Programming review method and system based on multi-modal data

Abstract

The invention relates to a programming review method and system based on multi-modal data. The method comprises the following steps that source code fragments are collected, character format matching is carried out, consistent items are output, and initial node mapping is generated; extracting a pointer reference and calling sequence, carrying out node association recombination, screening node levels, carrying out semantic mark matching, summarizing a connection path, checking a code security scanning index, and generating a dynamic semantic structure; carrying out stack-up matching to compare pixel distribution and label similarity, scanning edge coordinates, checking label corresponding positions and visible area distribution, judging feature co-occurrence, and generating multi-modal associated features; and performing program logic checking, analyzing a variable initialization sequence, generating a checking element set, comparing code security scanning indexes, generating security scanning information, judging a risk identification level and generating a review instruction list. Compared with the prior art, the information utilization rate and the correlation analysis depth in the code review process can be improved, and the accuracy of program defect and risk discovery is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of programming review, and in particular to a programming review method and system based on multi-modal data. BACKGROUND

[0002] The technical field of programming review mainly involves technical methods for systematically reviewing, analyzing and evaluating software code, aiming to find and solve defects, security vulnerabilities or non-compliance issues in the programming and coding process. Through the combination of automated tools or manual inspection, it helps developers to identify and correct errors in the code in a timely manner, improving the security, reliability and maintainability of software.

[0003] CN117648931A discloses a code review method, device, electronic equipment and medium, the method comprising: performing semantic extraction on multi-modal data of the code to be reviewed to obtain a target semantic vector corresponding to the code to be reviewed; inputting the target semantic vector and the code to be reviewed into a code review model to obtain a target review result corresponding to the code to be reviewed, the code review model being trained by a defect code set on a preset language model and being optimized by a human feedback mechanism. This method directly obtains the target review result corresponding to the code to be reviewed by inputting the target semantic vector and the code to be reviewed into the code review model, realizes automatic review of defects in the code, and improves the application scope of code review. Although this method obtains multi-modal information, it only performs semantic extraction on multi-modal information to obtain a target semantic vector, and the utilization of code itself meta information, semantic association and multi-modal information is insufficient, which leads to the neglect of potential risks in the code review process and the over-reliance of the review result on artificial experience and subjective judgment. In actual operation, the semantic association between the review contents cannot be effectively constructed and dynamically updated, and there is a lack of correlation analysis between the code meta information extraction and the code logic, resulting in an information silo effect in the review process; the review mode lacks analysis and fusion means for unstructured information or cross-modal data, which causes a large amount of valuable review clues to be unrecognized or wrongly determined. For example, when there is a conflict between the code comment content and the actual program logic, a single-dimensional static review method cannot timely identify such implicit risks, thereby reducing the review accuracy, increasing the program security risks and affecting the reliability and stability of the software. SUMMARY

[0004] The purpose of the present application is to provide a programming review method and system based on multi-modal data, which fully utilizes code itself meta information, semantic association and multi-modal information to improve the accuracy of code review.

[0005] The purpose of the present application can be achieved by the following technical solutions:

[0006] A programming review method based on multi-modal data, comprising the following steps:

[0007] Collecting source code fragments, extracting meta-information including entry declaration, variable list and comment text record, recording version number, submitter identification and submission date, performing character format matching, classifying the matched meta-information according to submitter identification and submission date, outputting consistency items, and generating an initial node mapping;

[0008] Based on the initial node mapping, extracting pointer references and calling sequences, performing node association reorganization, combining a preset incremental update parameter set and a node relationship table, filtering node levels, performing semantic label matching on each filtered node, inducing connection paths, outputting connectable relationships between nodes, and verifying code security scanning indicators in the connection paths, generating a dynamic semantic structure based on the connectable relationships between nodes and the verification results;

[0009] Based on the dynamic semantic structure, parse semantic label groups and measure text corresponding range, perform layer matching to compare pixel distribution and label similarity, generate layer matching items, based on the layer matching items, load image content labels and text description items, and scan edge coordinates, check label corresponding position and visible area distribution, generate multi-modal load information, based on the multi-modal load information, compare the same elements in the image content labels and the text description items, determine feature co-occurrence and mark the corresponding position, and generate multi-modal associated features;

[0010] Based on the multi-modal associated features, perform program logic checking, analyze variable initialization order, generate a set of checking elements, compare code security scanning indicators, retrieve memory management markers and permission call records, generate security scanning information, determine risk identification level based on security scanning information, and generate a review instruction list.

[0011] The initial node mapping is generated in particular as follows:

[0012] A feedforward neural network is constructed to extract node names, version order relationship, and mapping relationship between submitter identification and submission date, input data includes submitter identification, submission date and version number, output data is a two-dimensional vector for identifying node level label and corresponding mapping index, entries with the same node position and submitter identification are classified into the same level and the mapping index is merged, and the initial node mapping is generated.

[0013] The node association reorganization is performed in particular as follows:

[0014] Based on the initial node mapping, read the pointer information in each node entry and refer to the previously prepared pointer reference table, and perform a literal comparison of the node names one by one to confirm their matching relationship in the pointer reference table. Based on the upper and lower limits of the number of nodes, determine whether the number of occurrences of the same name exceeds the preset number to confirm whether the name is reused or spelled similarly. Define a pointer offset threshold. If the difference between the starting address of a certain pointer and the starting address of the corresponding called function is greater than the pointer offset threshold, record the pointer information for subsequent matching to exclude potential conflicts and count the frequency of occurrence.

[0015] After traversing all nodes and recording the corresponding pointer matching state, sort the call chain according to the order of the node name sequence. If the order is chaotic and exceeds the threshold, mark the part of the nodes as to be rearranged. Recheck the actual function call sequence through the pointer reference table and generate a new sequence number mapping. Assemble the adjusted node sequence number into a call order list to obtain the associated reorganized items.

[0016] The screening node hierarchy is specifically:

[0017] Set a starting address difference threshold. Based on the node association reorganization result, determine whether the pointer address difference of a certain node in two consecutive versions is less than the starting address difference threshold. If so, determine that the node is prone to conflict and mark it in the node relationship table. For nodes with conflict marks, compare whether there are repeated or interval too short merging operations across versions according to the incremental update parameter set. If the number of operations exceeds the preset number on a single node, mark the node as a conflict node.

[0018] Perform the above steps on all nodes to screen conflict nodes, retain available node hierarchies, and summarize conflict nodes to form a screening node set.

[0019] The generated dynamic semantic structure is specifically:

[0020] Obtain a previously prepared semantic label reference table, which includes the function label and key attributes of the node. Match the sequence number of each node in the screening node set with the index value in the semantic label reference table, and calculate the label feature similarity for testing. Complete label matching. Form a connection path according to the call order and dependency relationship of the nodes that match the semantic label, output the connectable relationship between nodes, and perform code security scanning index testing on the connection path. If the code or attribute in the connection path triggers the code security scanning index, mark the security scanning result in the connection path. Summarize the nodes that match the semantic label, the connectable relationship between nodes, and the security scanning result mark to obtain the dynamic semantic structure.

[0021] The generated layered matching item is specifically:

[0022] Based on the dynamic semantic structure, the semantic tag group marked therein is read to obtain a text feature vector, and the text corresponding range is disassembled in the form of character or word group boundary coordinates, the text range coordinates are further mapped to an image coordinate system to obtain an image, the pixel density value is counted, and the image is input into a convolutional neural network to output an image feature vector;

[0023] A label reference table is obtained, and the specific meaning and typical keywords of each label are extracted to form a label vector, the similarity between the text feature vector and the image feature vector and the label vector is calculated respectively; the two similarities calculated are compared for layered matching judgment, and if the similarities exceed the set reference value, it is considered to be matched and recorded in the subsequent process to generate a layered matching item.

[0024] The generated multi-modal load information is specifically:

[0025] According to the image content label and the text description item in the layered matching item, the corresponding key coordinate information is extracted, the basic reference table containing the standard resolution edge coordinates is compared with the top, bottom, left and right four corner points of the key coordinate information, and whether the visible pixel rate of the region determined by the corner points is less than the visible region threshold is judged, if yes, it is considered that there is an occlusion or edge cutting, and the region is segmented; for each region, the preset neighborhood range is searched in the horizontal direction and the vertical direction according to the label content, if a complete labeled boundary is matched in the neighborhood range, it is confirmed that the label and the text description item position are consistent, the matched coordinate information and the image feature vector are associated, and are summarized into the same mapping table, and the mapping table is combined as multi-modal load information.

[0026] The generated multi-modal association feature is specifically:

[0027] Based on the multi-modal load information, the specific element names mentioned in the image content label and the text description item are compared piece by piece, if the same key terms are found in both, it is determined that there may be feature co-occurrence, and then the pixel distribution of the same region is confirmed according to the coordinate index recorded in the mapping table, if the pixel distribution exceeds the overlap threshold, it is determined that there is feature co-occurrence, and the pixel position of the element is marked, and the multi-modal association feature is obtained.

[0028] The method further comprises:

[0029] Based on the review instruction list, task scheduling analysis is performed, the queue length is counted, and an asynchronous loading trigger signal is called, the review priority is superimposed and compared, the merged queue is output according to the operation time interval and batch synchronization rule, and the synchronous processing package is generated;

[0030] Based on the synchronization processing package, integrated comparison is carried out, review matching reference relationship is extracted, and the number of labels is counted, the execution link identifier and the safety inspection parameter are associated, the comprehensive list is output, the version retrieval record is connected, and the comprehensive review data is generated.

[0031] A programming review system based on multi-modal data is used to implement the method, comprising:

[0032] The corpus extraction module collects source code fragments, extracts meta-information including entry declaration, variable list and comment text record, records version number, submitter identifier and submission date, performs character format matching, classifies the matched meta-information according to submitter identifier and submission date, outputs consistency items, and generates initial node mapping.

[0033] The dynamic construction module extracts pointer reference and call sequence based on the initial node mapping, recombines node association, filters node hierarchy by combining a preset incremental update parameter set and a node relationship table, performs semantic label matching on each filtered node, induces connection paths, outputs connectable relationships between nodes, and verifies code safety scanning indicators in the connection paths, generates a dynamic semantic structure based on the connectable relationships between nodes and the verification results.

[0034] The multi-modal analysis module analyzes semantic label groups and measures text corresponding ranges based on the dynamic semantic structure, performs layer-by-layer matching to compare pixel distribution and label similarity, generates layer-by-layer matching items, loads image content labels and text description items based on the layer-by-layer matching items, scans edge coordinates, checks label corresponding positions and visible area distribution, generates multi-modal loading information, compares the same elements in the image content labels and the text description items based on the multi-modal loading information, determines feature co-occurrence and marks the corresponding positions, and generates multi-modal associated features.

[0035] The review generation module performs program logic checking based on the multi-modal associated features, analyzes variable initialization sequence, generates a set of checking elements, compares code safety scanning indicators, retrieves memory management markers and permission call records, generates safety scanning information, determines risk identification level based on the safety scanning information, and generates a review instruction list.

[0036] Compared with the prior art, the present application has the following beneficial effects:

[0037] (1) The prior art is relatively simple in processing code metadata information, only local extraction and viewing, leading to scattered information and poor correlation. The present application collects various metadata information of source code fragments, such as entry declaration, variable list and comment text record, and records key information such as version number, submitter identification and submission date in detail, and then performs character format matching and classification to generate an initial node mapping. This comprehensive and organized metadata processing method enables the establishment of a more complete and detailed initial information architecture from the metadata level during code review, laying a good foundation for subsequent in-depth review and effectively avoiding review vulnerabilities caused by scattered metadata.

[0038] (2) In the prior art, semantic association is often difficult to maintain dynamically, which can easily cause information to be outdated or missed. Based on the initial node mapping, the present application extracts pointer references and call sequences, combines incremental update parameter sets and node relationship tables, filters node levels, performs semantic label matching, and induces connection paths to build a dynamic semantic structure, achieving high-precision semantic association between nodes. This can reflect the evolution of code logic over time and modifications in real time, capture newly added or changed semantic associations in a timely manner, enable the review process to be based on the latest and most accurate semantic association information at all times, reduce review biases caused by outdated semantic associations, and improve the timeliness and accuracy of the review.

[0039] (3) In the prior art, there is a lack of effective semantic association construction and dynamic updating between different review contents, leading to information silos. The present application organically connects various isolated review contents through metadata classification and dynamic semantic association construction, enabling code review to be performed from a more macro and systematic perspective, allowing for a more comprehensive understanding of the logical dependency relationships between different parts of the code, thereby discovering potential cross-module and cross-level issues and avoiding review blind spots caused by information silos, thereby improving review quality.

[0040] (4) The prior art has limited processing capabilities for unstructured information and cross-modal data. The present application introduces multi-modal analysis methods and further uses semantic layering matching methods based on dynamic semantic structures, combines pixel distribution and label similarity, integrates image content labels and text description items, and forms more complete and fine-grained multi-modal association features. This series of operations can fully exploit and integrate various modal information involved in the code review process, avoid situations where code comments conflict with actual program logic but cannot be identified, effectively utilize multi-modal clues to improve review accuracy, and reduce security risks.

[0041] (5)The application can reduce the dependence on manual experience and subjective judgment by program logic checking and variable initialization sequence analysis, simultaneously enabling code security scanning indicators, memory management markers and permission call records to determine risk identification levels, outputting review instruction lists, improving information utilization and correlation analysis depth in the code review process through systematic multi-modal data processing, semantic association construction and dynamic updating, and deep mining of meta-information, so that code review can be based on more comprehensive, objective and accurate information, thereby enhancing the accuracy of program defect and risk discovery, making programming review more automated and intelligent, reducing review blind spots and false negatives caused by manual intervention, and improving review efficiency and program quality control level. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 A flowchart of the method of the application. DETAILED DESCRIPTION

[0043] The application will be described in detail below in conjunction with the drawings and specific embodiments. The embodiments are implemented on the premise of the technical solution of the application, and detailed implementation methods and specific operation processes are given, but the protection scope of the application is not limited to the following embodiments.

[0044] Embodiment 1

[0045] The embodiment provides a programming review method based on multi-modal data, as shown in Figure 1 , including the following steps:

[0046] S1, corpus extraction

[0047] S11, analyze version number and submission quantity, compare timestamps, collect source code fragments, extract meta-information including entry declaration, variable list and comment text record, record version number, submitter identification and submission date, and generate node collection data.

[0048] Specifically, based on the version number list and the corresponding submission quantity information read in advance, the time stamp content associated with each record is compared, one record is selected as a reference standard and parsed into multiple fields, including version number, submitter identification and corresponding date label. In order to determine whether the submission frequency is within an acceptable range, a time difference threshold based on empirical statistics is set, which is 12 hours in this embodiment. The difference in date labels between adjacent records is calculated and compared with the threshold. If the difference is more than 12 hours, it is determined that the submission is cross-day and the record needs to be further checked. If the difference is within 12 hours, it is classified as an intra-day submission and processed. In order to further improve the analysis process of the version number, a simplified identification function can be used to obtain the integer part and round the decimal part, where represents the upward rounding operation, if the version number is incremented by more than 1 in the adjacent record, it indicates that the version may belong to a major iteration, each record in the above operation is processed in sequence, and additional comparison of time zone information is required when splitting the date label, for example, if the time zone parameter is set to UTC+8, the timestamp of the comparison item needs to be converted to a unified UTC reference for difference calculation to ensure effective alignment of the time node. In this way, multiple key points that need to be counted later are marked in all records and related information is accumulated and merged, and finally the node collection data is obtained.

[0049] S12, based on the node collection data, the submitter identifier and the submission date in the record are screened and character format comparison is performed to distinguish repeated items and new items, and consistent items are output to generate matching item information.

[0050] After obtaining the node collection data, the submitter identifier and the submission date contained in each record are further investigated. In order to distinguish repeated items and new items, the submitter identifier needs to be checked for consistency first, and a string comparison method is set where δ represents the character-by-character comparison function, m represents the number of characters, s1 and s2 are the strings to be compared, and s 1k 2k represents the kth character in the string, and when the corresponding position characters are the same, 0 is taken, otherwise 1 is taken. If the sum exceeds 3, it is judged that the two are inconsistent. The threshold value 3 is set according to the experience of common naming differences, and can be modified according to the coding specifications of the enterprise. In order to determine whether the record of the submission date appears the same item, the date label and the submitter identifier can be combined into a key-value pair for comparison. If there is the same date under the same key-value pair and the version number is similar, it is judged as a repeated item, otherwise it is included in the new item statistics. At the same time, a fixed date range is referred to, for example, the 1st to 30th of the current month is set as the valid range, if the date in the record is earlier than the 1st or later than the 30th, it is judged as an invalid record and excluded. The above comparison process can be adjusted according to the actual project size, if the daily submission volume is usually around 50, the submission of more than 100 on a certain day can be regarded as an exception and marked out. After accumulating these consistent items one by one, they are summarized to finally generate matching item information.

[0051] S13, based on the matching item information, the node position and the submitter identifier in the comparison item are compared, the node level that can be attributed is summarized and the mapping index is merged to generate the initial node mapping.

[0052] ​After obtaining the aforementioned matching entry information, in order to compare the node position and submitter identifier and summarize the attributable node level, a feedforward neural network including three layers of hidden layers is constructed, each layer is set to 128 neurons for extracting node name, version ascending relationship and mapping relationship of submitter and date, input data includes the submitter identifier, submission date and version number obtained in the foregoing, and output data is a two-dimensional vector for identifying node level label and corresponding mapping index. The training process of the feedforward neural network adopts a standard back propagation algorithm, first initializes the network weight matrix ω = {ω ij} and sets the initial value range to between -0.05 and 0.05, takes 2000 historical submission records as a training set and constructs a labeled label for each record, iteratively calculates the loss function L = ∑(y pred -y true ) 2 , wherein y pred represents the predicted value, y true represents the true value, and reversely adjusts the weights ω ij and bias items b i of each layer, and stops iteration when the training round reaches 500 times and the loss is less than 0.001. 0.001 here is a convergence threshold determined in combination with previous test experience. In order to illustrate the source of the threshold, 5 times of random initialization training can be performed in the early stage and the average convergence speed is calculated. If the average loss can only be reduced to about 0.005 after 300 iterations, the learning rate can be appropriately reduced and the number of iterations can be increased until it reaches about 0.001. In the reasoning process, the new input data is sent into the feedforward network layer by layer to calculate the activation value, and the node level label is obtained in the output layer. Finally, according to the node level label, the entries with the same node position and submitter identifier are classified into the same level and the mapping index is merged, and the initial node mapping is generated.

[0053] S2, dynamically constructing

[0054] S21, based on the initial node mapping, retrieving the pointer reference, and matching the node name and the number of nodes, performing associated restructuring, obtaining the call sequence, and generating the associated restructuring entry.

[0055] Based on the initial node mapping obtained in the foregoing, the pointer information in each node entry is first read and compared with a previously prepared pointer reference table, which is composed of several typical address ranges and function call positions and is obtained by statistical analysis of historical code in the project. Then, literal comparison is performed on the node names one by one to confirm their matching relationship in the pointer reference table. Based on the upper and lower limits of the number of nodes, it is determined whether the same name appears more than three times, and if so, it is additionally determined whether the name is reused or approximately spelled. In this process, a pointer offset threshold is also defined, which is set to 128 bytes in this embodiment, to determine whether cross-domain access is reasonable. The threshold is an average value calculated from observation of the memory usage rules of several example projects. For example, if the difference between the starting address of a pointer and the starting address of the corresponding called function is greater than 128 bytes, it is considered to be out of the safe range and the pointer information is temporarily recorded for subsequent matching to exclude potential conflicts and count the frequency of occurrence. After traversing all nodes and recording the corresponding pointer matching state, the call chain is sorted according to the sequence of the node name serial numbers. If the order is mixed and the threshold is crossed, the part of the nodes is marked as to be rearranged, the actual function call sequence is rechecked through the pointer reference table, and a new serial number mapping is generated. Finally, the corrected node serial numbers are assembled into a call order list, and the associated reorganized item is obtained.

[0056] S22, based on the associated reorganized item, combining the preset incremental update parameter set and the node relationship table, locating the pointer conflict point, screening the available node level, and generating a screened node set.

[0057] After the acquisition of the associated reorganization items is completed, the change amplitude information of each node between different versions is extracted from the established incremental update parameter set and node relationship table, wherein the incremental update parameter set contains several numerical parameters, such as the number of added and deleted lines of code, and is calculated based on the average change trend of each branch version in multiple iterations of the actual project. In order to locate the possible pointer conflict points, it is necessary to first confirm whether the pointer reference addresses of the same node between different versions are reused or the adjacent distance is too small. For example, set a starting address difference threshold, which is 64 bytes in this embodiment, which is obtained by statistically averaging the minimum cross-segment distance of the key functions in the project and supplemented by a 0.1 times floating coefficient, if the pointer address difference of a node in two consecutive versions is less than 64 bytes, it is determined that a conflict is easy to occur, and it is marked in the node relationship table to facilitate subsequent screening. For the nodes with conflict markers, further comparison is made according to the incremental update parameter set to determine whether there is a repeated or short-interval merging operation across versions, if the number of such operations exceeds 2 times on a single node, the node is marked as a conflict node and added to the easy conflict list and further investigation is prepared. After cross comparison of all nodes is completed, the conflict nodes marked in the node list are screened out, the available node hierarchy is retained, and the nodes are aggregated to form a screened node set, and finally the screened node set is obtained.

[0058] S23, based on the screened node set, matching semantic labels and associating node indexes, inducing connection paths, outputting the connectable relationship between nodes, and verifying the code safety scanning indicators in the connection paths, generating a dynamic semantic structure based on the connectable relationship between nodes and the verification results.

[0059] After the screened node set is determined, the semantic labels of each node need to be parsed and checked for matching with the corresponding call order. A semantic label reference table is obtained in advance, which records the function tags and several key attributes of the nodes and can be supplemented by reading the incremental update parameter set in the previous stage. In order to match these tags with the node indexes, the serial number of the node in the screened node set needs to be matched with the index value in the semantic label reference table.

[0060] In the matching process, if it is found that the tags and indexes of a certain node are missing or multiple mapping occurs, a rule needs to be defined for verification, which is realized by label feature similarity in this embodiment. The label feature similarity calculation is Compared with a similarity benchmark of 0.8 selected according to multiple test experiences, if the label feature similarity calculation result exceeds 0.8, it is considered that the matching is established, otherwise the label needs to be manually corrected.

[0061] According to the calling sequence and dependency relationship of the nodes matched with the semantic labels, a connection path is formed, and the connectable relationship between the nodes is output. The code security scanning indicators are compared on the connection path, which include keyword checking and access permission checking, etc. The code security scanning indicators are obtained by counting the common vulnerabilities of existing projects. If there is a sensitive keyword or an abnormal access permission level, a mark is made in the path for subsequent in-depth investigation. Finally, the dynamic semantic structure is obtained by matching the semantic labels of the nodes, the connectable relationship between the nodes, and the security scanning result markers.

[0062] S3, multi-modal analysis

[0063] S31, based on the dynamic semantic structure, the semantic label group is parsed and the text corresponding range is measured, the layer-by-layer matching is performed to compare the pixel distribution and the label similarity, and the layer-by-layer matching item is generated.

[0064] Specifically, based on the dynamic semantic structure, the semantic label group in the dynamic semantic structure is read to obtain a text feature vector, and the text corresponding range is disassembled in the form of character or word group boundary coordinates. A label reference table collected from historical projects is obtained, and the specific meaning and typical keywords of each label are extracted to form a label vector. Then, a similarity matrix is constructed for the text part, and a baseline value of 0.8 is set according to past test experience. The baseline value is obtained by measuring the average similarity from hundreds of actual semantic label and text comparison data and adding 0.05 as a safety redundancy. The similarity score is obtained by comparing the text feature vector and the label vector. When the score reaches or exceeds 0.8, it is determined that the semantics are basically consistent. In order to analyze the pixel distribution synchronously, the text range coordinates obtained above can be further mapped to the image coordinate system, and the pixel density value in the corresponding area is counted. In order to improve the accuracy of the similarity matching, a three-layer convolutional neural network can be used for training. The training samples are composed of 500 images with labels, and the images are converted into grayscale or RGB matrix as input in advance. The size of the convolution kernel is fixed at 3x3 and the step is 1. The first layer contains 32 convolution kernels, the second layer contains 64 convolution kernels, and the third layer contains 128 convolution kernels. The output layer generates an image feature vector in a fully connected form. The cosine similarity between the image feature vector and the label vector is calculated as where p i and q i represent the components of the image feature vector and the label vector respectively. By minimizing ∑(S-Y) 2The loss function is back-propagated iteratively, where Y is the true value, and the training is stopped when the training round reaches about 300 times and the loss is lower than 0.01, which is determined by preliminary experiments to compare the risk of overfitting. When a new sample is input into the network, the similarity of the image and the label in the feature vector space is obtained, and the above-mentioned text similarity is used for layer-by-layer matching judgment. If the result exceeds the set reference value, it is considered to be matched, and is recorded in the subsequent process, and finally the layer-by-layer matching item is generated.

[0065] S32, based on the layer-by-layer matching item, load the image content label and the text description item, and scan the edge coordinates to check the corresponding position of the label and the visible area distribution to generate multi-modal load information.

[0066] After obtaining the layer-by-layer matching item, the corresponding key coordinate information is extracted according to the explicit image content label and the text description item, and then a standard resolution edge coordinate reference table is used to compare the recorded top, bottom, left and right corner points to determine the actual range of the visible area. A visible area threshold value of 0.9 is set based on the statistical results of pixel distribution, and the threshold value is derived from the average of the total pixel proportion of the visible area under the rendering view of 50 different size images. If the visible pixel rate of a certain area is lower than the value, it is considered that there is an occlusion or edge cutting situation, and the area needs to be segmented, otherwise, the area is directly regarded as a visible area. Then, according to the label content, the preset neighborhood range is searched in the horizontal and vertical directions, for example, the width direction allows a maximum of 20 pixel deviations, and the height direction allows a maximum of 15 pixel deviations. These ranges come from the alignment deviation calculation of multiple camera devices in real application scenarios. If the complete annotation boundary can be matched within the neighborhood range, it is confirmed that the label and the text description item position are consistent, and the matched coordinate information and pixel density feature value are associated and summarized into the same mapping table. Finally, the mapping table is combined into multi-modal load information.

[0067] S33, based on the multi-modal load information, comparing the same elements in the image content label and the text description item, determining the feature co-occurrence and marking the corresponding position, generating multi-modal associated features.

[0068] After obtaining the multimodal loading information, it is necessary to compare the specific element names mentioned in the image content label and the text description entry one by one. If the two are found to have the same key terms, it is determined that there may be feature co-occurrence. Then, combined with the coordinate index recorded in the mapping table, it is confirmed whether the pixel distribution appearing in the same area exceeds an overlap threshold of 0.75 derived from experimental statistics. This threshold is calculated by averaging the overlap ratios of image labels and text elements in 30 test scenarios. If the overlap reaches or exceeds 0.75, it is considered that the element is clearly indicated in both the image and the text, and the pixel location of the element is marked in the subsequent steps. To further improve the accuracy of feature co-occurrence judgment, a support vector machine can be introduced for auxiliary classification. The training samples of the support vector machine are compared with the existing multimodal loading information and manually segmented and annotated data. 200 positive samples that meet high similarity and 200 negative samples that do not match are selected. In the feature space, the kernel function κ(u,v)=exp(-γ||uv|| 2 ) measures the sample distance, where u and v are the two samples to be calculated for similarity, γ is the parameter for adjusting the width of the kernel function, and the setting of the penalty parameter C makes the classification result closer to the actual scene. If the classification confidence is higher than 80%, it is used as the basis for confirming the co-occurrence and the final position is recorded in the mapping table. After the above process, the multimodal correlation feature is obtained.

[0069] S4, Review Generation

[0070] S41, based on multimodal association features, scans the program logic structure and process entry, checks the call sequence and abnormal branches, parses the variable initialization sequence, and generates a check feature set.

[0071] Specifically, based on the multimodal association feature, first read the call sequence and the connectable relationship between nodes contained in the dynamic semantic deconstruction, locate the process entry, and compare each logical branch with the function call sequence. Set a concurrency threshold based on actual engineering experience. In this embodiment, it is set to 3 call chains. If there are more than 3 call chains at the same time and their starting timestamps are within 50 milliseconds of each other, it is marked as a high concurrency state. At the same time, the variable initialization order is checked separately and the first assignment position of each variable in the code segment is recorded, and a variable reference verification function is defined. Used to count the citation density of variable i, where n is the citation check range, and δ is the number of times variable i is cited by the kth citation source or position. ik1, otherwise, it is 0, and compared with a baseline value 1.5 calculated from historical data, if the reference density of a variable is greater than 1.5, it means that it may be called repeatedly in multiple places, and additional attention should be paid to the initialization of the variable in the abnormal branch. Then all the abnormal branches at the entry of the flow are summarized and it is confirmed whether they exist with the normal calling flow. For example, if a piece of logic is called twice within 10 milliseconds, but skips the necessary initialization steps in between, it is determined that there is an abnormal jump, and such abnormal information is included in a temporary list for further comparison. After the above steps, all the integrated call relationship, variable initialization record and abnormal branch identification are summarized to generate the verification element set.

[0072] S42, based on the verification element set, comparing the code security scanning indicators, retrieving the memory management markers and permission call records, and generating security scanning information.

[0073] Based on the verification element set, first read the branch entries marked as abnormal jump or high concurrency state and enable the previously prepared code security scanning indicators, which include specific items such as sensitive function call list and memory access permission list, and match them one by one in the form of string hash comparison. If it is found that a branch refers to a function name in the list and contains more than 8KB of dynamic memory allocation behavior, it will be marked as suspicious memory reference and recorded separately. When comparing these suspicious records with the permission call records, attention should be paid to whether the access level information exceeds the upper limit value defined in the table. For example, set an access level threshold of 5, which is determined by comprehensive evaluation after statistical analysis of the kernel call range of the operating system. If the level of a call is greater than 5, it means that there is an illegal access request, and after scanning all abnormal jump branches, the above suspicious memory references and illegal access information are summarized into a to-be-processed list, which is automatically classified by a trained deep learning classifier. The structure of the classifier includes a bidirectional long short-term memory network and an attention layer, which is used to identify the association between the context and the calling intention of the code segment. First, collect 10,000 historical normal calls and 10,000 abnormal calls as training samples and divide each code segment into several vector sequences, then input them into the bidirectional long short-term memory network to extract sequence features, and then calculate the weighted score a i i j i i i , where e true is the feature value and a pred is the attention score. During training, a self-defined cross-entropy loss function L = -∑[y true ​​​​​)ln(1-y pred )] and stop training after the loss drops below 0.02 after about 500 iterations. After inputting new suspicious records, the classification confidence can be obtained and entries with a confidence higher than 85% are listed as key risk items. Finally, the key risk items are combined with suspicious memory references and trans-level authority information to generate security scanning information.

[0074] S43, based on the security scanning information, abnormality identification is summarized and risk identification level is determined, and an audit instruction list is generated.

[0075] Based on the security scanning information, the records marked as key risk items are first retrieved and each record is assigned a unique abnormality identification number. Then, the severity of the abnormality identification is compared according to the risk grading rules established in advance. The risk grading rules are obtained by weighting the severity and damage range of a large number of historical vulnerability events, and a kernel density estimation method is used to determine the boundary point. The specific calculation process can define the kernel function and the damage range of the abnormality identification is determined as x. If the risk score obtained by kernel density estimation is greater than 0.7, it is classified into the high-risk level, otherwise if the risk score is less than 0.4, it is classified into the low-risk level, and the intermediate interval is the medium-risk level. After the grading and determination of all key risk items, the records under different risk levels are summarized and the final audit instruction list is generated.

[0076] S5, data synchronization

[0077] S51, based on the audit instruction list, read the task number and associated execution time and split the queue, count the queue length and call the asynchronous loading trigger signal, and generate a scheduling analysis result.

[0078] Specifically, based on the audit instruction list, the task entries recorded therein are first read and the identification number of each task and the corresponding estimated execution time are extracted. This part of information is split into several sub-queues and the length of all sub-queues is counted. In order to enable the system to still handle smoothly in a high load scenario, a queue length threshold of 100 is defined in advance. The specific value is selected by the enterprise from the statistical data of multiple batch processing as the peak load average of 90 plus a 10% margin. If the length of a sub-queue exceeds 100, an additional sub-queue splitting process is triggered to split it into smaller units for subsequent arrangement. At the same time, an asynchronous loading trigger signal is set to take into account the need for multi-task synchronous processing. This signal will be determined according to the system resource usage after the sub-queue splitting is completed, for example, when the CPU occupancy rate is within the pre-established effective range (0% to 80%) and the memory occupancy rate is within the range of 0GB to 4GB, it is considered that the resources are available, otherwise if the load of CPU or memory exceeds the range, the loading of part of the queue is suspended and the status is recorded. After the above operations, all split sub-queues and trigger signal states are summarized to generate a scheduling analysis result.

[0079] S52, based on the scheduling analysis results, identify the review priority and retrieve the high-priority sequence, compare the remaining sequences to divide and merge the order, and generate the priority comparison item.

[0080] After obtaining the scheduling analysis results, the queue information is read one by one and the review priority of each queue is retrieved. The priority is defined in a classification table and represented by an integer value. The larger the value, the more urgent or dependent the review. The classification table is developed based on the emergency distribution of review tasks in the past years of the enterprise and the median is set to 2. If the priority of a queue entry is greater than 2, it is classified as high priority, otherwise it is considered as regular priority. Then, all entries marked as high priority are summarized to form a high-priority sequence, which is compared with the remaining lower-priority sequences to distinguish between the parts that need to be merged and the parts that can be delayed. For example, if a high-priority entry appears more than 5 times in adjacent time periods, it is considered to be executed immediately in the first period. If a low-priority entry appears more than 10 times in the same time period in multiple queues, it is moved to a later period and attached to an idle period. The threshold values of 5 and 10 are determined based on the statistics of queue execution in the past projects. The value of 5 is the average upper limit of urgent events plus one margin, and the value of 10 is the median of the frequency of ordinary events plus two margins. After this comparison process, the priority comparison item is generated.

[0081] S53, based on the priority comparison item, cross-merge the queues according to the operation period interval and batch synchronization rule, distribute the summary information to the unified channel, and generate the synchronization processing package.

[0082] After generating the priority comparison item, further cross-merge processing is needed according to the operation period interval and batch synchronization rule. The operation period interval refers to the time block reserved in a fixed period to start task execution or insert an idle segment. The size of the time block is usually set to 30 minutes and determined by the project management team after statistical analysis of daily task peak distribution. If the number of a batch of queues exceeds the previously set reference value of 50, batch synchronization rule needs to be started for batch merging. The value of 50 is derived from the common online scale of single batch tasks plus a small amount of redundancy. The specific merging method is to mix high-priority entries with part of low-priority entries in the same period in a ratio of 1 to 2 to avoid long waiting or blocking. At the same time, all merged queue information is summarized in a unified channel for direct retrieval in subsequent execution periods. Finally, the corresponding merge sequence number and time period information of each queue are recorded in the channel to form a complete synchronization processing package.

[0083] S6, result output

[0084] S61, based on the synchronization processing package, checking the review instruction list and matching reference relationship, counting the number of labels and comparing the differences of the merged information, and generating integrated comparison items.

[0085] Specifically, based on the previously obtained synchronization processing package, all items about the review instruction list are extracted and compared with a previously prepared reference material. The reference material lists the index number and key identification information corresponding to the review instruction, and also includes matching rules for judging possible repeated references or missing references. When reading each instruction and matching it with the reference material, it is necessary to first check whether the index number is consistent and whether the key identification information is consistent with the same line item. If the same number but different key identification information is found, it is considered as an abnormal reference and temporarily summarized in an abnormal list to be cleared. To confirm whether the label is missing during the merging process, an experienced threshold of 5 labels is set by comparing the number of labels recorded in the synchronization processing package. For example, if a review instruction originally contains 5 label information but only 4 or less after merging, it is marked as missing label information. If such cases occur repeatedly, further splitting inspection is required for this item. After completion of the inspection, the information difference rate before and after merging is calculated. The difference rate can be defined as Compared with a benchmark value of 0.1 obtained from historical review tasks, if the difference rate exceeds 0.1, it indicates that there may be a large default or repetition in the merging process. The value of 0.1 is obtained by averaging the difference rate of nearly 100 instructions, which is about 0.08, and adding 0.02 redundancy. After classifying the items exceeding this value as key objects for checking, all information difference checking results are finally summarized. Finally, the normal matching items and the abnormal list to be cleared are merged to form integrated comparison items.

[0086] S62, based on the integrated comparison items, reading and executing the link identification and retrieving the safety inspection parameter record, confirming the processed and unprocessed reference links, and generating associated reference information.

[0087] After obtaining the integrated comparison entries, the execution link identifier of each entry is read and checked whether there is a corresponding data line in the previously recorded security check parameters. These security check parameters contain a number of numerical values or identification descriptions of potential risk characteristics, which are gradually summarized in multiple historical documents and actual code review scenarios. In order to determine which reference links have been processed and which have not been processed, the mapping relationship between the execution link identifier and the security check parameter needs to be retrieved. If both appear under the same identifier number and the risk characteristic value does not exceed the benchmark range defined by the current project, for example, between 0 and 100, it means that the link has been processed, otherwise it is classified as a type to be processed and marked with a special symbol. To make the process more accurate, an allowed difference threshold of 3 can be set, which is obtained by measuring the difference of several hundred link identifier numbers in different time periods, with an average value of 2.5 and rounding up. If the same link identifier and the security check parameter number differ by 3 or less, it is considered the same link, otherwise it is considered not matching or a new link. According to this logic, all entries are traversed and the processed and unprocessed markers are recorded, and the results are cross-referenced with the integrated comparison entries to form the associated reference information.

[0088] S63, based on the associated reference information, outputting a comprehensive list and locating the version retrieval record position, synchronizing the number of labels and archiving the security check parameters, and generating comprehensive review data.

[0089] Based on the associated reference information, the references in each entry that have been clearly marked as processed are classified again and a comprehensive list is output. To ensure that the merged content corresponds correctly to the version retrieval record, all available version identifiers in the project data are first searched and compared with the same number appearing in the comprehensive list. If the numbers match, the version position corresponding to the list entry is marked, and the number of labels is read and synchronized with the label record in the overall process. If there is a loss of more than 2 labels between them, the number of missing labels is recorded in an exception tracking statistics item. The value of this threshold 2 is determined by investigating the label loss rate in the actual use of the project, and if the label loss rate is within 3%, the probability of multiple losses should not exceed 2. The threshold value is determined by the probability of multiple losses. After the check is completed, the security check parameters are associated and archived with all corresponding list entries and their final numbers are recorded. Finally, the processing status of the comprehensive reference is marked in the record and the above information is collected into a comprehensive review data.

[0090] Embodiment 2

[0091] The embodiment provides a programming review system based on multi-modal data, which is used to implement the method of embodiment 1, comprising:

[0092] The corpus extraction module: collects source code fragments, extracts meta-information including entry declaration, variable list and comment text record, records version number, submitter identification and submission date, performs character format matching, classifies the matched meta-information according to submitter identification and submission date, outputs consistency items, and generates initial node mapping;

[0093] The dynamic construction module: based on the initial node mapping, extracts pointer reference and calling sequence, performs node association and reorganization, combines the preset incremental update parameter set and the node relationship table, filters node levels, performs semantic label matching on each filtered node, induces connection paths, outputs connectable relationships between nodes, and verifies code security scanning indicators in the connection paths, generates dynamic semantic structure based on the connectable relationships between nodes and the verification results;

[0094] The multi-modal analysis module: based on the dynamic semantic structure, parses the semantic label group and measures the text corresponding range, performs layer-by-layer matching to compare pixel distribution and label similarity, generates layer-by-layer matching items, based on the layer-by-layer matching items, loads image content labels and text description items, and scans edge coordinates, checks label corresponding position and visible area distribution, generates multi-modal loading information, based on the multi-modal loading information, compares the same elements in the image content labels and the text description items, determines feature co-occurrence and marks the corresponding position, and generates multi-modal associated features;

[0095] The review generation module: based on the multi-modal associated features, performs program logic checking, analyzes variable initialization sequence, generates a set of checking elements, compares code security scanning indicators, retrieves memory management markers and permission call records, generates security scanning information, determines risk identification level based on security scanning information, and generates review instruction list;

[0096] The data synchronization module: based on the review instruction list, performs task scheduling analysis, counts queue length and calls asynchronous loading trigger signal, superimposes review priority for comparison, outputs merged queue according to operation time interval and batch synchronization rules, and generates synchronization processing package.

[0097] The result output module: based on the synchronization processing package, performs integration comparison, extracts review matching reference relationship and counts label quantity, associates execution link identification and security verification parameters, outputs comprehensive list, connects version retrieval record, and generates comprehensive review data.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described modules can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0099] The preferred embodiments of the present application have been described above in detail. It should be understood that modifications and variations to the preferred embodiments could be made by those skilled in the art in light of the teachings above without departing from the spirit of the present application. It is therefore to be understood that what is desired to be protected by letters patent is defined by the scope of the claims below and that on the basis of the teachings of the present application, obvious modifications and equivalents can be adopted by those skilled in the art in their possession of the teachings of the present application without departing from the spirit and scope of the application.

Claims

1. A programming review method based on multimodal data, characterized in that: The following steps are involved: Collect source code snippets, extract meta-information including entry declarations, variable lists, and comment text records, record version numbers, submitter IDs, and submission dates, perform character format matching, classify matched meta-information according to submitter IDs and submission dates, output consistency entries, and generate an initial node map; Based on the initial node mapping, pointer references and call sequences are extracted, node associations are reorganized, and a preset incremental update parameter set and node relationship table are combined to filter node hierarchies. Semantic tag matching is performed on each filtered node, connection paths are summarized, and connectable relationships between nodes are output. At the same time, code security scanning indicators are tested in the connection paths, and a dynamic semantic structure is generated based on the connectable relationships between nodes and the test results. Based on the dynamic semantic structure, the semantic tag group is parsed and the text corresponding range is measured, and stacked matching is performed to compare pixel distribution and tag similarity to generate stacked matching items. Based on the stacked matching items, the image content tag and the text description item are loaded, and the edge coordinates are scanned to check the corresponding position of the tag and the visible area distribution to generate multimodal loading information. Based on the multimodal loading information, the same elements in the image content tag and the text description item are compared, feature co-occurrence is determined, and the corresponding positions are marked to generate multimodal association features. Based on the multimodal association features, program logic verification is performed, variable initialization order is analyzed, a verification element set is generated, code security scanning indicators are compared, memory management tags and permission call records are retrieved, security scanning information is generated, risk identification levels are determined based on the security scanning information, and a review instruction list is generated.

2. A programming review method based on multimodal data according to claim 1, characterized in that: The specific steps of generating the initial node mapping are as follows: A feedforward neural network is constructed to extract the node name, version ascending order, and the mapping relationship between the submitter ID and the submission date. The input data includes the submitter ID, submission date, and version number. The output data is a two-dimensional vector used to identify the node's level label and the corresponding mapping index. Entries with the same node position and the same submitter ID are assigned to the same level and the mapping indexes are merged to generate the initial node mapping.

3. The programming review method based on multimodal data according to claim 1, characterized in that: The node association reorganization is specifically as follows: Based on the initial node mapping, the pointer information for each node entry is read and compared with the previously compiled pointer reference table. The node names are compared literally one by one to confirm their matching relationship in the pointer reference table. Based on the upper and lower limits of the number of nodes, it is determined whether the number of occurrences of the same name exceeds the preset number to confirm whether the name is reused or has similar spellings. A pointer offset threshold is defined. If the difference between the starting address of a pointer and the starting address of the corresponding called function is greater than the pointer offset threshold, the pointer information is recorded for use in subsequent matching to eliminate potential conflicts and count the frequency of occurrence. After traversing all nodes and recording the corresponding pointer matching status, the call chain is sorted according to the order of the node name serial numbers. If the order is chaotic and crosses the threshold, the part of the nodes is marked as to be rearranged. The actual function call timing is rechecked through the pointer reference table and a new serial number mapping is generated. The adjusted node serial numbers are assembled into a call sequence list to obtain the associated reorganization items.

4. The programming review method based on multimodal data according to claim 1, characterized in that: The specific levels of the screening nodes are: A starting address difference threshold is set. Based on the node association reorganization results, it is determined whether the difference in the pointer address of a node in two consecutive versions is less than the starting address difference threshold. If so, the node is determined to be a node prone to conflict and marked as a conflict in the node relationship table. For nodes with conflict marks, the incremental update parameter set is used to compare whether there are repeated merge operations across versions or merge operations with too short intervals. If the cumulative number of operations on a single node exceeds the preset number, the node is marked as a conflict node. The above steps are performed on all nodes to filter out conflicting nodes, retain the available node levels, and aggregate the conflicting nodes to form a filtered node set.

5. The programming review method based on multimodal data according to claim 1, characterized in that: The generation of dynamic semantic structure is specifically as follows: A pre-compiled semantic tag reference table is obtained, which includes the functional labels and key attributes of the nodes. The serial number of each filtered node in the filtered node set is matched with the index value in the semantic tag reference table, and the label feature similarity is calculated for verification to complete the label matching. A connection path is formed according to the calling sequence and dependency relationship of the nodes that match the semantic tags, and the connectable relationship between the nodes is output. The code security scanning indicator is tested on the connection path. If the code or attribute in the connection path triggers the code security scanning indicator, the security scanning result is marked in the connection path. The nodes that match the semantic tags, the connectable relationship between the nodes and the security scanning result marking are summarized to obtain a dynamic semantic structure.

6. The programming review method based on multimodal data according to claim 1, characterized in that: The generation of cascade matching items is specifically as follows: Based on the dynamic semantic structure, the semantic tag group annotated in it is read to obtain the text feature vector, and the corresponding text range is disassembled in the form of character or phrase boundary coordinates. The text range coordinates are further mapped to the image coordinate system to obtain an image, and the pixel density value is calculated. The image is input into the convolutional neural network and the image feature vector is output. Obtain a label reference table and extract the specific meaning and typical keywords of each label to form a label vector. Calculate the similarity between the text feature vector and image feature vector and the label vector respectively. Perform a stacked matching judgment on the two calculated similarities. If the similarities exceed the set benchmark value, they are considered to be matched and recorded in the subsequent process to generate a stacked matching item.

7. The programming review method based on multimodal data according to claim 1, characterized in that: The generating of multimodal loading information is specifically as follows: The corresponding key coordinate information is extracted based on the image content labels and text description entries clearly defined in the stacked matching items, and the four upper, lower, left and right corner points of the key coordinate information are compared using a basic reference table containing standard resolution edge coordinates. Based on the area determined by the corner points, it is determined whether the visible pixel rate of the area is less than the visible area threshold. If so, it is considered that there is occlusion or edge cropping, and the area is segmented. For each area, the preset neighborhood range is searched in the horizontal and vertical directions according to the label content. If a complete annotation boundary is matched within the neighborhood range, it is confirmed that the label here is consistent with the position of the text description entry. The matching coordinate information is associated with the image feature vector, summarized in the same mapping table, and the mapping table is combined into multimodal loading information.

8. The programming review method based on multimodal data according to claim 1, characterized in that: The generation of multimodal association features is specifically as follows: Based on the multimodal loading information, the specific element names mentioned in the image content label and the text description entry are compared one by one. If the two are found to have the same key terms, it is determined that there may be feature co-occurrence. Then, combined with the coordinate index recorded in the mapping table, it is confirmed whether the pixel distribution appearing in the same area exceeds the overlap threshold. If so, it is determined that feature co-occurrence exists, and the pixel position of the element is marked to obtain the multimodal association feature.

9. The programming review method based on multimodal data according to claim 1, characterized in that: The method further comprises: Based on the review instruction list, task scheduling analysis is performed, queue length is counted and asynchronous loading trigger signal is called, review priority is superimposed for comparison, and merged queues are output according to operation period interval and batch synchronization rules to generate synchronization processing packages; Based on the synchronization processing package, an integrated comparison is performed, the review matching reference relationship is extracted and the number of tags is counted, the execution link identification and security inspection parameters are associated, a comprehensive list is output, the version retrieval records are connected, and comprehensive review data is generated.

10. A programming review system based on multimodal data, characterized in that: Used to implement the method according to any one of claims 1 to 9, comprising: Corpus Extraction Module: This module collects source code snippets and extracts metadata, including entry declarations, variable lists, and comment text records. It also records version numbers, submitter IDs, and submission dates. It then performs character format matching, categorizes the matched metadata based on submitter IDs and submission dates, outputs consistent entries, and generates an initial node map. Dynamic construction module: Based on the initial node mapping, it extracts pointer references and call sequences, performs node association reorganization, combines a preset incremental update parameter set and a node relationship table, filters node hierarchies, performs semantic tag matching on each filtered node, summarizes connection paths, outputs connectable relationships between nodes, and simultaneously verifies code security scanning indicators in the connection paths. Based on the connectable relationships between nodes and the verification results, a dynamic semantic structure is generated; Multimodal analysis module: Based on the dynamic semantic structure, the module parses the semantic tag group and measures the text corresponding range, performs stacked matching to compare pixel distribution and tag similarity, generates stacked matching items, loads image content tags and text description items based on the stacked matching items, scans edge coordinates, verifies the corresponding positions of the tags and the distribution of visible areas, generates multimodal loading information, compares the same elements in the image content tags and text description items based on the multimodal loading information, determines feature co-occurrence and marks the corresponding positions, and generates multimodal association features; Review generation module: Based on the multimodal association features, perform program logic verification, analyze variable initialization order, generate a verification element set, compare code security scanning indicators, retrieve memory management tags and permission call records, generate security scanning information, determine the risk identification level based on the security scanning information, and generate a review instruction list.

Images