use the difference analysis algorithm to compare whether the code behavior before and after the repair is consistent; E2. Apply the defect identification mode to re-test the repaired code to ensure that the defects have been eliminated and no new defects have been introduced; E3. Automatically apply the repair code based on the verification results, or display the candidate results for developers to choose.

7. The method according to claim 1, wherein The specific process of the automated testing and secondary static analysis in step F is as follows: F1. Conduct regression testing by combining with the existing unit test set of the project to verify that the functional correctness is not affected; F2. Execute the automatically constructed supplementary test cases to cover the defect repair paths and boundary conditions; F3. Use the same rule engine as in step C to perform static analysis again to confirm that there are no new or remaining defects.

8. The method according to claim 1, characterized in that The system supports a human-machine collaborative working mode and provides a graphical user interface to display the detected defects, repair suggestions, difference comparison, and user feedback operation entrances.

Images