Software source code defect detection method and system based on deep learning

Abstract

The present application relates to the field of data processing technology, and specifically to a method and system for software source code defect detection based on deep learning. The method includes: obtaining historical runtime error data of the software source code; based on the historical runtime error data, associating multiple functions in the software source code, and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph; weighting the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix; training a graph neural network based on the adjusted edge connection matrix and combining the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result for the software source code. The embodiment of the present application merges the control flow graphs corresponding to multiple related functions based on data-driven, and trains the graph neural network after weighting the edge connection matrix corresponding to the merged control flow graph, thereby improving the accuracy of source code defect detection.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and specifically relates to a software source code defect detection method and system based on deep learning. Background Art

[0002] With the continuous advancement of software engineering technology, source code defect detection has become a crucial component in ensuring software quality and system stability. In recent years, software systems have become increasingly widespread in key areas such as enterprise management, financial technology, and e-government. Their functional logic has become increasingly complex, inter-module dependencies are tight, and the source code size continues to expand. Against this backdrop, achieving efficient and intelligent source code defect detection has become a research hotspot in software development and testing. Furthermore, the development of deep learning technology has provided new insights into program structure understanding, semantic abstraction extraction, and abnormal behavior identification, driving source code analysis technology towards higher precision and stronger generalization capabilities.

[0003] However, the current source code defect detection method based on deep learning in the existing technology has significant shortcomings in modeling the interaction relationship between code and business data. It is difficult to accurately identify potential defects caused by data-driven logic anomalies and has poor accuracy. Summary of the Invention

[0004] In order to solve the above problems, the embodiments of the present application provide a software source code defect detection method and system based on deep learning.

[0005] According to a first aspect of an embodiment of the present application, a method for detecting software source code defects based on deep learning is provided, the method comprising:

[0006] Obtaining historical running error data of the software source code;

[0007] Based on the historical running error data, multiple functions in the software source code are associated, and control flow graphs corresponding to the multiple functions are merged to obtain a merged control flow graph;

[0008] performing weight adjustment on the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix;

[0009] A graph neural network is trained based on the adjusted edge connection matrix and combined with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code.

[0010] In one embodiment, the associating multiple functions in the software source code based on the historical runtime error data and merging control flow graphs corresponding to the multiple functions to obtain a merged control flow graph includes:

[0011] Obtaining the granularity of any function among the plurality of functions;

[0012] Obtaining, according to the granularity of any function among the multiple functions, a control flow correlation coefficient between any two functions among the multiple functions;

[0013] Function clustering is performed according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph.

[0014] In one embodiment, obtaining the granularity of any function among the multiple functions includes:

[0015] Obtaining the graph complexity of any function among the multiple functions;

[0016] Obtaining graph complexity information entropy corresponding to the multiple functions;

[0017] Obtaining information entropy of the number of parameters corresponding to the multiple functions;

[0018] Obtaining the number of parameters of any function among the multiple functions;

[0019] The granularity of any function among the multiple functions is obtained according to the graph complexity, the graph complexity information entropy, the parameter quantity information entropy, and the number of parameters.

[0020] In one embodiment, obtaining a control flow correlation coefficient between any two functions among the multiple functions according to the granularity of any function among the multiple functions includes:

[0021] Obtaining the number of edges in a control flow graph between any two functions among the plurality of functions;

[0022] Obtain the number of variables that exist in any two functions among the multiple functions;

[0023] A control flow correlation coefficient between any two functions in the plurality of functions is obtained according to the number of edges, the number of variables, and the granularity of the any two functions.

[0024] In one embodiment, performing function clustering according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph includes:

[0025] According to the granularity and the control flow correlation coefficient, functions whose granularity is smaller than a preset granularity threshold and whose control flow correlation coefficient is larger than a preset correlation coefficient threshold are clustered and merged to obtain a merged control flow graph.

[0026] In one embodiment, weight adjustment is performed on the edge connection matrix corresponding to the merged control flow graph to obtain the adjusted edge connection matrix, including:

[0027] Get the error contribution rate of any node of any merged function at any time;

[0028] Obtaining, according to the error contribution rate, the weight of the edge between the any node and an adjacent node of the any node at any moment;

[0029] According to the weights of the edges, the edge connection matrix corresponding to the merged control flow graph is weight-adjusted to obtain an adjusted edge connection matrix.

[0030] In one embodiment, obtaining the error contribution rate of any node of any merged function at any time includes:

[0031] Obtaining the first execution timestamp sequence of any node of any merged function within a set time;

[0032] Obtaining a second execution timestamp sequence of adjacent nodes of related functions of any of the merged functions within a set time;

[0033] According to the first execution timestamp sequence and the second execution timestamp sequence, the error contribution rate of any node of any merged function at any moment is obtained.

[0034] In one embodiment, obtaining the weight of the edge between any node and its adjacent node at any moment according to the error contribution rate includes:

[0035] Obtain a first error contribution rate, where the first error contribution rate is the error contribution rate of any node of any function after the merger at any moment;

[0036] Obtain a second error contribution rate, where the second error contribution rate is an error contribution rate of the adjacent node of the correlation function at any time;

[0037] The weight of the edge between the any node and an adjacent node of the any node at any moment is obtained according to the first error contribution rate and the second error contribution rate.

[0038] In one embodiment, the training of a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code includes:

[0039] Using the adjusted edge connection matrix and the multi-dimensional features of each node of the merged control flow graph as input to the graph neural network;

[0040] Whether an error occurs in a detection node in the historical running error data, and the error type are used as output labels of the graph neural network;

[0041] The graph neural network is trained using a cross entropy loss function to obtain a defect detection result of the software source code.

[0042] According to a second aspect of an embodiment of the present application, a software source code defect detection system based on deep learning is provided, the system including a server, the server including:

[0043] a memory having a computer program stored thereon;

[0044] A processor is used to execute the computer program in the memory to implement the steps of any one of the methods in the first aspect.

[0045] In summary, an embodiment of the present application provides a software source code defect detection method based on deep learning, the method comprising: obtaining historical runtime error data of the software source code; based on the historical runtime error data, associating multiple functions in the software source code, and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph; weight-adjusting the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix; training a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code. An embodiment of the present application is based on data-driven, merges the control flow graphs corresponding to multiple related functions, and weight-adjusts the edge connection matrix corresponding to the merged control flow graph, and finally trains a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code, thereby improving the accuracy of source code defect detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the implementation scheme of the present application, the following is a brief introduction to the drawings required for use in the implementation scheme. It should be understood that the drawings only show certain implementation schemes of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on the drawings without paying any creative work.

[0047] Figure 1 The present invention is a flowchart showing a method for detecting software source code defects based on deep learning according to an exemplary embodiment.

[0048] Figure 2The present invention is a flowchart of a method for associating multiple functions in software source code based on historical runtime error data and merging control flow graphs corresponding to the multiple functions to obtain a merged control flow graph according to an exemplary embodiment.

[0049] Figure 3 The present invention is a flowchart showing a method for obtaining the granularity of any function among multiple functions according to an exemplary embodiment.

[0050] Figure 4 The present invention is a flowchart illustrating a method for obtaining a control flow correlation coefficient between any two functions among multiple functions according to the granularity of any function among the multiple functions, according to an exemplary embodiment.

[0051] Figure 5 The present invention is a flowchart of a method for clustering functions according to granularity and control flow correlation coefficient to obtain a merged control flow graph according to an exemplary embodiment.

[0052] Figure 6 The present invention is a flowchart of a method for performing weight adjustment on an edge connection matrix corresponding to a merged control flow graph to obtain an adjusted edge connection matrix according to an exemplary embodiment.

[0053] Figure 7 The present invention is a flowchart showing a method for obtaining the error contribution rate of any node of any merged function at any time according to an exemplary embodiment.

[0054] Figure 8 The present invention is a flowchart showing a method for obtaining the weight of an edge between any node and an adjacent node at any moment according to an error contribution rate according to an exemplary embodiment.

[0055] Figure 9 This is a flowchart of a method for obtaining defect detection results for software source code by training a graph neural network based on an adjusted edge connection matrix and combining multi-dimensional features of each node of a merged control flow graph according to an exemplary embodiment.

[0056] Figure 10 The present invention is a block diagram of a software source code defect detection system based on deep learning according to an exemplary embodiment.

[0057] Figure 11 The figure is a block diagram of a server according to an exemplary embodiment. DETAILED DESCRIPTION

[0058] In order to clearly illustrate the technical features of this solution, this application is described in detail below through specific implementation methods and in conjunction with the accompanying drawings.

[0059] The following describes embodiments of the present application in more detail with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are for illustrative purposes only and are not intended to limit the scope of protection of the present application.

[0060] It should be understood that the various steps described in the method embodiments of the present application can be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0061] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0062] It should be noted that the concepts of "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0063] It should be noted that the modifiers "one" and "multiple" mentioned in this application are illustrative and non-restrictive. Those skilled in the art will understand that, unless the context clearly indicates otherwise, they should be understood as "one or more." In the description of this application, unless otherwise specified, "multiple" means two or more than two, and other quantifiers are similar. "At least one item (item)", "one (item) or more (items)" or similar expressions refer to any combination of these items (items), including any combination of single items (items) or plural items (items). For example, at least one item (item) a can refer to any number of a; for another example, one (item) or more (items) of a, b, and c can refer to: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural. "And / or" is a relationship that describes the association of related objects, indicating that three relationships can exist. For example, A and / or B can refer to three situations: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural.

[0064] Although operations or steps are described in a specific order in the drawings in the embodiments of the present application, this should not be understood as requiring that these operations or steps be performed in the specific order shown or in a serial order, or that all of the operations or steps shown be performed to obtain the desired result. In the embodiments of the present application, these operations or steps may be performed in serial; these operations or steps may be performed in parallel; or some of these operations or steps may be performed.

[0065] At the same time, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant regulations.

[0066] First, the application scenario of the present application is described. In practical applications, software systems usually need to process a variety of structured or semi-structured business data. The execution results of the code logic depend not only on the grammatical structure and control flow, but also on the semantic attributes, value range and context constraints of the input data. However, existing detection methods often focus on the static characteristics of the code structure itself, ignoring the dynamic connection between the code and business data, resulting in the inability to identify defect types closely related to data semantics, such as missed boundary judgments, improper handling of outliers, and data dependency mismatches. Especially in data-sensitive systems such as finance and medical care, detection mechanisms that lack data perception capabilities are difficult to meet high-reliability application requirements. Therefore, there is an urgent need to construct a deep learning method that integrates source code structure information and data flow semantics to improve the depth and accuracy of source code defect detection. The present application is described below in conjunction with specific embodiments.

[0067] Figure 1 FIG. 1 is a flowchart of a method for detecting software source code defects based on deep learning according to an exemplary embodiment. Figure 1 As shown, the embodiment of the present application provides a software source code defect detection method based on deep learning, which may include the following steps:

[0068] In step S10, historical running error data of the software source code is obtained.

[0069] In this step, the historical operation error data of the software source code is obtained. For example, the basic data containing historical defect instances can be constructed by collecting and archiving the log information, exception reports, debugging records and other data generated by the target software during actual operation. Specifically, it includes but is not limited to: error stack information in the operation log, the type and location of exceptions thrown by the system, the description of the problem reported by the user, the abnormal results triggered during the execution of the test case, and the error context information associated with the runtime data (such as input parameters, configuration items, database fields, etc.). By cleaning the above data, a software defect sample library is established, and each defect instance is annotated, including the location where the defect occurs (source code file function block and line number), defect type (such as calculation error, logical exception, data out of bounds, null pointer, etc.), triggering conditions and related operation data characteristics, providing high-quality data support for subsequent model training and defect pattern mining.

[0070] In step S20, based on the historical running error data, multiple functions in the software source code are associated, and control flow graphs corresponding to the multiple functions are merged to obtain a merged control flow graph.

[0071] In this step, based on historical runtime error data, multiple functions in the software source code are correlated, and the control flow graphs corresponding to the multiple functions are merged to obtain a merged control flow graph. For example, the granularity of any function in the multiple functions can be first obtained, and then the control flow correlation coefficient between any two functions in the multiple functions can be obtained based on the granularity of any function in the multiple functions. Functions are then clustered based on the granularity and control flow correlation coefficient to obtain the merged control flow graph.

[0072] In step S30, the weight of the edge connection matrix corresponding to the merged control flow graph is adjusted to obtain an adjusted edge connection matrix.

[0073] In this step, the edge connection matrix corresponding to the merged control flow graph is weighted and adjusted to obtain an adjusted edge connection matrix. For example, the error contribution rate of any node of any function after the merger at any time can be obtained. Then, based on the error contribution rate, the weight of the edge between any node and its adjacent nodes at any time can be obtained. Then, based on the edge weights in the edge connection matrix, the edge connection matrix corresponding to the merged control flow graph is weighted and adjusted to obtain the adjusted edge connection matrix.

[0074] In step S40, a graph neural network is trained based on the adjusted edge connection matrix and combined with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code.

[0075] In this step, a graph neural network is trained based on the adjusted edge connectivity matrix and the multi-dimensional features of each node in the merged control flow graph to obtain defect detection results for the software source code. For example, the adjusted edge connectivity matrix and the multi-dimensional features of each node in the merged control flow graph can be used as inputs to the graph neural network. The presence of errors in the detection nodes and the error types in historical runtime error data are then used as output labels for the graph neural network. The graph neural network is then trained using a cross-entropy loss function to obtain defect detection results for the software source code.

[0076] In summary, an embodiment of the present application provides a software source code defect detection method based on deep learning, the method comprising: obtaining historical runtime error data of the software source code; based on the historical runtime error data, associating multiple functions in the software source code, and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph; weight-adjusting the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix; training a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code. An embodiment of the present application is based on data-driven, merges the control flow graphs corresponding to multiple related functions, and weight-adjusts the edge connection matrix corresponding to the merged control flow graph, and finally trains a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code, thereby improving the accuracy of source code defect detection.

[0077] Figure 2 This is a flowchart of a method for associating multiple functions in software source code based on historical running error data and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph according to an exemplary embodiment. Figure 2 As shown, the correlating multiple functions in the software source code based on the historical running error data and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph may include the following steps:

[0078] In step S201 , the granularity of any function among the multiple functions is obtained.

[0079] In this step, the granularity of any function in the multiple functions is obtained. For example, the graph complexity of any function in the multiple functions can be obtained first, and then the graph complexity information entropy corresponding to the multiple functions can be obtained. Then, the parameter number information entropy corresponding to the multiple functions can be obtained, and then the number of parameters of any function in the multiple functions can be obtained. Finally, the granularity of any function in the multiple functions can be obtained based on the graph complexity, graph complexity information entropy, parameter number information entropy, and number of parameters.

[0080] In step S202 , a control flow correlation coefficient between any two functions among the multiple functions is obtained according to the granularity of any function among the multiple functions.

[0081] In this step, a control flow correlation coefficient between any two functions in the multiple functions is obtained based on the granularity of any function in the multiple functions. For example, the number of edges in the control flow graph between any two functions in the multiple functions can be obtained first, followed by the number of variables present in any two functions in the multiple functions. Finally, based on the number of edges, the number of variables, and the granularity of any two functions, the control flow correlation coefficient between any two functions in the multiple functions can be obtained.

[0082] In step S203, function clustering is performed according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph.

[0083] In this step, functions are clustered based on granularity and control flow correlation coefficient to obtain a merged control flow graph. For example, functions with smaller granularity and stronger control flow correlation can be clustered and merged based on granularity and control flow correlation coefficient to obtain a merged control flow graph.

[0084] Figure 3 FIG. 1 is a flow chart showing a method for obtaining the granularity of any function among multiple functions according to an exemplary embodiment. Figure 3 As shown, obtaining the granularity of any function among the multiple functions may include the following steps:

[0085] In step S2011, the graph complexity of any function among the multiple functions is obtained.

[0086] In this step, the graph complexity of any function i among multiple functions is obtained. For example, the graph complexity of any function i among multiple functions is It can be obtained by the following formula:

[0087] Formula 1

[0088] in, Indicates the number of edges in the control flow graph corresponding to the function, Represents the number of nodes in the control flow graph, Indicates the exit number of the function.

[0089] In step S2012, graph complexity information entropy corresponding to the multiple functions is obtained.

[0090] In this step, the graph complexity information entropy corresponding to multiple functions is obtained .

[0091] In step S2013, the parameter quantity information entropy corresponding to the multiple functions is obtained.

[0092] In this step, the information entropy of the number of parameters corresponding to multiple functions is obtained .

[0093] In step S2014, the number of parameters of any function among the multiple functions is obtained.

[0094] In this step, get the number of parameters of any function i among multiple functions .

[0095] In step S2015, the granularity of any function among the multiple functions is obtained according to the graph complexity, the graph complexity information entropy, the parameter quantity information entropy, and the number of parameters.

[0096] In this step, according to the graph complexity , Graph Complexity Information Entropy , parameter number information entropy , and the number of parameters , get the granularity of any function i among multiple functions For example, the granularity of any function i among multiple functions is It can be obtained by the following formula:

[0097] Formula 2

[0098] in, or Not zero.

[0099] First, the source code is partitioned (based on individual functions, etc.), generating a control flow graph corresponding to each function module. Feature extraction is then performed on this control flow graph to obtain static graph structure data. During graph neural network training, the basic input unit is the graph structure corresponding to a function module. However, in real-world code, cross-function calls and data dependencies are frequent, and functions are not isolated. Therefore, in addition to traditional estimated function module partitioning, it is necessary to consider the connections between multiple function modules and perform adaptive function block partitioning. During the function extraction and analysis phase, the source code is statically analyzed using the programming language's syntax parsing tools to automatically identify and partition all independent function modules. Taking Python code as an example, the built-in ast (Abstract Syntax Tree) module is used to construct and traverse the source file syntax tree, extracting the definition, structure, and nesting relationships of each function. For each extracted function module, its internal logical structure is further analyzed, including control structures such as conditional branches, loop statements, jumps, and returns, and a control flow graph (CFG) is constructed. This graph consists of basic blocks as nodes, and directed edges represent the program execution path. The radon tool is used to analyze the control structure of the code and obtain the control flow graph corresponding to the function module.

[0100] In existing software defect detection methods, a single function is often used as the basic unit of analysis. A corresponding control flow graph (CFG) is generated independently for each function, and subsequent graph neural network modeling and learning are performed. However, during the training or detection process, if all functions are treated equally as a single graph input unit of the graph neural network, due to the differences in granularity of different functions, small function graphs lack sufficient contextual information, making it difficult to determine whether they constitute defects. The model also finds it difficult to extract graph features of a unified scale, resulting in a decrease in generalization ability.

[0101] When dividing the function modules, consider analyzing multiple smaller-granularity functions, consider the correlation between multiple small-granularity functions, that is, whether there are more parameter passing situations, and then merge the control flow graphs corresponding to multiple small-granularity functions to further represent the source code processing logic, thereby improving the accuracy of the merged control flow graph in code anomaly detection.

[0102] Figure 4 This is a flowchart of a method for obtaining a control flow correlation coefficient between any two functions in a plurality of functions according to the granularity of any function in a plurality of functions according to an exemplary embodiment. Figure 4 As shown, obtaining the control flow correlation coefficient between any two functions among the multiple functions according to the granularity of any function among the multiple functions may include the following steps:

[0103] In step S2021, the number of edges of the control flow graph between any two functions among the multiple functions is obtained.

[0104] In this step, the number of edges in the control flow graph between any two functions i and j in multiple functions is obtained. .

[0105] In step S2022, the number of variables existing in any two functions among the multiple functions is obtained.

[0106] In this step, we get the number of variables that exist in any two functions i and j among multiple functions. .

[0107] In step S2023, a control flow correlation coefficient between any two functions in the multiple functions is obtained according to the number of edges, the number of variables, and the granularity of the any two functions.

[0108] In this step, according to the number of edges , number of variables , and the granularity of any two functions i and j and , get the control flow correlation coefficient between any two functions i and j in multiple functions For example, the control flow correlation coefficient between any two functions i and j in multiple functions is It can be obtained by the following formula:

[0109] Formula 3

[0110] in, Not zero.

[0111] That is, when there are many similar parameter features between two smaller granularity functions, the control flow correlation coefficient of the two functions is The larger it is, the stronger the control flow connection between the two functions.

[0112] Figure 5 This is a flowchart of a method for clustering functions based on granularity and control flow correlation coefficient to obtain a merged control flow graph according to an exemplary embodiment. Figure 5 As shown, performing function clustering according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph may include the following steps:

[0113] In step S2031, based on the granularity and the control flow correlation coefficient, functions with smaller granularity and stronger control flow correlation are clustered and merged to obtain a merged control flow graph.

[0114] In this step, based on the granularity and control flow correlation coefficient, the functions with granularity less than the preset granularity threshold and control flow correlation coefficient greater than the preset correlation coefficient threshold are clustered and merged to obtain a merged control flow graph. For example, in order to merge functions with small granularity (granularity less than the preset granularity threshold) and strong control flow correlation (control flow correlation coefficient greater than the preset correlation coefficient threshold), multiple small granularity functions can be merged by DBSCAN clustering. According to the obtained control flow correlation coefficient ,Pick The reciprocal of is used as the distance between the two functions to perform cluster analysis. In this clustering process, the cluster radius is set to 2, and the minimum number of sample points within the cluster radius is set to 5, thereby obtaining the clustering results. The preset granularity threshold can be 0.3, and the preset correlation coefficient threshold can be 0.7.

[0115] The clustering results primarily include two types of sample points: core objects and non-core objects. For core objects with multiple functions that have strong control flow correlations, the top five functions with the strongest control flow correlations are selected and merged with them to produce a merged control flow graph. For non-core objects, their corresponding functions are relatively isolated or have sufficiently large granularity, so no further merging is required.

[0116] Figure 6 This is a flow chart showing a method for adjusting the weight of the edge connection matrix corresponding to the merged control flow graph to obtain the adjusted edge connection matrix according to an exemplary embodiment. Figure 6 As shown, the weight adjustment of the edge connection matrix corresponding to the merged control flow graph to obtain the adjusted edge connection matrix may include the following steps:

[0117] In step S301 , the error contribution rate of any node of any merged function at any time is obtained.

[0118] In this step, the error contribution rate of any node of any merged function at any time is obtained. For example, a first execution timestamp sequence of any node of any merged function within a set time period can be obtained first, and then a second execution timestamp sequence of adjacent nodes of related functions of any merged function within a set time period can be obtained. Then, based on the first execution timestamp sequence and the second execution timestamp sequence, the error contribution rate of any node of any merged function at any time period can be obtained.

[0119] In step S302, the weight of the edge between any node and its adjacent node at any moment is obtained according to the error contribution rate.

[0120] In this step, the weight of the edge between any node and any adjacent node at any time is obtained based on the error contribution rate. For example, a first error contribution rate can be obtained first, where the first error contribution rate is the error contribution rate of any node of any function after the merger at any time, and then a second error contribution rate is obtained, where the second error contribution rate is the error contribution rate of the adjacent node of the related function at any time. Then, based on the first error contribution rate and the second error contribution rate, the weight of the edge between any node and the adjacent node at any time is obtained.

[0121] In step S303, the edge connection matrix corresponding to the merged control flow graph is weight-adjusted according to the weight of the edge to obtain an adjusted edge connection matrix.

[0122] In this step, the edge connection matrix corresponding to the merged control flow graph is weight-adjusted according to the edge weights to obtain an adjusted edge connection matrix. Exemplarily, the edge weight parameter information can be added to the edge connection matrix corresponding to the merged control flow graph to obtain the adjusted edge connection matrix.

[0123] For example, the edge connection matrix corresponding to the merged control flow graph can be shown as follows:

[0124] [0, 1, 1, 2, 2];

[0125] [1, 2, 3, 3, 0];

[0126] Among them, each data in the first row represents the number of the starting node of an edge, and each data in the second row represents the number of the ending node of an edge. This matrix contains 5 edges, namely 0-1, 1-2, 1-3, 2-3, and 2-0.

[0127] The edge connection matrix after edge weight adjustment can be shown as follows:

[0128] [0, 1, 1, 2, 2];

[0129] [1, 2, 3, 3, 0];

[0130] [0.82, 0.45, 0.67, 0.91, 0.38];

[0131] Among them, the five data in the third row represent the weight data information of each edge, that is, the edge weight of the 0-1 edge is 0.82, the edge weight of the 1-2 edge is 0.45, the edge weight of the 1-3 edge is 0.67, the edge weight of the 2-3 edge is 0.91, and the edge weight of the 2-0 edge is 0.38. It can be seen that the weight data information of each edge is added to this matrix, and the edge weights of the control flow graph of each function in the source code are corrected.

[0132] Figure 7 FIG. 1 is a flow chart showing a method for obtaining the error contribution rate of any node of any merged function at any time according to an exemplary embodiment. Figure 7 As shown, obtaining the error contribution rate of any node of any merged function at any time may include the following steps:

[0133] In step S3011, the first execution timestamp sequence of any node of any merged function within a set time is obtained.

[0134] In this step, obtain the first execution timestamp sequence of any node s of any merged function k within a set time (for example, 1 hour) . Exemplarily, the first execution timestamp sequence It can represent the execution status of node s of function k within a set time.

[0135] Considering that the probability of errors occurring in the same source code is different when processing different data, for example, for financial software, its processing behavior is "time-sensitive". At key time points such as the end of the month, the end of the quarter, and the end of the year, a large number of business operations (such as batch settlement, account period carryforward, year-end reports, tax declarations, etc.) will occur in a concentrated manner. The frequency of data circulation is high, which can easily become a system bottleneck or a high-incidence point of errors.

[0136] Therefore, based on the multi-dimensional features corresponding to the above static control flow graph, the dynamic features of each node are counted in real time. In a 1-hour time window, the execution timestamp, total number of executions, and time consumption of each execution of each node within a historical hour are counted for further analysis.

[0137] In step S3012, a second execution timestamp sequence of adjacent nodes of related functions of any merged function within a set time is obtained.

[0138] In this step, the second execution timestamp sequence of the adjacent node r of the related function j of any merged function k within a set time (for example, 1 hour) is obtained. . Exemplarily, the second execution timestamp sequence It can represent the execution status of node r of function j within a set time.

[0139] In step S3013, the error contribution rate of any node of any merged function at any time is obtained according to the first execution timestamp sequence and the second execution timestamp sequence.

[0140] In this step, the timestamp sequence is executed according to the first and the second execution timestamp sequence , obtain the error contribution rate of any node s of any function k after the merger at any time t For example, the error contribution rate of any node s of any function k at any time t after merging is It can be obtained by the following formula:

[0141] Formula 4

[0142] in, Indicates the The number of functions corresponding to the number of nodes in the control flow graph, Indicates the DTW (Dynamic Time Warping) distance between two timestamp sequences.

[0143] exist and When the similarity is high, there is a high similarity in the execution process between the two function nodes within the past hour. There is a runtime error in the function node r. Function The node will also display some error information.

[0144] Figure 8 This is a flow chart showing a method for obtaining the weight of an edge between any node and an adjacent node at any time according to an error contribution rate according to an exemplary embodiment. Figure 8 As shown, obtaining the weight of the edge between any node and its adjacent nodes at any moment according to the error contribution rate may include the following steps:

[0145] In step S3021, a first error contribution rate is obtained, where the first error contribution rate is the error contribution rate of any node of any merged function at any moment.

[0146] In this step, the first error contribution rate is obtained , the first error contribution rate is the error contribution rate of any node s of any function k after merging at any time t.

[0147] After merging some core function objects, taking the kth function as an example, there are more data associations between it and the merged functions. However, in different periods, there is not necessarily more data transmission between functions with strong control flow associations. Therefore, when an error occurs in the kth core function object, the contribution of different functions to the error among the several functions merged with it is different.

[0148] In step S3022, a second error contribution rate is obtained, where the second error contribution rate is the error contribution rate of the adjacent node of the correlation function at any time.

[0149] In this step, the second error contribution rate is obtained , the second error contribution rate is the error contribution rate of the neighboring node r of the correlation function j at any time t.

[0150] In step S3023, the weight of the edge between the any node and the adjacent node at the any moment is obtained according to the first error contribution rate and the second error contribution rate.

[0151] In this step, according to the first error contribution rate and the second error contribution rate , get the weight of the edge between any node s and its adjacent node r at any time t For example, at any time t, the weight of the edge between any node s and its adjacent node r is It can be obtained by the following formula:

[0152] Formula 5

[0153] Figure 9 This is a flowchart of a method for obtaining defect detection results of software source code by training a graph neural network based on an adjusted edge connection matrix and combining the multi-dimensional features of each node of the merged control flow graph according to an exemplary embodiment. Figure 9 As shown, the training of a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain the defect detection result of the software source code may include the following steps:

[0154] In step S401, the adjusted edge connection matrix and the multi-dimensional features of each node of the merged control flow graph are used as inputs of the graph neural network.

[0155] In this step, the edge connection matrix after adjusting the edge weights and the multi-dimensional features of each node in the merged control flow graph are used as input to the graph neural network. Exemplarily, the multi-dimensional features of each node in the merged control flow graph may include at least one of the following:

[0156] a) Node semantic type: such as assignment, judgment, function call, etc., quantized through one-hot encoding.

[0157] b) Whether it is a branch node: Whether it is an if / while / for structure, the Boolean type value is 0 / 1.

[0158] c) Number of variables involved: the number of variables involved in the current statement.

[0159] d) Number of API calls: the number of external API functions called in the node.

[0160] e) Is it a return statement?: This field is used to identify a return statement. The Boolean type takes a value of 0 or 1.

[0161] f) Node position encoding: position encoding information in the control flow graph.

[0162] In step S402, whether there is an error in the detection node in the historical operation error data and the error type are used as the output label of the graph neural network.

[0163] In this step, the output label of the graph neural network is based on whether the detection node has an error and the error type in the historical running error data. For example, the label representation of each node can be:

[0164] 0: no error;

[0165] 1-n: There are different error types, such as syntax errors, logic errors, resource release errors, etc.

[0166] In step S403, the graph neural network is trained using a cross entropy loss function to obtain a defect detection result of the software source code.

[0167] In this step, the graph neural network is trained using a cross-entropy loss function to obtain defect detection results for the software source code. For example, a GAT (Graph Attention Network) model structure can be selected, and the neural network is trained using a cross-entropy loss function to obtain defect detection results for the software source code.

[0168] In summary, an embodiment of the present application provides a software source code defect detection method based on deep learning, the method comprising: obtaining historical runtime error data of the software source code; based on the historical runtime error data, associating multiple functions in the software source code, and merging the control flow graphs corresponding to the multiple functions to obtain a merged control flow graph; weight-adjusting the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix; training a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code. An embodiment of the present application is based on data-driven, merges the control flow graphs corresponding to multiple related functions, and weight-adjusts the edge connection matrix corresponding to the merged control flow graph, and finally trains a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code, thereby improving the accuracy of source code defect detection.

[0169] The present application also provides a computer-readable storage medium having computer program instructions stored thereon. When the program instructions are executed by a processor, the steps of the software source code defect detection method based on deep learning provided in the present application are implemented.

[0170] Figure 10 FIG1 is a block diagram of a software source code defect detection system based on deep learning according to an exemplary embodiment. Figure 10 As shown, an embodiment of the present application provides a software source code defect detection system 1000 based on deep learning, including a server 1100.

[0171] Figure 11 FIG. 1 is a block diagram of a server according to an exemplary embodiment. Figure 11 Server 1100 includes a processing component 1122, which further includes one or more processors, and memory resources represented by memory 1132 for storing instructions executable by processing component 1122, such as applications. The applications stored in memory 1132 may include one or more modules, each corresponding to a set of instructions. Furthermore, processing component 1122 is configured to execute instructions to perform the aforementioned deep learning-based software source code defect detection method.

[0172] The server 1100 may also include a power supply component 1126 configured to perform power management of the server 1100, a communication component 1150 configured to connect the server 1100 to a network, and an input / output interface 1158. The server 1100 may operate based on an operating system stored in the memory 1132.

[0173] In another exemplary embodiment, a computer program product is also provided, which includes a computer program that can be executed by a programmable electronic device, and the computer program has a code portion for executing the above-mentioned deep learning-based software source code defect detection method when executed by the programmable electronic device.

[0174] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the scope of the present application, and such modifications and improvements are all within the scope of protection of the present application.

Claims

1. A software source code defect detection method based on deep learning, characterized in that: The method comprises: Obtaining historical running error data of the software source code; Based on the historical running error data, multiple functions in the software source code are associated, and control flow graphs corresponding to the multiple functions are merged to obtain a merged control flow graph; performing weight adjustment on the edge connection matrix corresponding to the merged control flow graph to obtain an adjusted edge connection matrix; Training a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code; Acquisition of the merged control flow graph, including: Obtaining the granularity of any function among the plurality of functions; Obtaining, according to the granularity of any function among the multiple functions, a control flow correlation coefficient between any two functions among the multiple functions; Function clustering is performed according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph.

2. The software source code defect detection method based on deep learning according to claim 1, characterized in that: The obtaining of the granularity of any function among the multiple functions includes: Obtaining the graph complexity of any function among the multiple functions; Obtaining graph complexity information entropy corresponding to the multiple functions; Obtaining information entropy of the number of parameters corresponding to the multiple functions; Obtaining the number of parameters of any function among the multiple functions; The granularity of any function among the multiple functions is obtained according to the graph complexity, the graph complexity information entropy, the parameter quantity information entropy, and the number of parameters.

3. The software source code defect detection method based on deep learning according to claim 1, characterized in that: The obtaining, according to the granularity of any function among the multiple functions, a control flow correlation coefficient between any two functions among the multiple functions includes: Obtaining the number of edges in a control flow graph between any two functions among the plurality of functions; Obtain the number of variables that exist in any two functions among the multiple functions; A control flow correlation coefficient between any two functions in the plurality of functions is obtained according to the number of edges, the number of variables, and the granularity of the any two functions.

4. The software source code defect detection method based on deep learning according to claim 1, characterized in that: The performing function clustering according to the granularity and the control flow correlation coefficient to obtain a merged control flow graph includes: According to the granularity and the control flow correlation coefficient, functions whose granularity is smaller than a preset granularity threshold and whose control flow correlation coefficient is larger than a preset correlation coefficient threshold are clustered and merged to obtain a merged control flow graph.

5. The software source code defect detection method based on deep learning according to claim 1, characterized in that: The weight adjustment of the edge connection matrix corresponding to the merged control flow graph to obtain the adjusted edge connection matrix includes: Get the error contribution rate of any node of any merged function at any time; Obtaining, according to the error contribution rate, the weight of the edge between the any node and an adjacent node of the any node at any moment; According to the weights of the edges, the edge connection matrix corresponding to the merged control flow graph is weight-adjusted to obtain an adjusted edge connection matrix.

6. The software source code defect detection method based on deep learning according to claim 5, characterized in that: The obtaining of the error contribution rate of any node of any merged function at any time includes: Obtaining the first execution timestamp sequence of any node of any merged function within a set time; Obtaining a second execution timestamp sequence of adjacent nodes of related functions of any of the merged functions within a set time; According to the first execution timestamp sequence and the second execution timestamp sequence, the error contribution rate of any node of any merged function at any moment is obtained.

7. The software source code defect detection method based on deep learning according to claim 5, characterized in that: The obtaining, at any moment, the weight of the edge between the any node and its adjacent nodes according to the error contribution rate includes: Obtain a first error contribution rate, where the first error contribution rate is the error contribution rate of any node of any function after the merger at any moment; Obtain a second error contribution rate, where the second error contribution rate is an error contribution rate of the adjacent node of the correlation function at any time; The weight of the edge between the any node and an adjacent node of the any node at any moment is obtained according to the first error contribution rate and the second error contribution rate.

8. The software source code defect detection method based on deep learning according to claim 1, characterized in that: The training of a graph neural network based on the adjusted edge connection matrix and in combination with the multi-dimensional features of each node of the merged control flow graph to obtain a defect detection result of the software source code includes: Using the adjusted edge connection matrix and the multi-dimensional features of each node of the merged control flow graph as input to the graph neural network; Whether an error occurs in a detection node in the historical running error data, and the error type are used as output labels of the graph neural network; The graph neural network is trained using a cross entropy loss function to obtain a defect detection result of the software source code.

9. A software source code defect detection system based on deep learning, characterized in that: The system includes a server, and the server includes: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 8.

Images