Methods, apparatus, computer equipment, and media for constructing a code repair knowledge base

Abstract

This invention provides a method, apparatus, computer device, and medium for constructing a code repair knowledge base. The method includes the following steps: using multiple vulnerability scanning tools to perform static vulnerability scanning on the code recorded in a version control tool, recording each vulnerability and its corresponding vulnerability information; obtaining the commit records of the vulnerability locations in chronological order, detecting whether the vulnerability disappeared after the commit, and if the vulnerability disappeared, recording the commit information, code differences, and abstract syntax tree changes of the version control tool from the existence of the vulnerability to its disappearance; extracting vector features from the commit information, code differences, and abstract syntax tree changes, generating vectorized feature information; constructing a vector database using the vectorized feature information, and constructing a code repair knowledge base using the vector database. This solution improves the intelligence level of vulnerability repair by constructing a code repair knowledge base.

Description

Technical Field

[0001] This invention relates to the field of computer program technology, and in particular to a method, apparatus, computer equipment, and medium for constructing a code repair knowledge base. Background Technology

[0002] In modern software development, the detection and remediation of code vulnerabilities are crucial for ensuring software security and stability. As software systems become increasingly complex and undergo frequent version iterations, traditional methods relying on manual vulnerability detection and remediation are no longer sufficient to meet the demands for development efficiency and accuracy. Therefore, automated vulnerability detection and remediation technologies are receiving increasing attention.

[0003] Static vulnerability scanning tools (such as SonarQube and Coverity) are widely used to automatically identify the types and locations of potential vulnerabilities in code. However, these tools primarily focus on the "vulnerability detection" stage, lacking systematic analysis and structured modeling of the subsequent "remediation process." Meanwhile, version control systems (such as Git), as the mainstream code change management tool, meticulously record every commit during development, including code modifications, commit messages, and their corresponding unique commit IDs. This historical commit data contains rich clues for vulnerability remediation; combining it with vulnerability detection results will provide a reliable data foundation for building a systematic vulnerability remediation knowledge base.

[0004] However, current mainstream methods for building vulnerability remediation knowledge bases still face the following challenges:

[0005] 1. Reliance on manual annotation, resulting in low efficiency: Traditional methods usually require manual screening and annotation of repair cases, which is tedious, time-consuming, and difficult to adapt to the processing needs of large-scale code bases;

[0006] 2. Low level of data structuring and limited reuse value: The code change information before and after the fix is ​​often not systematically organized and stored in a structured manner, resulting in insufficient usability of the knowledge base in subsequent vulnerability matching and fix suggestion generation;

[0007] 3. Lack of in-depth understanding and modeling of the remediation path: Current methods are unable to fully extract multi-dimensional features in the vulnerability remediation process, which limits their application depth in intelligent recommendation and model training.

[0008] To address the aforementioned issues, there is an urgent need for an automated knowledge base construction method that integrates vulnerability scanning, version submission history analysis, and semantic understanding capabilities. Summary of the Invention

[0009] In view of this, embodiments of the present invention provide a method for constructing a code repair knowledge base to solve the technical problems of low efficiency and limited reusability in existing vulnerability repair methods. The method includes:

[0010] Using multiple vulnerability scanning tools, static vulnerability scanning is performed on the code recorded in the version management tool, recording each vulnerability and the corresponding vulnerability information, wherein the vulnerability information includes the vulnerability location and vulnerability type;

[0011] The commit records of the vulnerability location are obtained in chronological order. The commit records are used to detect whether the vulnerability disappeared after the commit. If the vulnerability disappears, the commit information, code differences and abstract syntax tree changes of the version management tool are recorded from the existence of the vulnerability to the disappearance of the vulnerability. The commit information includes the commit ID and commit comments of the version management tool.

[0012] Extract vector features from the submission information, the code differences, and the abstract syntax tree changes respectively, and generate vectorized feature information from the vector features;

[0013] A vector database is constructed using the vectorized feature information, and a code repair knowledge base is constructed using the vector database.

[0014] This invention also provides an apparatus for constructing a code repair knowledge base to address the technical problems of low efficiency and limited reusability in existing vulnerability repair technologies. The apparatus includes:

[0015] The vulnerability scanning module is used to perform static vulnerability scanning on the code recorded in the version management tool using various vulnerability scanning tools, and to record each vulnerability and the vulnerability information corresponding to the vulnerability, wherein the vulnerability information includes the vulnerability location and vulnerability type;

[0016] The information extraction module is used to obtain the commit records of the vulnerability location in chronological order, and to detect whether the vulnerability disappeared after the commit through the commit records. If the vulnerability disappears, the module records the commit information, code differences and abstract syntax tree changes of the version management tool from the existence of the vulnerability to its disappearance. The commit information includes the commit ID and commit notes of the version management tool.

[0017] The feature vectorization module is used to extract vector features from the submission information, the code differences, and the abstract syntax tree changes, and generate vectorized feature information through the vector features.

[0018] The knowledge base construction module is used to construct a vector database using the vectorized feature information, and to construct a code repair knowledge base using the vector database.

[0019] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for constructing any of the code repair knowledge bases, thereby solving the technical problems of low efficiency and limited reuse value in vulnerability repair in the prior art.

[0020] This invention also provides a computer-readable storage medium storing a computer program that executes any of the above-described methods for constructing a code repair knowledge base, in order to solve the technical problems of low efficiency and limited reusability of vulnerability repair in the prior art.

[0021] Compared with the prior art, the beneficial effects that at least one technical solution adopted in the embodiments of this specification can achieve include at least:

[0022] By combining static vulnerability scanning results with historical data from version control systems and utilizing large language models for semantic modeling, a high-quality code repair knowledge base can be built. This will significantly improve the intelligence level of vulnerability repair and meet the current urgent need for efficient and automated vulnerability repair in software development. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a method for constructing a code repair knowledge base provided in an embodiment of the present invention;

[0025] Figure 2 This is a structural block diagram of a computer device provided in an embodiment of the present invention;

[0026] Figure 3 This is a structural block diagram of a code repair knowledge base construction device provided in an embodiment of the present invention. Detailed Implementation

[0027] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0028] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] In this embodiment of the invention, a method for constructing a code repair knowledge base is provided, such as... Figure 1 As shown, the method includes:

[0030] Step S101: Use multiple vulnerability scanning tools to perform static vulnerability scanning on the code recorded in the version management tool, and record each vulnerability and the vulnerability information corresponding to the vulnerability, wherein the vulnerability information includes the vulnerability location and vulnerability type;

[0031] Step S102: Obtain the commit records of the vulnerability location in chronological order, and use the commit records to detect whether the vulnerability disappeared after the commit. If the vulnerability disappears, record the commit information, code differences, and abstract syntax tree changes of the version management tool from the existence of the vulnerability to its disappearance. The commit information includes the commit ID and commit notes of the version management tool.

[0032] Step S103: Extract the vector features of the submission information, the code differences, and the abstract syntax tree changes respectively, and generate vectorized feature information through the vector features;

[0033] Step S104: Construct a vector database using the vectorized feature information, and construct a code repair knowledge base using the vector database.

[0034] In practice, the following steps are used to perform static vulnerability scanning on the code recorded in the version management tool using multiple vulnerability scanning tools, recording each vulnerability and its corresponding vulnerability information:

[0035] Static vulnerability scanning is performed on the code recorded in the version management tool using multiple vulnerability scanning tools to generate multiple vulnerability scanning results. The vulnerability scanning results are converted into a vulnerability scanning report in a unified format. Vulnerabilities with the same vulnerability location and vulnerability type are considered as the same vulnerability. Based on the vulnerability scanning reports generated by the multiple vulnerability scanning tools, it is determined whether the vulnerabilities in the multiple vulnerability scanning reports are all the same vulnerability. If they are the same vulnerability, the vulnerability location and vulnerability type are saved as vulnerability information.

[0036] Specifically, for older versions of project code managed using version control tools (such as Git), multiple static analysis tools are used to scan for code vulnerabilities, precisely locating the vulnerability's location (such as file path, line number) and its type. Static vulnerability scanning tools include at least three different types of code analysis tools (scanning principles, vulnerability coverage characteristics, and language framework support). A vulnerability is determined to exist only when all static analysis tools identify the same vulnerability.

[0037] In practice, to improve the accuracy of vulnerability detection, the following steps are taken to use different vulnerability scanning tools:

[0038] The vulnerability scanning tools are at least three different types, each with different scanning principles, vulnerability coverage characteristics, and language framework support.

[0039] The following lists several representative vulnerability scanning tools and highlights their scanning principles, coverage characteristics, and language framework support.

[0040] 1. FortifyStaticCodeAnalyzer (MicroFocus, formerly HPFortify).

[0041] Scanning principle:

[0042] Deep data flow analysis. Construct detailed code control flow graphs and data flow graphs to accurately track the propagation path of tainted data (user input, untrusted sources) within the program until it reaches sensitive operation points (such as executing SQL statements or calling system commands); combine language semantics and framework knowledge (such as Spring, Struts, .NET MVC) to understand the flow and processing of data within the framework; assist in detecting specific code patterns and performing pattern matching.

[0043] Coverage features / advantages:

[0044] Deep vulnerability detection. Particularly adept at detecting vulnerabilities requiring complex data flow analysis, such as SQL injection, command injection, path traversal, XSS (reflection / stored), XXE, insecure deserialization, and memory leaks (in some languages). False positives are relatively low (in deep analysis mode): False positives are reduced through path reachability analysis.

[0045] Language / framework support:

[0046] This includes Java, .NET (C#, VB.NET), C / C++, Python, JavaScript, PHP, PL / SQL, COBOL, Swift, Kotlin, Scala, and more.

[0047] 2. CoverityStaticAnalysis(Synopsys).

[0048] Scanning principle:

[0049] It features advanced inter-program analysis capabilities, emphasizing cross-function, cross-file, and even cross-module analysis; path-sensitive symbolic execution. It performs symbolic reasoning along code paths to explore different execution branches and conditional constraints; it uses formal methods to accurately model specific types of defects (such as null pointer dereferencing, resource leaks, and concurrency issues); and it utilizes a highly optimized engine known for its analysis speed and scalability, making it suitable for large codebases.

[0050] Coverage features:

[0051] It excels in quality and reliability defects, particularly in null pointer dereferencing, resource leaks (memory, file handles), concurrency issues (data races, deadlocks), buffer overflows, integer overflows, and logical errors. It also has good coverage of security vulnerabilities, such as SQL injection and XSS, but its depth of security vulnerability detection may be slightly inferior to the specialized Fortify, while it is superior in quality defect detection. It boasts high accuracy, especially in its core area of ​​quality defect detection, with high accuracy and low false positives.

[0052] Language / framework support:

[0053] C, C++, C#, Java, JavaScript, TypeScript, Python, Ruby, PHP, Go, etc.

[0054] 3. SonarQube (SonarSource) + security plugins (such as SonarJS, SonarJavawithsecurityrules).

[0055] Scanning principle:

[0056] The code's AST is built for structural analysis; a pattern matching / rule engine matches bad patterns, violations of best practices and security rules in the code using a large number of predefined rules (customizable); it provides some data flow tracing capabilities, but is usually not as in-depth as Fortify / Coverity.

[0057] Coverage features / advantages:

[0058] It has broad coverage, including security vulnerabilities, code smells, bugs, coding style issues, and duplicate code. Security rules cover common OWASP Top 10 and CWE Top 25 vulnerabilities (such as hardcoded passwords, weak encryption, XSS, and SQLi basic patterns).

[0059] Language / framework support:

[0060] It supports almost all major languages ​​(Java, C#, JS / TS, Python, PHP, Go, Kotlin, Swift, etc.) and frameworks through plugins.

[0061] IV. Bandit (specifically for Python).

[0062] Scanning principle:

[0063] Perform an AST scan on the Python source code;

[0064] Matching is performed using a predefined set of test rules that address common issues in the Python ecosystem;

[0065] Coverage features:

[0066] Specifically designed for Python, it has a very good understanding and coverage of Python-specific security risks (such as pickle deserialization, yaml.load risks, subprocess calls, and the use of assert statements in production environments); it is easy to integrate into the Python development process.

[0067] 5. ESLint + security plugins (such as eslint-plugin-security).

[0068] Scanning principle:

[0069] Based on AST pattern matching, it parses JavaScript / TypeScript code to generate AST and applies rules to match potential problem patterns; it is highly configurable, and the rules can be customized or extended through plugins.

[0070] Coverage features / advantages:

[0071] Focusing on front-end / Node.js, it detects common security issues in JavaScript / TypeScript, such as the use of eval(), direct assignment of innerHTML leading to XSS, regular expression denial-of-service, insecure child resource loading, and child_process command injection risks; it runs in the developer's IDE or pre-commit hook, providing real-time feedback.

[0072] Language / framework support:

[0073] For JavaScript / TypeScript projects, especially Node.js backends or rich frontend applications, the ESLint security plugin provides a rule set that is closer to language conventions and updated more frequently than general SAST tools (especially for the rapidly evolving JS ecosystem).

[0074] In specific implementation, the following steps are used to obtain the commit records of the vulnerability location in chronological order, and to detect whether the vulnerability disappeared after the commit using the commit records. If the vulnerability disappears, the commit information, code differences, and abstract syntax tree changes of the version management tool from the existence of the vulnerability to its disappearance are recorded:

[0075] The commit records are sorted in ascending order of time. All commit records after the initial commit node where the vulnerability first appeared are scanned. The vulnerability status of each commit record is checked in ascending order of time. When the vulnerability status of the same vulnerability location changes from "vulnerable" to "vulnerable", it is determined that the vulnerability has disappeared. If the vulnerability disappears, the commit information of the version management tool at the time of the vulnerability disappearance is recorded. The code and abstract syntax tree before and after the vulnerability disappearance are obtained, and the code differences and abstract syntax tree changes are generated after comparison.

[0076] Specifically, the scan begins from the commit node where the vulnerability first appeared; the vulnerability status is checked sequentially along the commit history; when the security check result for the same vulnerability location changes from dangerous to safe, the vulnerability is considered to have disappeared. The commit information (including the commit ID and commit comments) is recorded, with the commit ID serving as a key identifier that the vulnerability has been patched.

[0077] In specific implementation, the following steps are used to extract vector features from the submission information, the code differences, and the abstract syntax tree changes, respectively, and to generate vectorized feature information from these vector features:

[0078] Using a pre-trained large language model, the vector features of the submission information are extracted to generate submission information vector features; the vector features of the code differences are extracted to generate code difference vector features; the vector features of the abstract syntax tree changes are extracted to generate abstract syntax tree change vector features; and the vector features of the submission information vector features, the code difference vector features, and the abstract syntax tree change vector features are fused using a feature fusion method based on vector addition to generate vectorized feature information.

[0079] Specifically, all relevant submissions identified from the time the vulnerability appeared until it disappeared are comprehensively analyzed using a pre-trained large language model (such as an LLM model). The input to the large language model includes submission information, code differences (code change differences (diff)), and abstract syntax tree (AST) changes. The large language model aims to extract and fuse key features from this information to ultimately generate vectorized feature information about the vulnerability and its fix.

[0080] The commit messages are the commit messages for all commits from the existence of the vulnerability to its disappearance. The code differences are all code versions that have undergone changes from the existence of the vulnerability to its disappearance. The Abstract Syntax Tree (AST) changes are the path characteristics of all AST node changes from the existence of the vulnerability to its disappearance.

[0081] In specific implementation, the vector database is constructed using the vectorized feature information through the following steps:

[0082] Using the vectorized feature information as an index key, obtain the submission information corresponding to the index key; obtain the code before vulnerability fix and the code after vulnerability fix based on the submission ID of the submission information; use the code segment before fix and the code segment after fix as key values, and store the index key and the key value in the vector database.

[0083] Specifically, the generated vectorized feature information is used as the index key, and the code segment before and after the vulnerability is fixed corresponding to the index is used as the value. They are stored together in the vector database to build a code fixation knowledge base.

[0084] The code before and after the vulnerability is patched contains the complete context code block of the machine-patched version of the vulnerable function.

[0085] In practice, the following steps are used to obtain code repair suggestions from the code repair knowledge base:

[0086] The semantic features of the code to be repaired are converted into vector features; similar repair cases are searched in the code repair knowledge base using a vector similarity matching algorithm, and repair suggestions for the code are generated based on the similar repair cases.

[0087] Specifically, the training database supports similarity-based retrieval operations to match new vulnerabilities with historical vulnerability features in the knowledge base.

[0088] In this embodiment, a computer device is provided, such as... Figure 2 As shown, it includes a memory 201, a processor 202, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the construction method of any of the above-mentioned code repair knowledge bases.

[0089] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0090] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the above-described methods for constructing a code repair knowledge base.

[0091] Specifically, computer-readable storage media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media do not include transient media, such as modulated data signals and carrier waves.

[0092] Based on the same inventive concept, this invention also provides an apparatus for constructing a code repair knowledge base, as described in the following embodiments. Since the principle by which the apparatus for constructing a code repair knowledge base solves the problem is similar to the method for constructing a code repair knowledge base, the implementation of the apparatus can refer to the implementation of the method for constructing a code repair knowledge base, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0093] Figure 3 This is a structural block diagram of a code repair knowledge base construction device according to an embodiment of the present invention, such as... Figure 3 As shown, it includes: vulnerability scanning module 301, information extraction module 302, feature vectorization module 303, and knowledge base construction module 304. The structure is described below.

[0094] The vulnerability scanning module 301 is used to perform static vulnerability scanning on the code recorded in the version management tool using a variety of vulnerability scanning tools, and to record each vulnerability and the vulnerability information corresponding to the vulnerability, wherein the vulnerability information includes the vulnerability location and vulnerability type;

[0095] The information extraction module 302 is used to obtain the commit records of the vulnerability location in chronological order, and to detect whether the vulnerability disappeared after the commit through the commit records. If the vulnerability disappears, the commit information, code differences and abstract syntax tree changes of the version management tool are recorded from the existence of the vulnerability to the disappearance of the vulnerability. The commit information includes the commit ID and commit remarks of the version management tool.

[0096] The feature vectorization module 303 is used to extract vector features of the submission information, the code differences and the abstract syntax tree changes respectively, and generate vectorized feature information through the vector features.

[0097] The knowledge base construction module 304 is used to construct a vector database using the vectorized feature information and to construct a code repair knowledge base using the vector database.

[0098] In one embodiment, the vulnerability scanning module includes:

[0099] The tool scanning unit is used to perform static vulnerability scanning on the code recorded in the version management tool using multiple vulnerability scanning tools, and generate multiple vulnerability scanning results.

[0100] A format conversion unit is used to convert the vulnerability scanning results into a vulnerability scanning report in a unified format;

[0101] The vulnerability determination unit is used to classify vulnerabilities with the same vulnerability location and vulnerability type as the same vulnerability, and to determine whether the vulnerabilities in multiple vulnerability scanning reports generated by multiple vulnerability scanning tools are the same vulnerability.

[0102] An information storage unit is used to store the vulnerability location and vulnerability type as vulnerability information if the vulnerability is the same.

[0103] In one embodiment, the tool scanning unit is further configured to use at least three vulnerability scanning tools, each with different scanning principles, vulnerability coverage characteristics, and language framework support.

[0104] In one embodiment, the information extraction module includes:

[0105] The commit record scanning unit is used to sort the commit records in order from oldest to newest time, and scan all commit records after the initial commit node where the vulnerability first appeared.

[0106] The vulnerability status recording unit is used to check the vulnerability status of each submission record in chronological order from oldest to newest.

[0107] A unit is used to determine that a vulnerability has disappeared when the vulnerability status at the same vulnerability location changes from having a vulnerability to not having a vulnerability.

[0108] The syntax tree change acquisition unit is used to record the commit information of the version management tool when the vulnerability disappears, obtain the code and abstract syntax tree before and after the vulnerability disappears, and generate code differences and abstract syntax tree changes after comparison.

[0109] In one embodiment, the feature vectorization module includes:

[0110] The submission information feature extraction unit is used to extract the vector features of the submission information using a pre-trained large language model, and generate the submission information vector features.

[0111] The code difference feature extraction unit is used to extract the vector features of the code differences and generate code difference vector features;

[0112] Abstract syntax tree feature extraction unit is used to extract vector features of the abstract syntax tree change and generate abstract syntax tree change vector features;

[0113] The feature fusion unit is used to fuse the submission information vector features, the code difference vector features, and the abstract syntax tree change vector features using a feature fusion method based on vector addition to generate vectorized feature information.

[0114] In one embodiment, the knowledge base building module includes:

[0115] The submission information acquisition unit is used to use the vectorized feature information as an index key to acquire the submission information corresponding to the index key;

[0116] The code acquisition unit is used to acquire the code before and after vulnerability fix based on the submission ID of the submission information.

[0117] The vector database construction unit is used to store the index key and the key value in the vector database, using the code segment before repair and the code segment after repair as key values.

[0118] In one embodiment, the above-described apparatus further includes a module for obtaining repair suggestions.

[0119] In one embodiment, the repair suggestion module includes:

[0120] The semantic transformation unit is used to convert the semantic features of the code to be repaired into vector features;

[0121] The code repair case matching unit is used to search for similar repair cases in the code repair knowledge base using a vector similarity matching algorithm, and generate code repair suggestions based on the similar repair cases.

[0122] The embodiments of the present invention achieve the following technical effects:

[0123] By cross-validating multiple tools to accurately locate vulnerability nodes in the repository, tracing vulnerability remediation points through commit history, and utilizing a pre-trained large language model to extract and fuse multimodal features from commit information, code differences, and AST node change paths during the vulnerability's lifespan, a vectorized indexed remediation knowledge base is constructed. This knowledge base supports intelligent retrieval of vulnerability remediation solutions based on feature similarity and is suitable for the development of automated code remediation systems, security auditing tools, and intelligent programming assistance platforms. Leveraging the semantic expression capabilities of the pre-trained large language model, joint analysis of multiple commit nodes, code differences, and Abstract Syntax Tree (AST) changes before and after the vulnerability disappears not only accurately identifies the vulnerability remediation process but also extracts high-dimensional semantic features, enabling structured and vectorized modeling of code remediation behavior. Furthermore, by constructing a vector database supporting similarity matching, historical remediation instances can be efficiently stored and retrieved, providing data support for the rapid location and automated remediation of new vulnerabilities. Combining static vulnerability scanning results with historical data from the version control system and utilizing a large language model for semantic modeling, a high-quality code remediation knowledge base is constructed, significantly improving the intelligence level of vulnerability remediation and meeting the current urgent need for efficient and automated vulnerability remediation in software development.

[0124] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0125] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for constructing a code repair knowledge base, characterized in that, include: Using multiple vulnerability scanning tools, static vulnerability scanning is performed on the code recorded in the version management tool, recording each vulnerability and the corresponding vulnerability information, wherein the vulnerability information includes the vulnerability location and vulnerability type; The commit records of the vulnerability location are obtained in chronological order. The commit records are used to detect whether the vulnerability disappeared after the commit. If the vulnerability disappears, the commit information, code differences and abstract syntax tree changes of the version management tool are recorded from the existence of the vulnerability to the disappearance of the vulnerability. The commit information includes the commit ID and commit comments of the version management tool. Extract vector features from the submission information, the code differences, and the abstract syntax tree changes respectively, and generate vectorized feature information from the vector features; A vector database is constructed using the vectorized feature information, and a code repair knowledge base is constructed using the vector database.

2. The method for constructing a code repair knowledge base as described in claim 1, characterized in that, Using various vulnerability scanning tools, static vulnerability scanning was performed on the code recorded in the version control tool, recording each vulnerability and its corresponding vulnerability information, including: Using multiple vulnerability scanning tools, static vulnerability scans were performed on the code recorded in the version management tool, generating multiple vulnerability scan results. Convert the vulnerability scan results into a vulnerability scan report in a unified format; Vulnerabilities with the same vulnerability location and vulnerability type are considered as the same vulnerability. Based on the vulnerability scanning reports generated by multiple vulnerability scanning tools, it is determined whether the vulnerabilities in multiple vulnerability scanning reports are the same vulnerability. If it is the same vulnerability, the vulnerability location and the vulnerability type are saved as vulnerability information.

3. The method for constructing a code repair knowledge base as described in claim 2, characterized in that, The vulnerability scanning tools are at least three different types, each with different scanning principles, vulnerability coverage characteristics, and language framework support.

4. The method for constructing a code repair knowledge base as described in claim 1, characterized in that, The commit records for the vulnerability location are retrieved in chronological order. The commit records are used to check whether the vulnerability disappeared after the commit. If the vulnerability disappears, the commit information, code differences, and abstract syntax tree changes from the vulnerability's existence to its disappearance, as recorded by the version management tool, are included: The commit records are sorted in chronological order from oldest to newest, and all commit records after the initial commit node where the vulnerability first appeared are scanned. The vulnerability status of each submission record is checked sequentially from oldest to newest. When the vulnerability status at the same vulnerability location changes from "vulnerable" to "vulnerable", it is determined that the vulnerability has disappeared. If the vulnerability disappears, record the commit information of the version management tool at the time the vulnerability disappears, obtain the code and abstract syntax tree before and after the vulnerability disappears, compare them and generate code differences and abstract syntax tree changes.

5. The method for constructing a code repair knowledge base as described in claim 1, characterized in that, Extract vector features from the submission information, the code differences, and the abstract syntax tree changes, respectively, and generate vectorized feature information from these vector features, including: Using a pre-trained large language model, extract the vector features of the submitted information to generate the submitted information vector features. Extract the vector features of the code differences to generate code difference vector features; Extract the vector features of the abstract syntax tree changes to generate the abstract syntax tree change vector features; By using a feature fusion method based on vector addition, the submission information vector features, the code difference vector features, and the abstract syntax tree change vector features are fused to generate vectorized feature information.

6. The method for constructing a code repair knowledge base as described in claim 1, characterized in that, Constructing a vector database using the vectorized feature information includes: Use the vectorized feature information as an index key to obtain the submission information corresponding to the index key; Based on the submission ID in the submission information, obtain the code before and after the vulnerability fix; The code segment before and after repair are used as keys, and the index key and the key value are stored in a vector database.

7. The method for constructing a code repair knowledge base as described in any one of claims 1 to 6, characterized in that, Also includes: The code repair suggestions obtained from the code repair knowledge base include: Convert the semantic features of the code to be repaired into vector features; The code repair knowledge base is searched for similar repair cases using a vector similarity matching algorithm, and repair suggestions are generated based on the similar repair cases.

8. An apparatus for constructing a code repair knowledge base, characterized in that, include: The vulnerability scanning module is used to perform static vulnerability scanning on the code recorded in the version management tool using various vulnerability scanning tools, and to record each vulnerability and the vulnerability information corresponding to the vulnerability, wherein the vulnerability information includes the vulnerability location and vulnerability type; The information extraction module is used to obtain the commit records of the vulnerability location in chronological order, and to detect whether the vulnerability disappeared after the commit through the commit records. If the vulnerability disappears, the module records the commit information, code differences and abstract syntax tree changes of the version management tool from the existence of the vulnerability to its disappearance. The commit information includes the commit ID and commit notes of the version management tool. The feature vectorization module is used to extract vector features from the submission information, the code differences, and the abstract syntax tree changes, and generate vectorized feature information through the vector features. The knowledge base construction module is used to construct a vector database using the vectorized feature information, and to construct a code repair knowledge base using the vector database.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for constructing the code repair knowledge base as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method for constructing the code repair knowledge base according to any one of claims 1 to 7.

Images