Code scanning analysis method and system based on large model

Abstract

The application discloses a code scanning analysis method and system based on a large model, and relates to the technical field of large language models and computers.The method comprises the following steps: scanning a first code based on a set of scanning rules, determining a first scanning rule and a second code matched by scanning, filling a first prompt word template corresponding to the first scanning rule with the second code to obtain a first prompt word, the first prompt word template being obtained by processing the first scanning rule through a first large model, and the first prompt word template comprising at least a code analysis task corresponding to the first scanning rule, and performing code analysis on the second code based on the code analysis task in the first prompt word through a second large model to obtain an analysis result of the second code.The prompt word constructed based on the prompt word template generated by the first large model can accurately describe the analysis requirement of the code under the scanning rule, is high in efficiency, can guarantee the quality of the prompt word, and further improves the code analysis capability of the second large model.

Description

Technical Field

[0001] This disclosure relates to the fields of large language models and computer technology, and more specifically, to a code scanning and analysis method and system based on large models. Background Technology

[0002] Static Application Security Testing (SAST) engines are a key technology for analyzing source code to discover potential security vulnerabilities without executing the program. With the development of Large Language Model (LLM) technology, after scanning code using SAST engines and fixed rules, the potential problems found and their corresponding code are submitted to the Large Language Model for analysis to obtain the analysis results.

[0003] In related technologies, generic prompts cannot accurately describe the analysis requirements of code under different scanning rules, resulting in poor analysis results. Manually writing prompts for each scanning rule is not only inefficient but also leads to inconsistent quality and unstable analysis results, making it difficult to scale up applications. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] Firstly, this disclosure provides a code scanning and analysis method based on a large model, the code scanning and analysis method comprising:

[0006] The first code is scanned based on a set of scanning rules to determine a first scanning rule and a second code that match the scan; wherein, the set of scanning rules includes at least the first scanning rule, and the second code is the code in the first code that matches the first scanning rule;

[0007] The first prompt word is obtained by filling the first prompt word template corresponding to the first scanning rule with the second code; wherein the first prompt word template is obtained by processing the first scanning rule with the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule;

[0008] The second model performs code analysis on the second code based on the code analysis task in the first prompt word, and obtains the analysis results of the second code.

[0009] Secondly, this disclosure provides a code scanning and analysis system based on a large model, the code scanning and analysis system including a scanning engine, a hint combination engine, a large model service, and a worker cluster:

[0010] The scanning engine is used to scan the first code based on a set of scanning rules to determine a matching first scanning rule and a second code; wherein the set of scanning rules includes at least the first scanning rule, and the second code is the code in the first code that matches the first scanning rule;

[0011] The worker cluster is used to call the prompt combination engine to fill the first prompt word template corresponding to the first scanning rule based on the second code to obtain the first prompt word; wherein, the first prompt word template is obtained by processing the first scanning rule through the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule.

[0012] The worker cluster is also used to call the large model service to perform code analysis on the second code based on the code analysis task in the first prompt word through the second large model in the large model service, and obtain the analysis result of the second code.

[0013] The above technical solution involves scanning the first code based on a set of scanning rules to determine the first and second scanning rules and the matching second code. Then, based on the second code, a first prompt word template corresponding to the first scanning rule is filled in to obtain a first prompt word. Finally, a second model performs code analysis on the second code based on the code analysis task in the first prompt word to obtain the corresponding analysis results. This method utilizes the semantic understanding capability of the first model to process the scanning rules and obtain the corresponding prompt word template. The prompt word template at least includes the code analysis task corresponding to the scanning rule. Thus, the prompt words constructed based on this template can accurately describe the code analysis requirements under the scanning rule, resulting in high efficiency, guaranteed prompt word quality, improved code analysis capability of the second model, enhanced consistency and accuracy of analysis results, and ease of large-scale application.

[0014] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0015] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings:

[0016] Figure 1 This is a flowchart illustrating a code scanning and analysis method based on a large model according to an exemplary embodiment of the present disclosure;

[0017] Figure 2 This is a schematic diagram illustrating a code scanning and analysis system based on a large model according to an exemplary embodiment of the present disclosure;

[0018] Figure 3 This is a schematic diagram illustrating the creation process of a plug-in rule according to an exemplary embodiment of the present disclosure;

[0019] Figure 4 This is a schematic diagram illustrating a prompt word modification process according to an exemplary embodiment of the present disclosure;

[0020] Figure 5 This is a schematic diagram illustrating a code scanning and analysis process according to an exemplary embodiment of the present disclosure;

[0021] Figure 6 This is a schematic diagram illustrating a code scanning and analysis process according to an exemplary embodiment of the present disclosure;

[0022] Figure 7 This is a schematic diagram illustrating a model update process according to an exemplary embodiment of the present disclosure;

[0023] Figure 8 This is a structural block diagram of a code scanning and analysis system based on a large model, as illustrated in an exemplary embodiment of this disclosure. Detailed Implementation

[0024] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0025] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0026] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0027] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0028] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0029] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0030] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0031] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0032] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0033] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0034] Meanwhile, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0035] In related technologies, the SAST engine primarily relies on predefined scanning rules, such as regular expression matching and data flow analysis, for scanning. Due to a lack of understanding of the code's context and deep semantics, it often marks harmless code patterns as exceptions, leading to a high false positive rate. This requires developers to spend a significant amount of time verifying the authenticity of a massive number of alerts. Furthermore, its fixed rule base makes it difficult to handle complex and ever-changing exception scenarios and code implementations.

[0036] As large language models demonstrate their powerful capabilities in code understanding and reasoning, the SAST engine and fixed rules can be used to scan code, and the potential problems discovered during the scan and their corresponding code can be submitted to the large language model for analysis to obtain the analysis results.

[0037] The effectiveness of large-scale model analysis is highly dependent on the quality of input prompts. General prompts cannot accurately describe the analysis requirements of code under different scanning rules, resulting in poor analysis results. Manually writing prompts for each scanning rule is not only inefficient but also leads to inconsistent quality, resulting in unstable analysis results and hindering scalability.

[0038] Furthermore, resource-intensive and consumption-intensive large-scale model analysis is usually tightly coupled with the initial tool scanning process, preventing users from selectively initiating in-depth analysis on specific results as needed, resulting in unnecessary resource waste. Moreover, the analysis tasks for large models are often pre-defined, such as solely for identifying code anomalies. Users cannot flexibly configure the analysis behavior and output structure of large models according to different analysis needs, such as anomaly scanning, information extraction, and code classification.

[0039] In view of this, this disclosure provides a code scanning and analysis method and system based on a large model to solve the above-mentioned technical problems.

[0040] The embodiments of this disclosure will be further explained below with reference to the accompanying drawings.

[0041] Figure 1 This is a flowchart illustrating a code scanning and analysis method based on a large model according to an exemplary embodiment of this disclosure, with reference to... Figure 1 This code scanning and analysis method may include the following steps:

[0042] S101: Scan the first code based on the set of scanning rules to determine the first scanning rule and the second code that match the scan.

[0043] For example, the code can be initially scanned using a scanning rule-based scanning tool, such as the SAST engine mentioned above. The specific tool can be selected according to the requirements, and this disclosure does not impose any restrictions on it.

[0044] In one possible approach, the code scanning and analysis method further includes: in response to a rule selection operation on a scanning configuration page for multiple preset scanning rules, determining a set of scanning rules based on the preset scanning rules corresponding to the rule selection operation among the multiple preset scanning rules; and in response to a code selection operation on the scanning configuration page, obtaining the code corresponding to the code configuration operation from the code repository as the first code.

[0045] For example, the scan configuration page allows users to perform scan-related configuration operations, such as selecting scan rules and the code to be scanned. Multiple preset scan rules can be stored in a rule base, and the scan configuration page can display multiple preset scan rules for users to choose from. When selecting the code to be scanned on the scan configuration page, users can configure the code by entering its storage address to retrieve the corresponding code from the storage address. Alternatively, code identifiers, such as package identifiers, can be displayed, in which case all code under the package corresponding to the selected package identifier will be retrieved and scanned. The specific settings can be configured according to requirements, and this disclosure does not impose any restrictions on this.

[0046] In this way, users can select the scanning rules to be executed and the code to be analyzed according to their analysis needs, so as to achieve flexible and scalable preliminary code scanning.

[0047] It should be noted that the first code can be one or more code files, and the second code can be a code snippet in the code file that matches the scanning rule or the entire code file that matches the scanning rule. The specific settings can be configured according to requirements, and this disclosure does not impose any restrictions on this.

[0048] In one possible manner, determining the first scanning rule and the second code for scanning matching includes: if a third code exists in the first code that matches the second scanning rule, in response to a second selection operation on the second scanning rule and a third selection operation on the third code, determining the scanning rule corresponding to the second selection operation in the second scanning rule as the first scanning rule, and determining the code corresponding to the third selection operation in the third code as the second code; wherein the set of scanning rules includes the second scanning rule.

[0049] For example, the code identifier corresponding to the matched code and the rule identifier corresponding to the scanning rule can be displayed on the visualization page for users to select. By decoupling large-scale model analysis from the initial tool scanning process, after the initial scan based on the scanning tool, users can selectively perform resource-intensive large-scale model in-depth analysis on a portion of the code or scanning rules as needed. This effectively improves the flexibility of code analysis, avoids unnecessary large-scale model analysis, and reduces resource waste.

[0050] S102: Fill the first prompt word template corresponding to the first scanning rule with the second code to obtain the first prompt word; wherein, the first prompt word template is obtained by processing the first scanning rule with the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule.

[0051] In one possible approach, the first prompt word is obtained by filling the first prompt word template corresponding to the first scanning rule with the second code, including: filling the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; or, filling the context information of the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; wherein, each scanning rule in the scanning rule set is configured with extraction configuration information, the extraction configuration information is used to extract the context information of the code matching the corresponding scanning rule, and the context information of the second code is extracted based on the extraction configuration information corresponding to the first scanning rule.

[0052] For example, the code to be analyzed and the prompt word template corresponding to the matching scanning rule are dynamically assembled. The code that matches the scanning rule can be directly filled into the corresponding prompt word template to obtain the corresponding prompt word, or the context information of the code that matches the scanning rule can be filled into the corresponding prompt word template to obtain the corresponding prompt word. The context information of the code includes the code itself, the code above and below a preset number of lines, the code file name, and other code-related information. The specific settings can be configured according to requirements, and this disclosure does not impose any restrictions on this.

[0053] This ensures that each call to the second-largest model is highly customized according to specific analysis needs, and that it can perceive and utilize specific code context information to generate more accurate and relevant output, thereby effectively improving the analysis performance of the second-largest model. The prompt word template can include code analysis tasks consisting of role definitions, output format constraints, etc., and can also include analysis examples that help improve the analysis capabilities of the second-largest model, etc. The specific content can be determined according to the actual scenario, and this disclosure does not impose any restrictions on it.

[0054] S103: The second code is analyzed using the second major model based on the code analysis task in the first prompt word, and the analysis results of the second code are obtained.

[0055] It is worth noting that the first and second large models provided in this embodiment are both large language models, and the first and second large models can be the same large language model. After model training, different model processing capabilities can be achieved according to different prompt words. Alternatively, the first and second large models can be different large language models, which can be trained separately and then achieve corresponding model processing capabilities according to different prompt words. The specific choice can be made according to the needs, and this disclosure does not impose any restrictions on this.

[0056] Using the above method, the semantic understanding capability of the first model can be used to process the scanning rules to obtain the corresponding prompt word template. The prompt word template includes at least the code analysis task corresponding to the scanning rule. In this way, the prompt words constructed based on the prompt word template can accurately describe the code analysis requirements under the scanning rule. This is not only efficient, but also ensures the quality of the prompt words, thereby improving the code analysis capability of the second model, improving the consistency and accuracy of the analysis results, and facilitating large-scale application.

[0057] In some possible approaches, the code scanning analysis method also includes: for each of the multiple preset scanning rules, processing the preset scanning rule through a first large model to obtain the model processing result, and generating a preset prompt word template corresponding to the preset scanning rule based on the model processing result, wherein the model processing result includes at least the code analysis task corresponding to the preset scanning rule; wherein the multiple preset scanning rules include all scanning rules in the set of scanning rules.

[0058] For example, the powerful language understanding capabilities of the large model can be leveraged to deeply analyze the analysis requirements of each preset scanning rule, obtaining content such as task description, key variables, and core logic, and thus the model processing results. Based on the model processing results, prompt word templates corresponding to the preset scanning rules can be constructed. For instance, the model processing results can be filled into a preset "meta-template" that includes role definitions and output format constraints, thereby automatically generating high-quality prompt word templates that are strongly related to the scanning rules. In this way, the prompt words constructed based on the prompt word template can accurately describe the code analysis requirements under the scanning rule, thereby effectively improving the code analysis capabilities of the second large model.

[0059] In one possible manner, the preset scanning rules are obtained as follows: in response to a rule configuration operation on the rule configuration page, preset scanning rules in plugin format are generated based on the rule configuration operation; and / or, in response to a first selection operation on a non-plugin format scanning rule, the non-plugin format scanning rule corresponding to the first selection operation is converted into a preset scanning rule in plugin format. The preset scanning rules are processed by a first major model to obtain model processing results, including: performing syntactic analysis on the preset scanning rules based on the plugin format using the first major model, extracting key content from the preset scanning rules, and obtaining model processing results based on the key content.

[0060] In this embodiment, a code scanning and analysis system that supports multi-level workflows is provided, such as... Figure 2 As shown, the user interface / plugin management module serves as the unified entry point for user interaction with the system. It supports multiple plugin formats and provides a powerful plugin management backend for creating and modifying plugin rules and managing the prompt word templates corresponding to each plugin rule. Plugin rules are essentially the scanning rules for plugin formats. The plugin and prompt word template library acts as the system's "knowledge base," persistently storing the definitions of all plugin rules and their one-to-one binding prompt word templates.

[0061] For example, users can create scanning rules in plugin format on the rule configuration page of the plugin management module, or convert existing non-plugin format static scanning rules into plugin format scanning rules. The choice can be made according to the needs, and this disclosure does not impose any restrictions on this.

[0062] For example, such as Figure 3 As shown, taking user-configured plugin rules as an example, users can trigger the "Create Plugin" control to display the rule configuration page. Users can select the plugin format and fill in the rule metadata of the scanning rule to create the plugin rule. For example, if the code needs to be scanned according to regular expressions, the metadata including the corresponding regular expressions needs to be configured. The specific settings can be made according to the requirements, and this disclosure does not impose any restrictions on this.

[0063] Furthermore, after the user fills in the scanning rules, the system obtains the metadata of the creation instructions and plugin rules, and then calls the "Prompt Template Generator" module. This generator, also known as the first large model mentioned above, leverages the powerful language understanding capabilities of the large model to deeply analyze the analysis requirements of the plugin rule, and then assembles the corresponding prompt word template. This results in a high-quality prompt word template that is highly consistent with the analysis requirements of the plugin rule. The plugin rule and the corresponding prompt word template plugin are then stored together in the prompt word template library for subsequent use during code scanning.

[0064] It is important to note that the first major model may include a multi-format rule parser, a semantic feature extraction engine, and a prompt template assembler. The multi-format rule parser can perform syntactic analysis on scanning rules for different plugin formats. The semantic feature extraction engine can extract key content from the parsed rules, such as task descriptions, key variables, and core logic. The key content to be extracted varies depending on the plugin format and can be determined based on the specific situation; this disclosure does not impose any restrictions on this. The prompt template assembler can fill the extracted analysis requirements into a preset "meta-template" containing role definitions and output format constraints, thereby automatically generating a high-quality prompt word template that is strongly related to the plugin rule.

[0065] This embodiment supports a dual-modification mode prompt management and application mechanism.

[0066] In one possible approach, generating a preset prompt word template corresponding to a preset scanning rule based on the semantic understanding result includes: generating an initial prompt word template corresponding to the preset scanning rule based on the model processing result; and, in response to a first modification operation on the initial prompt word template, determining the preset prompt word template corresponding to the preset scanning rule based on the first modification operation.

[0067] For example, the prompt word templates automatically created by the system can be stored in the plugin and prompt word template library as the final prompt word template. Alternatively, the automatically created prompt word templates can be modified according to requirements to obtain the final prompt word template and then stored in the plugin and prompt word template library. Of course, existing prompt word templates in the plugin and prompt word template library can also be modified, as can be set according to requirements, and this disclosure does not impose any restrictions on this. By supporting permanent modification of the prompt word templates corresponding to plugin rules, continuous iteration of analysis capabilities can be achieved, thereby improving the flexibility and controllability of prompt words.

[0068] For example, such as Figure 4 As shown, the modification of prompt words can be determined as temporary or permanent based on the need for modification. Permanent modifications can be achieved through the plugin management module. Users can query the plugin rules that need to be modified according to their modification needs, and then edit the prompt word template corresponding to the plugin rule. The edited prompt word template is then stored in the plugin and prompt word template library. In this way, when performing large-scale model analysis based on the plugin rule in the future, the new prompt word template will be used.

[0069] In some possible approaches, the code scanning and analysis method further includes determining a second prompt word based on a second modification operation in response to a first prompt word. The method then performs code analysis on the second code using a second large model based on a code analysis task in the first prompt word, obtaining analysis results for the second code.

[0070] For example, the prompt words can also be temporarily modified. For instance... Figure 4 As shown, after the initial scan is initiated in the user interface to determine the code and plugin rules to be analyzed in the large model, prompt words are generated based on the prompt word templates corresponding to the code and plugin rules to be analyzed in the large model. At this time, the prompt words can be edited. In this way, the modified prompt words are used for code analysis in this large model analysis. The edited prompt word template does not need to be stored in the plugin and prompt word template library, and the modified prompt words will not be obtained in the subsequent large model analysis process.

[0071] In this way, when a user initiates a code scan, they can temporarily and temporarily modify the prompts used for the current scan task to cope with special or exploratory analysis tasks, thereby improving the flexibility and controllability of the prompts.

[0072] In one possible approach, the code scanning analysis method further includes: storing a first scanning rule and a second code in an asynchronous job queue; and filling the first prompt word template corresponding to the first scanning rule with the second code to obtain the first prompt word, including: retrieving the first scanning rule and the second code from the asynchronous job queue, and retrieving the first prompt word template corresponding to the first scanning rule from a template library, wherein the template library is used to store prompt word templates corresponding to all scanning rules in the scanning rule set; and filling the first prompt word template with the second code to obtain the first prompt word.

[0073] Continue to refer to Figure 2 After the user selects the scanning rules and the code to be scanned in the user interface, the scan is initiated. The scanning engine retrieves the selected scanning rules from the plugin and prompt word template libraries, and the selected source code from the code repository, and performs an initial code scan. After determining the plugin rules and corresponding code that require large-scale model analysis, they are stored in the asynchronous job queue. The analysis worker cluster retrieves the plugin rules and corresponding code from the asynchronous job queue and proceeds with the subsequent processes.

[0074] In this embodiment, Figure 2The asynchronous job queue shown is a key component for decoupling the preliminary scanning process from the deep analysis process. It can handle a large number of scan results and large model calls. Through the architecture of the asynchronous job queue combined with the worker pool, the system achieves high throughput, scalability, elasticity, and reliability. The analysis worker cluster, as the core processing unit of the system, can call one or more large models to consume jobs from the asynchronous job queue and coordinate the entire deep analysis process. A job can be understood as a piece of code to be deeply analyzed and its corresponding plugin rules. The suggestion combination engine can obtain the corresponding suggestion templates from the plugin and suggestion word template library based on the plugin rules in the job, and then dynamically fill the code to be analyzed in the job into the suggestion word templates to form a complete suggestion that can be executed immediately.

[0075] In one possible approach, the code analysis task includes a first analysis task for analyzing whether the code is abnormal, and a second code analysis based on the code analysis task in the first prompt word using a second major model to obtain the analysis result of the second code. This includes: performing code analysis on the second code based on the first analysis task in the first prompt word using the second major model, obtaining an analysis result indicating that the second code is normal when the second code is executed in a non-online environment, or obtaining an analysis result indicating that the second code is abnormal when the second code is executed in an online environment.

[0076] For example, code scanning can be used to perform security scans on code, such as detecting security vulnerabilities. Taking a plugin rule that "detects calls to insecure software development kit versions" as an example, such as... Figure 5 As shown, corresponding prompt templates are obtained from the plugin and prompt template library. Assuming that the matching is assigned to production code and test code, two prompts are constructed based on the two matched files and prompt templates, and then input into the second model for code analysis to obtain structured analysis results.

[0077] It should be noted that production code is code that will be executed in the online environment. If it calls an insecure version of the software development kit, a security vulnerability will appear. Test code is code that will not be executed in the online environment. Even if it calls an insecure version of the software development kit, a security vulnerability will not appear.

[0078] For example, the second major model can determine whether the code within the warning words is production code or test code based on code characteristics. Taking a code file as an example, it can be determined whether it is a production or test code file based on the file description or the code project it belongs to. Taking a code snippet as an example, it can be determined whether it is a production or test code snippet based on special characters in the code snippet; for example, test code snippets are usually distinguished from production code using comment characters. Furthermore, if an insecure software development kit version is called in production code, it is identified as abnormal code; if an insecure software development kit version is called in test code, it is identified as a false alarm. This allows for accurate differentiation between real and false alarms, enabling intelligent filtering of abnormal alarms in the initial scan, reducing the probability of false alarms, and greatly improving the signal-to-noise ratio and efficiency of security scanning.

[0079] For example, the structured analysis results can be in JSON format. The analysis results can include fields that indicate whether the code is production code and the reasons for the analysis, thereby enabling an agent that can understand the plugin rules and provide analysis suggestions. The specific settings can be configured according to the requirements, and this disclosure does not impose any restrictions on this.

[0080] In one possible approach, the code analysis task includes a second analysis task for data extraction, which includes extracting objects and an output format; the second code is analyzed using a second major model based on the code analysis task in the first prompt word to obtain analysis results for the second code, including: the second code is analyzed using a second major model based on the second analysis task in the first prompt word to extract object data corresponding to the extracted objects from the second code, and analysis results including the object data are generated according to the output format.

[0081] For example, such as Figure 6 As shown, code scanning can be used for data extraction. For example, a regular expression plugin rule can be defined to extract the version numbers of all software development kits referenced in the project. After an initial scan using a scanning tool, all matching lines of code are found. The engine then calls the corresponding plugin rule's suggestion template for each line of code, requiring the large model to extract information such as version numbers from the code and return the analysis results in JSON format. In this example, the extracted object is the aforementioned software development kit, and the object data is the version number.

[0082] Furthermore, the returned analysis results can be enhanced, for example, by aggregating all the uniformly formatted JSON objects returned by all the large models to automatically form a complete and queryable software development kit dependency list, which can then be applied to software component analysis, technical debt management, and other tasks.

[0083] In other words, the code scanning and analysis method provided in this embodiment can be applied not only to security scanning but also to data extraction, improving the versatility of code scanning. Furthermore, by constraining the output format in the prompts, the structured, consistent, and machine-readable results of large-scale model analysis are ensured, laying the foundation for subsequent automated processing.

[0084] like Figure 2 As shown, the analysis results output by the second largest model can be stored in the results database and visualized in the user interface.

[0085] In this embodiment, the static analysis process is decomposed into three logical stages: the creation of plugin rules and the automatic generation of preset prompt templates; low-resource-consumption, scalable preliminary code scanning; and on-demand, large-model enhancement-based deep analysis. This system can convert structured machine rules into natural language analysis tasks, enabling the large model to analyze not only code but also plugin rules. This improves the efficiency and quality of large-model prompt word construction, effectively enhancing the analysis results and improving consistency and accuracy. It also facilitates large-scale application. Furthermore, it supports different format types and allows users to modify prompt words, enabling the code scanning analysis system to accurately execute user analysis needs. Whether performing rigorous security scans to filter false positives or conducting open-ended information extraction to enhance results, both needs are met, and the analysis results are returned in a unified structured format.

[0086] In some possible approaches, code scanning analysis methods also include: obtaining labeled analysis results in response to annotation operations on the analysis results, with the labels used to characterize whether the analysis results are correct; and fine-tuning the second-largest model based on the labeled analysis results to obtain an updated second-largest model.

[0087] For example, such as Figure 7 As shown, users can analyze the analysis results of the second-largest model, determine whether the analysis results are correct, and label them accordingly. A sample dataset can then be constructed to fine-tune the second-largest model, resulting in an updated second model applicable to future code scanning. Each sample includes input prompts and output analysis results. Incorrect analysis results can be collected to construct a sample dataset for model fine-tuning; this disclosure does not impose any restrictions on this.

[0088] This creates a closed loop of analysis, feedback, learning, and iterative updates, enabling the code scanning and analysis system to continuously improve its analytical capabilities.

[0089] Based on the same concept, this disclosure also provides a code scanning and analysis system based on a large model, such as Figure 8As shown, the code scanning and analysis system 800 includes a scanning engine 801, a hint combination engine 802, a large model service 803, and a worker cluster 804.

[0090] Scanning engine 801 is used to scan a first code based on a set of scanning rules to determine a matching first scanning rule and a second code; wherein the set of scanning rules includes at least the first scanning rule, and the second code is the code in the first code that matches the first scanning rule;

[0091] The worker cluster 804 is used to call the prompt combination engine 802 to fill the first prompt word template corresponding to the first scanning rule based on the second code, so as to obtain the first prompt word; wherein, the first prompt word template is obtained by processing the first scanning rule through the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule;

[0092] The worker cluster 804 is also used to call the large model service 803 to perform code analysis on the second code based on the code analysis task in the first prompt word through the second large model in the large model service 803, and obtain the analysis results of the second code.

[0093] By using the above system, the semantic understanding capability of the first model can be used to process the scanning rules to obtain the corresponding prompt word template. The prompt word template includes at least the code analysis task corresponding to the scanning rule. In this way, the prompt words constructed based on the prompt word template can accurately describe the code analysis requirements under the scanning rule. This is not only efficient, but also ensures the quality of the prompt words, thereby improving the code analysis capability of the second model, improving the consistency and accuracy of the analysis results, and facilitating large-scale application.

[0094] Optionally, the code scanning and analysis system also includes a plugin management module; the plugin management module is used to generate preset scanning rules in plugin format according to the rule configuration operation on the rule configuration page; and / or, in response to the first selection operation of a non-plugin format scanning rule, convert the non-plugin format scanning rule corresponding to the first selection operation into a preset scanning rule in plugin format; the worker cluster is also used to call the large model service to perform syntax analysis on the preset scanning rules based on the plugin format through the first large model in the large model service, extract the key content in the preset scanning rules, and obtain the model processing result based on the key content; wherein, the model processing result is used to generate a preset prompt word template corresponding to the preset scanning rule, and the model processing result includes at least the code analysis task corresponding to the preset scanning rule.

[0095] For example, such as Figure 2The code scanning and analysis system shown also includes a plugin management module, allowing users to configure plugin rules. After configuring the plugin rules, the worker cluster can call the large model service to process the plugin rules through the first large model and generate corresponding prompt word templates. This effectively improves the efficiency of prompt word template construction and facilitates the generation of high-quality prompt words that are strongly related to the code and plugin rules in the subsequent code scanning process, effectively improving the code analysis capabilities of the second large model.

[0096] Optionally, the code scanning and analysis system also includes an asynchronous job queue, which is used to store the first scanning rule and the second code; and a worker cluster, which is used to call the prompt combination engine to obtain the first scanning rule and the second code from the asynchronous job queue, and to obtain the first prompt word template corresponding to the first scanning rule from the template library, and to fill the first prompt word template based on the second code to obtain the first prompt word; wherein, the template library is used to store the prompt word templates corresponding to all scanning rules in the scanning rule set.

[0097] For example, a template library is... Figure 2 The plugins and prompt word template library, such as Figure 2 The code scanning and analysis system shown also includes an asynchronous job queue for storing scan rules and code that match the scans. By decoupling large-scale model analysis from the initial tool scanning process, after the initial scan based on the scanning tool, users can selectively perform resource-intensive large-scale model in-depth analysis on portions of code or scan rules as needed. This effectively improves the flexibility of code analysis, avoids unnecessary large-scale model analysis, and reduces resource waste.

[0098] In addition, the code scanning and analysis system also includes, Figure 2 The functions of each module of the system, such as the code library and result database shown, have been described in detail in the relevant method embodiments, and will not be repeated here.

[0099] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0100] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0101] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A code scanning and analysis method based on a large model, characterized in that, The code scanning and analysis method includes: The first code is scanned based on a set of scanning rules to determine a first scanning rule and a second code that match the scan; wherein, the set of scanning rules includes at least the first scanning rule, and the second code is the code in the first code that matches the first scanning rule; The second code is at least filled into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; wherein, the first prompt word template is obtained by processing the first scanning rule through the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule; The second model performs code analysis on the second code based on the code analysis task in the first prompt word, and obtains the analysis results of the second code.

2. The code scanning and analysis method based on a large model according to claim 1, characterized in that, The code scanning and analysis method also includes: For each of the multiple preset scanning rules, the first large model processes the preset scanning rule to obtain the model processing result. Based on the model processing result, a preset prompt word template corresponding to the preset scanning rule is generated. The model processing result includes at least the code analysis task corresponding to the preset scanning rule. The plurality of preset scanning rules include all scanning rules in the set of scanning rules.

3. The code scanning and analysis method based on a large model according to claim 2, characterized in that, The preset scanning rules are obtained in the following way: In response to a rule configuration operation on the rule configuration page, a preset scanning rule in plugin format is generated based on the rule configuration operation; and / or, In response to a first selection operation of a non-plugin format scanning rule, the non-plugin format scanning rule corresponding to the first selection operation is converted into a preset scanning rule of a plugin format. The step of processing the preset scanning rules using the first large model to obtain the model processing result includes: The first large model performs syntactic analysis on the preset scanning rules based on the plugin format, extracts key content from the preset scanning rules, and obtains the model processing result based on the key content.

4. The code scanning and analysis method based on a large model according to claim 2, characterized in that, The step of generating a preset prompt word template corresponding to the preset scanning rule based on the model processing result includes: Based on the model processing results, an initial prompt word template corresponding to the preset scanning rule is generated; In response to a first modification operation on the initial prompt word template, a preset prompt word template corresponding to the preset scanning rule is determined based on the first modification operation.

5. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code scanning and analysis method also includes: In response to a second modification operation on the first prompt word, a second prompt word is determined based on the second modification operation; The step of performing code analysis on the second code using a second large model based on the code analysis task in the first prompt word, and obtaining the analysis results of the second code, includes: The second model performs code analysis on the second code based on the code analysis task in the second prompt word, and obtains the analysis results of the second code.

6. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The first scanning rule and the second code for determining the scan match include: If a third code that matches the second scanning rule exists in the first code, in response to the second selection operation on the second scanning rule and the third selection operation on the third code, the scanning rule corresponding to the second selection operation in the second scanning rule is determined as the first scanning rule, and the code corresponding to the third selection operation in the third code is determined as the second code; The set of scanning rules includes the second scanning rule.

7. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code analysis task includes a first analysis task for analyzing whether the code has any anomalies, and the second code is analyzed using a second model based on the code analysis task in the first prompt word to obtain the analysis results of the second code, including: The second model performs code analysis on the second code based on the first analysis task in the first prompt word. If the second code is not executed in an online environment, an analysis result indicating that the second code is normal is obtained; if the second code is executed in the online environment, an analysis result indicating that the second code is abnormal is obtained.

8. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code analysis task includes a second analysis task for data extraction, which includes the extraction object and output format; the step of performing code analysis on the second code based on the code analysis task in the first prompt word using a second large model to obtain the analysis results of the second code includes: The second model performs code analysis on the second code based on the second analysis task in the first prompt word, extracts the object data corresponding to the extracted object from the second code, and generates analysis results including the object data according to the output format.

9. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The step of at least filling the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word includes: The second code is filled into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; or, The context information of the second code is filled into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; wherein, each scanning rule in the scanning rule set is configured with extraction configuration information, the extraction configuration information is used to extract the context information of the code that matches the corresponding scanning rule, the context information of the second code is extracted based on the extraction configuration information corresponding to the first scanning rule, and the context information includes the second code and related information of the second code.

10. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code scanning and analysis method also includes: Store the first scanning rule and the second code into the asynchronous job queue; The step of at least filling the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word includes: The first scanning rule and the second code are obtained from the asynchronous job queue, and the first prompt word template corresponding to the first scanning rule is obtained from the template library. The template library is used to store prompt word templates corresponding to all scanning rules in the scanning rule set. The second code is at least filled into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word.

11. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code scanning and analysis method also includes: In response to a rule selection operation on the scan configuration page for multiple preset scan rules, the set of scan rules is determined based on the preset scan rules corresponding to the rule selection operation among the multiple preset scan rules; In response to the code selection operation on the scan configuration page, the code corresponding to the code configuration operation is obtained from the code repository as the first code.

12. The code scanning and analysis method based on a large model according to any one of claims 1-4, characterized in that, The code scanning and analysis method also includes: In response to the annotation operation on the analysis results, labeled analysis results are obtained, wherein the labels are used to characterize whether the analysis results are correct; Based on the labeled analysis results, the second largest model is fine-tuned to obtain the updated second largest model.

13. A code scanning and analysis system based on a large model, characterized in that, The code scanning and analysis system includes a scanning engine, a suggestion combination engine, a large model service, and a worker cluster: The scanning engine is used to scan the first code based on a set of scanning rules to determine a matching first scanning rule and a second code; wherein the set of scanning rules includes at least the first scanning rule, and the second code is the code in the first code that matches the first scanning rule; The worker cluster is used to call the prompt combination engine to fill the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; wherein, the first prompt word template is obtained by processing the first scanning rule through the first large model, and the first prompt word template includes at least the code analysis task corresponding to the first scanning rule. The worker cluster is also used to call the large model service to perform code analysis on the second code based on the code analysis task in the first prompt word through the second large model in the large model service, and obtain the analysis result of the second code.

14. The code scanning and analysis system based on a large model according to claim 13, characterized in that, The code scanning and analysis system also includes a plugin management module; The plugin management module is configured to, in response to a rule configuration operation on the rule configuration page, generate a preset scanning rule in plugin format according to the rule configuration operation; and / or, in response to a first selection operation on a non-plugin format scanning rule, convert the non-plugin format scanning rule corresponding to the first selection operation into a preset scanning rule in plugin format. The worker cluster is also used to call the large model service, so as to perform syntactic analysis on the preset scanning rules based on the plugin format through the first large model in the large model service, extract key content in the preset scanning rules, and obtain model processing results based on the key content; The model processing results are used to generate preset prompt word templates corresponding to the preset scanning rules, and the model processing results include at least the code analysis task corresponding to the preset scanning rules.

15. The code scanning and analysis system based on a large model according to claim 13 or 14, characterized in that, The code scanning subsystem also includes an asynchronous job queue, which is used to store the first scanning rule and the second code; The worker cluster is used to invoke the prompt combination engine to obtain the first scanning rule and the second code from the asynchronous job queue through the prompt combination engine, and to obtain the first prompt word template corresponding to the first scanning rule from the template library, and to at least fill the second code into the first prompt word template corresponding to the first scanning rule to obtain the first prompt word; wherein, the template library is used to store the prompt word templates corresponding to all scanning rules in the scanning rule set.

Images