Code detection method and device based on large model, program product and electronic equipment

Abstract

The invention discloses a code detection method and device based on a large model, a program product and electronic equipment, and relates to the field of artificial intelligence and financial science and tech, the method comprises the following steps: creating an abstract syntax tree based on a target code, and performing static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, the static analysis is used for detecting a data flow and a control flow of a target code; dynamically analyzing the maintainability, the input data / output data and the business logic of the target code through the target model to obtain a second detection result; based on the first detection result and the second detection result, a target detection result of the target code is determined, and the target detection result at least comprises a code quality score, a code defect list and a code modification suggestion of the target code. The technical problems of high false alarm rate and low accuracy of program code detection in the prior art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and the field of financial technology, in particular, to a code detection method and device based on a large model, a program product and an electronic device. BACKGROUND

[0002] Existing software systems usually face the development challenges of rapid iteration, continuous integration / continuous delivery, and extremely short feedback cycle requirements. In the face of large software system scale, complex technology stack, and dependence on many conditions, manual review becomes inefficient and difficult to cover comprehensively. Traditional manual code review cannot meet the demand of rapid delivery. In addition, senior development human resources are limited. Therefore, automating repetitive and low-level code review work can free up development manpower to focus on more complex code logic design, architecture review, and business innovation areas.

[0003] In the prior art, code review can be performed by using open source tools / comprehensive platform tools. The open source tool plug-ins are rich, and the comprehensive platform tools aggregate vulnerability / bad smell / coverage / repeated code indicators, and can provide a visual technical debt board. However, the existing tools cannot adapt to the business scenarios and development history specifications of financial institutions, and have a high false positive rate.

[0004] In the prior art, code review can also be performed by using simple text / regular expression-based checking tools. However, as the number of supported code languages increases, the tool review scanning time is too long, the custom rule language is not popular and is not easy to promote, the false alarm volume is high, which makes team members fall into alarm fatigue, and the text / regular expression-based checking tools also cannot adapt to the core trading scenarios in the financial background, and have a high false positive rate.

[0005] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0006] The present application provides a code detection method and device based on a large model, a program product and an electronic device, to at least solve the technical problems of high false positive rate and low accuracy in detecting program code in the prior art.

[0007] According to an aspect of the present application, a large model-based code detection method is provided, comprising: creating an abstract syntax tree based on target code; performing static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code; performing dynamic analysis on maintainability, input data / output data, and business logic of the target code through a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer; and determining a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score, a code defect list, and a code modification suggestion of the target code.

[0008] Optionally, before creating the abstract syntax tree based on the target code, the large model-based code detection method comprises: collecting program source code corresponding to a code change request on a preset platform, wherein the code change request corresponds to a request identifier, and the program source code is a program code written in at least one programming language; performing standard processing on the program source code to obtain first code with uniform code format; and performing comment deletion, code block splitting, and sensitive information filtering operations on the first code through a preset regular expression to obtain the target code.

[0009] Optionally, the step of performing static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result comprises: creating a data flow graph and a control flow graph based on node information of the abstract syntax tree, wherein the data flow graph is used to represent the dependency relationship between data in the target code, and the control flow graph is used to represent all paths traversed in the execution process of the target code; and analyzing the data flow graph and the control flow graph based on a preset static rule to obtain a first code quality sub-score, a first code defect sub-list, and a first code modification sub-suggestion, wherein the preset static rule is used to detect at least reference packages, exception throwing methods, variable scopes, variable data flow directions, conditional branches, loop structures, and interface types of the target code; and taking the first code quality sub-score, the first code defect sub-list, and the first code modification sub-suggestion as the first detection result.

[0010] Optionally, the step of obtaining the second detection result by dynamically analyzing the maintainability, input data / output data and business logic of the target code through the target model comprises: after inputting the target code into the target model, performing lexical analysis on the target code through the target model to obtain a first word sequence; performing tokenization processing on the first word sequence to obtain a second word sequence, wherein the tokenization processing is used for uniformly processing identifiers and characters in the target code; performing sub-word segmentation processing on the second word sequence to obtain a target word, wherein the sub-word segmentation processing is used for separating keywords and operators in the target code, and the target word comprises the keywords and the operators; determining a preset model rule hit by the target code based on the target word, wherein the preset model rule is used at least for maintainability evaluation of the target code, business logic consistency verification of the target code, and integrity detection of an input / output communication area of the target code; and performing dynamic analysis on the target code based on the preset model rule to obtain the second detection result.

[0011] Optionally, the step of obtaining the second detection result by dynamically analyzing the target code based on the preset model rule comprises: analyzing the target code based on the preset model rule to obtain a second code quality sub-score, a third code quality sub-score, a second code defect sub-list and a second code modification sub-suggestion, wherein the second code quality sub-score is used to represent the integrity and business logic consistency of the target code, and the third code quality sub-score is used to represent the maintainability of the target code; and taking the second code quality sub-score, the third code quality sub-score, the second code defect sub-list and the second code modification sub-suggestion as the second detection result.

[0012] Optionally, the step of determining the target detection result of the target code based on the first detection result and the second detection result comprises: merging the first code defect sub-list in the first detection result and the second code defect sub-list in the second detection result to obtain a code defect list of the target code; merging the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result to obtain a code modification suggestion of the target code; determining a fourth code quality sub-score based on the target code modification suggestion, wherein the fourth code quality sub-score is used to represent the adoption rate of the target modification suggestion by the user; performing weighted summation on the first code quality sub-score in the first detection result, the second code quality sub-score in the second detection result, the third code quality sub-score and the fourth code quality sub-score to obtain a code quality score of the target code; and taking the code defect list, the code modification suggestion and the code quality score of the target code as the target detection result.

[0013] Optionally, after the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result are merged to obtain a target code modification suggestion, the code detection method based on the large model comprises: in a case where an adoption rate of the target code modification suggestion is less than or equal to a preset adoption rate, generating prompt information, wherein the prompt information is used to prompt a developer to update the preset static rule and / or the preset model rule.

[0014] According to another aspect of the present application, a code detection device based on a large model is also provided, comprising: a creation unit configured to create an abstract syntax tree based on target code; a first analysis unit configured to perform static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code; a second analysis unit configured to perform dynamic analysis on maintainability, input data / output data and business logic of the target code by a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer; and a determination unit configured to determine a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score, a code defect list and a code modification suggestion of the target code.

[0015] According to another aspect of the present application, a computer program product is also provided, and the computer program product stores a computer program, wherein the computer program controls the computer program product to execute the code detection method based on the large model of any one of the above aspects when the computer program runs.

[0016] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device comprises one or more processors and a memory, and the memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the code detection method based on the large model of any one of the above aspects.

[0017] In the present application, first, an abstract syntax tree is created based on target code, then, the present application performs static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code, then, the present application performs dynamic analysis on maintainability, input data / output data and business logic of the target code by a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer, and finally, the present application determines a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score, a code defect list and a code modification suggestion of the target code.

[0018] From the above, the application adopts the mode of combining abstract syntax tree and large model analysis, through static analysis on the abstract syntax tree of the target code, using the large model to intelligently detect the maintainability of the target code, input data / output data and business logic, achieving the purpose of improving the detection accuracy of the target code, thereby realizing the technical effects of precise code quality evaluation and precise code defect positioning.

[0019] Specifically, the application first performs static data flow analysis and control flow analysis based on the abstract syntax tree to obtain a first detection result, ensuring the basic code specification, then uses the large model trained based on L code samples to perform dynamic analysis on the target code, evaluates the maintainability of the target code, data processing and business logic consistency, obtains a second detection result, finally aggregates the two types of detection results, provides comprehensive code quality detection results, thereby effectively reducing the false alarm amount, thereby realizing the technical effect of improving the reliability of the code review of the financial institution, and further solving the technical problems of high false positive rate and low accuracy in the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings described herein are used to provide further understanding of the application, and form a part of the application. The schematic embodiments of the application and their descriptions are used to explain the application, and do not constitute an improper limitation on the application. In the drawings:

[0021] Figure 1 is a hardware structure block diagram of an optional computer terminal (or mobile device) for implementing a large model-based code detection method according to an embodiment of the application;

[0022] Figure 2 is a flowchart of an optional large model-based code detection method according to an embodiment of the application;

[0023] Figure 3 is an architecture diagram of an optional large model-based code detection system according to an embodiment of the application;

[0024] Figure 4 is a workflow diagram of an optional preprocessing module according to an embodiment of the application;

[0025] Figure 5 is an optional program flowchart corresponding to the target code according to an embodiment of the application;

[0026] Figure 6 is a flowchart of an optional analysis method of the target code according to an embodiment of the application;

[0027] Figure 7is a flowchart of an optional target model training method according to an embodiment of the application;

[0028] Figure 8 is a schematic diagram of an optional large model-based code detection device according to an embodiment of the application;

[0029] Figure 9 is a structural block diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0032] It should also be noted that the relevant information (including but not limited to information for display and analyzed information) and data (including but not limited to target code data) involved in the present application are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information fed back by the aforementioned user or institution, the relevant information is obtained.

[0033] In addition, the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant information and relevant data involved in the present application all comply with the relevant laws, regulations and standards of the relevant regions, and necessary security measures are taken, without violating public order and good customs. In addition, the present application provides a corresponding operation portal for users to choose to authorize or refuse to authorize, and if the user chooses to refuse to authorize, the corresponding expert decision-making process is entered.

[0034] First, some of the nouns or terms that appear in the description of the embodiments of the present application are explained as follows:

[0035] Prompt: Check the input and optimization prompt keywords and templates in the large model.

[0036] Regular expression: A text processing tool used to match, find, and replace patterns in strings, widely used in programming, text editing, data processing, and other fields.

[0037] AST (Abstract Syntax Tree): A structured representation of source code that parses the code into a tree-like data structure, which is the core of compilers, interpreters, and code analysis tools.

[0038] CFG (Control Flow Graph): A control flow graph is a directed graph that represents all possible paths in the program execution process, composed of basic blocks (Basic Block) and edges (Edge).

[0039] DFG (Data Flow Graph): A data flow graph represents the dependencies between the definition (def) and use of data in a program. This flow graph focuses on how data flows, rather than control flow.

[0040] According to the embodiments of the present application, an embodiment of a code detection method based on a large model is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0041] The method embodiments provided by the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 is a hardware structure block diagram of a computer terminal (or mobile device) according to an embodiment of the present application for implementing a code detection method based on a large model. As Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0042] Optionally, it should be noted that the aforementioned one or more processors 102 and / or other data processing circuitry may generally be referred to herein as "data processing circuitry". This data processing circuitry may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuitry may be a single, independent processing module, or may be wholly or partially integrated into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuitry serves as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0043] Optionally, the memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the code detection method based on a large model in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned code detection method based on a large model. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0044] Optionally, the transmission device 106 is configured to receive or send data via a network. The network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network interface controller (NIC) that can connect to other network devices through a base station to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module that is configured to communicate with the Internet wirelessly.

[0045] Optionally, the display can be a touch screen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0046] Optionally, under the above operating environment, the present application provides a large model-based code detection system (hereinafter referred to as a large model-based code detection system) for executing the large model-based code detection method of the present application, Figure 2 is a flowchart of an optional large model-based code detection method according to an embodiment of the present application, as shown in Figure 2 The method comprises the following steps:

[0047] Step S201, creating an abstract syntax tree based on the target code.

[0048] Optionally, the target code refers to the preprocessed program code to be checked, which is the basis for subsequent code detection and analysis.

[0049] Optionally, the abstract syntax tree is a tree structure representing the target code, which is used to store the syntax structure of the target code. Each node in the abstract syntax tree represents a syntax structure, such as a function, a class, a variable declaration, etc. This structured representation makes the program structure and syntax of the target code easy to understand, thereby improving the subsequent detection efficiency.

[0050] Optionally, converting the target code into an abstract syntax tree form has the following effects:

[0051] (1) Accurate representation of code structure: the abstract syntax tree can accurately capture the internal structure of the code, including the hierarchy and mutual relationship between various syntax elements, providing structured data support for subsequent static analysis.

[0052] (2) Improving analysis efficiency and accuracy: compared with the original text code, the abstract syntax tree form of code is easier for computer algorithms to understand and analyze, thereby improving the efficiency and accuracy of the entire code detection process.

[0053] Step S202, based on the node information of the abstract syntax tree, the target code is statically analyzed to obtain a first detection result, wherein the static analysis is used to detect the data flow and the control flow of the target code.

[0054] Optionally, static analysis refers to checking and evaluating the syntax and structure of the code without executing it to detect potential defects and non-compliant programming habits in the code.

[0055] Optionally, data flow refers to how data is passed from one location to another during program execution, including variable definition and usage.

[0056] Optionally, control flow refers to the execution path of the program, including conditional branching (IF, SWITCH), loop structure (WHILE, FOR), and function calls, etc.

[0057] Optionally, static analysis of the target code based on the node information of the abstract syntax tree has the following effects:

[0058] (1) Detect syntax and structure errors: By analyzing the data flow and control flow, static analysis can more deeply detect potential errors in code syntax and structure.

[0059] (2) Reduce the risk of running: Static analysis helps to find code problems that may cause running errors before the target code runs, thereby reducing the risk of the software running phase.

[0060] (3) Standardize code style: Static analysis can also check whether the code conforms to specific programming standards, such as naming conventions, code format, etc., which helps to ensure the consistency and readability of the target code.

[0061] Step S203, the maintainability, input data / output data and business logic of the target code are dynamically analyzed by the target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer.

[0062] Optionally, dynamic analysis is opposite to static analysis, which is the analysis of program behavior during code execution, which can check the running characteristics of the target code.

[0063] Optionally, dynamic analysis of the maintainability, input data / output data and business logic of the target code by the target model has the following effects:

[0064] (1) Enhance detection depth: The target model can recognize more complex and deeper code problems, such as code maintainability and business logic consistency, by learning from historical code samples.

[0065] (2) Optimizing code performance: Dynamic analysis can detect performance issues during code execution, such as unnecessary loops, data processing bottlenecks, etc., which can help optimize code in advance and avoid low performance.

[0066] (3) Adapt to business scenarios: By analyzing business logic, the target model can better understand the functional intent of the code, ensuring that the target code meets business requirements, thereby improving user experience.

[0067] Step S204, based on the first detection result and the second detection result, determine the target detection result of the target code, wherein the target detection result at least includes the code quality score, the code defect list and the code modification suggestion of the target code.

[0068] Optionally, the first detection result includes the first code quality sub-score, the first code defect sub-list and the first code modification sub-suggestion.

[0069] Optionally, the second detection result includes the second code quality sub-score, the third code quality sub-score, the second code defect sub-list and the second code modification sub-suggestion.

[0070] Optionally, the target detection result is a comprehensive evaluation result after integrating the static and dynamic analysis results, providing comprehensive feedback on code quality.

[0071] Optionally, based on the first detection result and the second detection result, the target detection result of the target code is determined as follows:

[0072] (1) Comprehensive evaluation of code quality: Combining static analysis results and dynamic analysis results can more comprehensively evaluate the code quality of the target code. The target detection result not only checks the syntax and style of the code, but also focuses on the actual performance of the code and business logic errors.

[0073] (2) Improve detection accuracy: By analyzing the target code with multiple analysis methods, the false positive rate can be reduced, and the accuracy of the detection result can be improved. At the same time, the modification suggestions in the target detection result are more reliable.

[0074] (3) Improve code quality: The code defect list and modification suggestion in the target detection result provide clear code improvement direction for developers, which helps to more efficiently fix code problems and improve the overall quality of the code.

[0075] In summary, through the above steps, the present application aims to build a more comprehensive and accurate code detection system that can effectively identify and report defects in the target code, while providing code improvement suggestions, thereby improving the efficiency and quality of code review. The present application is suitable for continuous integration and continuous delivery processes of large software projects.

[0076] From the above, the application adopts the mode of combining abstract syntax tree and large model analysis, through static analysis of the abstract syntax tree of the target code, using the large model to intelligently detect the maintainability of the target code, input data / output data and business logic, achieving the purpose of improving the detection accuracy of the target code, thereby realizing the technical effects of accurate code quality evaluation and accurate code defect positioning.

[0077] Specifically, the application first performs static data flow analysis and control flow analysis based on the abstract syntax tree to obtain a first detection result, ensuring the basic code specification, then the application uses a large model trained based on L code samples to perform dynamic analysis on the target code, evaluates the maintainability of the target code, data processing and business logic consistency, obtains a second detection result, finally, the two types of detection results are summarized to provide comprehensive code quality detection results, thereby effectively reducing the false alarm amount, thereby realizing the technical effect of improving the reliability of the code review of the financial institution, and further solving the technical problems of high false positive rate and low accuracy in detecting program code in the prior art.

[0078] Optionally, Figure 3 is an architectural diagram of an optional large model-based code detection system according to an embodiment of the application, as Figure 3 shown, the system includes a code input module, a preprocessing module, a static analysis module, a basic checking module, a result fusion module, a visualization module and a result adoption feedback module, the functions of each module are described in conjunction with the following embodiments.

[0079] In an optional embodiment, before creating an abstract syntax tree based on the target code, the detection system first collects program source code corresponding to a code change request in a preset platform, wherein the code change request corresponds to a request identifier, the program source code is a program code written in at least one programming language, then the detection system performs standard processing on the program source code to obtain a first code with uniform code format, then the detection system performs comment deletion, code block splitting and sensitive information filtering operations on the first code through a preset regular expression to obtain the target code.

[0080] Optionally, the preset platform is used to manage change requests in the project code library, wherein each change request has a corresponding unique identifier key (request identifier), so that the developer can accurately track and extract code changes, and the key is the input data of the code input module, the code input module obtains all change request codes submitted by the developer but not entered into the public code library through the key.

[0081] Optionally, for example, the key is "https: / / scm-XXXXXX / c / test / + / 2419**1".

[0082] Optionally, code change request, when the developer makes code modifications to the project and wants to merge these modifications into the main code library, the corresponding code change request is initiated, which contains the comparison of the code before and after the modification, and detailed modification instructions.

[0083] Optionally, program source code refers to the original program code written in at least one programming language (such as Java language, SQL language, Shell language).

[0084] Optionally, specification processing aims to convert source code from different developers into a consistent format, eliminate inconsistencies caused by individual style differences, and ensure the accuracy of subsequent analysis. Standardization processing includes but is not limited to code indentation, line breaks, and bracket alignment.

[0085] Optionally, comments are non-executable texts used to explain the functions of the code. During code detection, comments will interfere with the normal work of analysis tools, so they need to be removed first.

[0086] Optionally, by code block splitting, large code units are split into smaller, functionally independent parts, making code analysis more detailed and targeted. Each code block may represent a function, class or other logical unit.

[0087] Optionally, by filtering sensitive information, it can ensure that sensitive information (such as customer data, account password, private key, etc.) in the code will not be leaked. The detection system can use regular expressions to identify names, phone numbers and email addresses, and replace or delete the identified sensitive information.

[0088] Optionally, Figure 4 is an optional pre-processing module according to an embodiment of the present application. As shown in Figure 4 The pre-processing module is used to preprocess the obtained code content written in different programming languages (such as Java language, SQL language, Shell language), thereby forming a basic data source suitable for the system, and then cleaning and outputting the basic data source through regular expressions, thereby forming the final inspection data source (i.e. target code), including format / annotation processing, code dependency analysis, code block splitting, and sensitive information filtering.

[0089] Optionally, comment processing is used to disassemble and delete the contents of " / / " and " / ** / " in Java code segments, delete the contents of "--" and " / ** / " in SQL code, and delete the contents after "#" in shell code, thereby reducing the interference caused by code comments.

[0090] Optionally, code blocks can be split into functional / class blocks, with each block being checked independently. This system uses "======B======" and "======E=======" to mark the beginning and end of each code block.

[0091] Optionally, sensitive information filtering is possible. Sensitive information such as email addresses, contact information, and usernames often appears in the code of the financial industry. Regular expressions can be used to replace or delete sensitive information. For example, this system uses the following regular expression to replace user contact information in the code.

[0092] #Find all matches:

[0093] text = "Telephone: 123-4567";

[0094] phones=re.findall(r'\d{3}-\d{4}',text);

[0095] # Output: ['Phone number: 123-4567', 'Phone number: 890-1234'];

[0096] Optionally, the detection system performs preprocessing operations on the program source code, such as standardization, comment removal, code block splitting, and sensitive information filtering, which can achieve the following technical effects:

[0097] (1) Improve code review efficiency: By preprocessing the code, especially by removing comments and splitting code blocks, static analysis tools can identify and analyze key parts of the code faster and more accurately.

[0098] (2) Protect sensitive information: During code flow and analysis, sensitive information filtering can prevent the leakage of sensitive information and ensure information security.

[0099] (3) Code standardization: The process of unifying code format eliminates the differences caused by the different personal habits of different developers, enabling code analysis tools to process all code in a consistent manner, thereby improving the accuracy and reliability of the tools.

[0100] (4) Reduce false alarms: The standardization of comments and code structure in the preprocessing step reduces the possibility of false alarms in subsequent detection steps, thereby improving the accuracy of the entire detection process.

[0101] In summary, the above preprocessing measures provide clean, uniformly formatted, and desensitized code data for subsequent code detection, thereby providing a data foundation for ensuring that the detection tool accurately identifies and analyzes the code.

[0102] In an alternative embodiment, the detection system first creates a data flow graph and a control flow graph based on the node information of the abstract syntax tree, wherein the data flow graph is used to represent the dependency relationship between data in the target code, and the control flow graph is used to represent all paths traversed by the target code during execution. Then, the detection system analyzes the data flow graph and the control flow graph based on preset static rules to obtain a first code quality sub-score, a first code defect sub-list, and a first code modification sub-suggestion, wherein the preset static rules are used to at least detect the reference package, the exception throwing manner, the variable scope, the variable data flow direction, the conditional branch, the loop structure, and the interface type of the target code. Finally, the detection system takes the first code quality sub-score, the first code defect sub-list, and the first code modification sub-suggestion as the first detection result.

[0103] Optionally, the first code defect sub-list is used to record code defect instances in the data flow and / or control flow of the target code, such as improper use of packages, improper exception handling, variable scope errors, variable data flow direction abnormalities, logical errors of conditional branches / loop structures, and interface type mismatches.

[0104] Optionally, the first code defect sub-list is used to record code defect instances that reduce the maintainability of the target code, the integrity of input / output data, and the consistency of business logic, such as business logic errors and non-standard input / output data processing.

[0105] Optionally, the first code modification sub-suggestion is used to correct the code defects in the first code defect sub-list.

[0106] Optionally, the second code modification sub-suggestion is used to correct the code defects in the second code defect sub-list.

[0107] Optionally, the first code quality sub-score is a quantitative score obtained after detecting the target code based on the preset static rules in the static analysis stage.

[0108] Optionally, the static analysis module takes the abstract syntax tree tool as the core module of the code static analysis step, and performs static checking on the target code output by the preprocessing module. The abstract syntax tree tool is used to convert the target code corresponding to the program to be checked into an abstract syntax tree. Then, all node information is obtained by traversing and accessing the nodes in the abstract syntax tree. Then, the DFG is constructed based on the node information to identify whether the relationship between the definition and use of data in the program is complete, so as to focus on the flow cycle of data between variables. In addition, the CFG is constructed based on the node information to identify all possible paths in the program. Then, the completeness of code traversal is judged by judging whether the jump condition of each basic block is true (i.e. T in Figure 5 ) or false (i.e. T in Figure 5 ).

[0109] Optionally, Figure 5 is an optional program flowchart corresponding to the target code according to an embodiment of the present application, as shown in Figure 5 , the target code is divided into different code segments, including Figure 5 program basic block A, program basic block B, program basic block C and program basic block D, and different program basic blocks are connected by conditional instructions and jump instructions, wherein the conditional instructions include Figure 5 conditional instruction A and conditional instruction A1, and the jump instructions include Figure 5 jump instruction B and jump instruction B1.

[0110] Optionally, the static analysis module combines the industry general development specification to preliminarily check the basic quality of the target code (such as prohibited reference package, exception throwing mode), variable scope, variable data flow, IF condition structure, FOR loop structure and interface type.

[0111] Optionally, the static analysis module tokenizes the code segment, including identifier normalization, character unification, and converting numbers <num>and string <str>Encapsulate, reserve IF, FOR, ELSE, WHILE and LOOP keywords, separate operators (such as "= ", ": = " and "+ = ").

[0112] Optionally, the preset static rule is a set of predefined rules for measuring and checking the quality and security of the code. The preset static rule covers the use limitation of the reference package, the best practice of the exception handling, the life cycle management of the variable, the legality of the data flow, the rationality of the conditional statement and the loop structure, and the consistency of the interface type, and in the financial software development environment, the preset static rule also needs to consider the compliance requirements specific to the financial industry.

[0113] For example, the preset static rule is as follows:

[0114] (1) prohibit referencing import org.apache.commons.beanutils;

[0115] (2) whether to use new TranFailException(e.getMessage()) to throw an exception;

[0116] (3) whether the variable is initialized, whether <str>initialized to ", will be <num>is initialized to 0;

[0117] (4) The detection function return type is checked whether it is consistent with the interface definition type.

[0118] In summary, the steps in the above embodiments have the following technical effects:

[0119] (1) Fine code understanding: by constructing DFG and CFG, the static analysis module can deeply understand the data flow pattern and control logic in the target code, so as to identify potential code defects and security vulnerabilities.

[0120] (2) Automatic rule checking: the application of preset static rules realizes the automation of code checking, reduces the burden of manual code review, and improves the code checking speed.

[0121] (3) Reduce false positives: combined with data flow graph and control flow graph analysis, the static analysis module can more accurately identify real code problems rather than false positives, thereby reducing false positives.

[0122] (4) Improve code compliance: in the financial field, the preset static rules often contain safety specifications and standards in the financial industry, therefore, using preset static rules for detection can significantly improve the industry compliance of the target code.

[0123] In an optional embodiment, after the target code is input into the target model, the detection system first performs lexical analysis on the target code through the target model to obtain a first word sequence, then the target model performs tokenization processing on the first word sequence to obtain a second word sequence, wherein the tokenization processing is used to uniformly process identifiers and characters in the target code, then the target model performs subword segmentation processing on the second word sequence to obtain a target word, wherein the subword segmentation processing is used to separate keywords and operators in the target code, the target word includes keywords and operators, next, the target model determines the preset model rule hit by the target code based on the target word, wherein the preset model rule is at least used for maintainability evaluation of the target code, business logic consistency verification of the target code, and integrity detection of the input / output communication area of the target code, finally, the detection system performs dynamic analysis on the target code based on the preset model rule to obtain a second detection result.

[0124] Optionally, the detection system controls the target model to perform the above lexical analysis, tokenization processing, subword segmentation processing, and maintainability evaluation, business logic consistency verification, and input / output communication area integrity verification operations through the basic checking module.

[0125] Optionally, Figure 6 is a flowchart of an optional target code analysis method according to an embodiment of the present application, as shown in Figure 6 As shown in the right branch, the detection system performs lexical analysis on the target code through the target model to obtain the corresponding lexical sequence (i.e., the first word sequence). Then, the target model performs tokenization processing and subword segmentation processing on the first word sequence, and inputs the keywords and operators segmented by subword segmentation into the Transformer architecture. The Transformer is used to perform maintainability evaluation on the target code, perform business logic consistency verification on the target code, and detect the integrity of the input / output communication area of the target code by using the self-attention mechanism.

[0126] Optionally, as shown in Figure 6 As shown in the left branch, the detection system analyzes the target code through the abstract syntax tree tool to obtain the abstract syntax tree corresponding to the target code. Then, the detection system creates CFG and DFG based on the node information in the abstract syntax tree through the static analysis module. Then, the CFG and DFG are statically analyzed based on the preset static rules through the GNN (Graph Neural Network). Finally, the detection system summarizes the static analysis result and the dynamic analysis result of the Transformer architecture to obtain the task output result (i.e., the target detection result).

[0127] Optionally, the task output result is shown in the following Table 1:

[0128] Table 1

[0129] Detection task type Input code Output result Defect check Copy properties (A, B) Source A not assigned Code clone check Try {} catch {} Similarity reaches 90% Key information check Add class C() Field A in Class C not initialized

[0130] Optionally, the target model refers to a large model pre-trained through a large number of code samples, for example, a neural network model created based on the Transformer architecture. The target model has the ability to identify and understand the code structure, syntax structure, and context information.

[0131] Optionally, lexical analysis is used to identify the basic constituent elements in the target code, such as keywords, identifiers, numbers, strings, and symbols, so as to decompose the source code into a series of meaningful units, i.e., a series of words.

[0132] Optionally, tokenization processing is used to convert the words in the first word sequence into standardized tokens. For example, in this process, all class names and variable names are marked as <identifier>, all numbers are labeled as <num>Thus, the complexity of subsequent model processing is reduced, and the analysis efficiency of the model is improved.

[0133] Optionally, the sub-word segmentation processing is used to further divide the words in the second word sequence obtained through the tokenization processing into smaller meaningful sub-units, which helps the model to identify more code details. After the sub-word segmentation processing, the second word sequence is subdivided into small units containing keywords and operators, and these small units constitute the minimum granularity elements for the target model to understand the code logic and structure.

[0134] Optionally, the target code is dynamically analyzed based on the preset model rule hit by the target code, which has the following technical effects:

[0135] (1) Enhance understanding ability: through lexical analysis, tokenization and sub-word segmentation, the target model can more deeply understand the structure and semantics of the code, thereby providing a more accurate data basis for subsequent dynamic analysis.

[0136] (2) Improve detection efficiency: tokenization processing and sub-word segmentation simplify the code structure, thereby reducing the processing difficulty of the target model and speeding up the dynamic analysis.

[0137] (3) Reduce false positive rate and improve accuracy: dynamic analysis based on preset model rules combines the intelligent analysis of large models and industry specifications, which can more accurately judge the quality and functionality of the code, reduce the false positives that may be generated by static analysis, and dynamic analysis can detect the maintainability of the code, business logic consistency and the integrity of input / output data processing, more comprehensively evaluate the quality of the code from multiple dimensions.

[0138] In an optional embodiment, the detection system first analyzes the target code based on the preset model rule to obtain a second code quality sub-score, a third code quality sub-score, a second code defect sub-list and a second code modification sub-suggestion, wherein the second code quality sub-score represents the integrity and business logic consistency of the target code, and the second code quality sub-score represents the maintainability of the target code. Then, the detection system takes the second code quality sub-score, the third code quality sub-score, the second code defect sub-list and the second code modification sub-suggestion as the second detection result.

[0139] Optionally, Figure 7 is a flowchart of an optional training method of a target model according to an embodiment of the present application, as shown in Figure 7 As shown, the detection model combines multiple simple code samples (such as variables, single functions, single-layer IF-ELSE structures, and single-layer loops) to obtain complex code samples, and then inputs the original simple code samples and the complex code samples as training data (i.e., L code samples) to the initial model for iterative training. After each output result of the model is obtained, the detection system checks the output result based on the financial industry specifications. The checking process includes collecting user feedback information, error analysis, updating the rule library with false positive cases, fine-tuning the data set, and retraining the model.

[0140] Optionally, the model output result adopted by the user is returned to the training model in the form of a code block as a positive sample; for the model output result not adopted by the user, the code segment needs to be manually rewritten and returned to the training model as a negative sample.

[0141] Optionally, the preset model rules are developed based on the deep understanding ability of the machine learning model and the coding specifications, business logic, and maintainability standards specific to the financial industry. Unlike traditional static rule analysis, the preset model rules can detect more complex code problems, such as code maintainability evaluation and business logic consistency check.

[0142] For example, the preset model rules are as follows:

[0143] (1) Deep copy and shallow copy data address problem: After performing the copyproperties operation (used to transfer data from one object to another object with similar attribute structure), check whether the variable address has changed;

[0144] (2) Maintain commonly recommended code segments: decimal integer amount exchange rate conversion, account list traversal, multi-element array output, interface call, variable non-empty check, non-space check, and communication area upload check;

[0145] (3) Key information missing check: important field assignment such as accounting network, medium identification, amount, borrowing direction, exchange rate, interest rate, and interest.

[0146] Optionally, the second code quality sub-score is used to evaluate the integrity and business logic consistency of the target code. This scoring criterion focuses on checking whether the code completely follows the design requirements, whether all business logic is correctly implemented, and whether the code logic is coherent and free of contradictions.

[0147] Optionally, the third code quality sub-score is used to evaluate the maintainability of the target code. This scoring criterion focuses on checking the structure, naming specification, annotation situation, and code style of the code to ensure that the code is easy to extend in the future.

[0148] Optionally, the second code defect sub-list, i.e., the list of code problems identified in the dynamic analysis, includes but is not limited to complex business logic errors, potential maintenance difficulties, and hard-to-detect performance bottlenecks.

[0149] Optionally, the second code modification sub-suggestion, i.e., specific modification guidance suggestions for each problem in the second code defect sub-list, includes but is not limited to refactoring suggestions, logic optimization techniques, and code rewriting strategies, thereby improving code quality and maintainability.

[0150] Optionally, the detection system performs dynamic detection based on the target model, and takes the second code quality sub-score, the third code quality sub-score, the second code defect sub-list, and the second code modification sub-suggestion obtained from the detection as the second detection result, thereby achieving comprehensive evaluation of the target code quality, especially for the inspection of code dynamic characteristics, including the coherence of business logic, the maintainability of code, and the future scalability, thereby improving the depth and breadth of code detection and improving the development quality of financial software code.

[0151] In an optional embodiment, the detection system first merges the first code defect sub-list in the first detection result and the second code defect sub-list in the second detection result to obtain a code defect list of the target code, then merges the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result to obtain a code modification suggestion of the target code, then determines a fourth code quality sub-score based on the target code modification suggestion, wherein the fourth code quality sub-score represents the adoption rate of the target modification suggestion by the user, next, the detection system performs weighted summation on the first code quality sub-score in the first detection result, the second code quality sub-score in the second detection result, the third code quality sub-score, and the fourth code quality sub-score to obtain a code quality score of the target code, and finally, the detection system takes the code defect list, the code modification suggestion, and the code quality score of the target code as the target detection result.

[0152] Optionally, the detection system checks the static inspection analysis result and the large model intelligent inspection output result, and if there is a conflict between the two detection results, i.e., the static inspection analysis fails but the basic inspection module passes, the expert is started for review.

[0153] Optionally, the calculation process of the code quality score (score) of the target code is shown in the following code content:

[0154] score = 0.4 * syntax_match(llm_output) / / large model intelligent inspection output result;

[0155] +0.3 * consistency_with_static (static_results) / / static analysis results;

[0156] +0.2 * historical (context) / / user adoption rate of target modification suggestions;

[0157] +0.1 * explanation_quality / / maintainability;

[0158] Optionally, considering that different types of scores have different importance for code quality, the detection system assigns different weight factors to different scores to comprehensively calculate a value reflecting the overall quality of the code, wherein the selection of the weight is based on the relative importance of the code attributes and business requirements.

[0159] Optionally, the target detection result contains all key information after a comprehensive evaluation of the target code, i.e., a list of all defects detected in the code, modification suggestions corresponding to each defect, and a code quality score calculated based on all detection results. The target detection result serves as a basis for subsequent code improvement and optimization actions, ensuring efficiency and accuracy in the software development process.

[0160] In an optional embodiment, after merging the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result to obtain the target code modification suggestion, in the case where the adoption rate of the target code modification suggestion is less than or equal to the preset adoption rate, the detection system generates a prompt information, wherein the prompt information is used to prompt the developer to update the preset static rules and / or the preset model rules.

[0161] Optionally, after obtaining the target detection result, the detection system can output a check result report based on the key of a single user request, and output all key check result scores in column chart according to different time dimensions such as hour, day, week, and check the code quality trend in different time periods.

[0162] Optionally, after collecting the feedback results of the target detection result from the user, the detection system feeds back the user adoption rate to the target model in percentage form based on the key of a single user request, and marks the check result items that are not adopted. At the same time, the detection system supplements the check rules, supplements the reasons for not adopting, false positive scenarios, related businesses, and design documents, so that the prompt engineering can independently learn and add rules, thereby continuously improving the accuracy of code checking.

[0163] Optionally, when the adoption rate of the target detection result does not reach the preset standard, the system generates a warning or notification, which aims to remind the development and maintenance team to re-examine the preset static rules and / or preset model rules. The role of this step is as follows:

[0164] (1) Improve the accuracy of code detection: By monitoring the adoption rate and providing prompt information, the system can continuously monitor the effectiveness of rules and models, prompting continuous optimization of rules and models, thereby improving the accuracy of code detection.

[0165] (2) Enhance rule adaptability: Prompt information prompts the development team to adjust static rules and model rules based on actual user feedback, ensuring that rules can better adapt to changing project requirements and coding standards.

[0166] (3) Automated feedback mechanism: This step establishes an automated feedback mechanism that can identify and report the shortcomings of rules and models in a timely manner, providing data support for subsequent iteration and optimization.

[0167] In summary, the feedback adoption rate mechanism promotes the continuous iteration and optimization of rules and models, ensuring that the target model can adapt to changing project requirements and coding standards, thereby improving the overall efficiency of the software development process and code quality.

[0168] From the above, it can be seen that the present application adopts a combination of abstract syntax tree and large model analysis, through static analysis of the abstract syntax tree of the target code, and using a large model to intelligently detect the maintainability, input data / output data and business logic of the target code, the purpose of improving the detection accuracy of the target code is achieved, thereby realizing the technical effects of precise code quality evaluation and precise code defect positioning.

[0169] Specifically, the present application first performs static data flow analysis and control flow analysis based on the abstract syntax tree to obtain a first detection result, ensuring the basic code specification, then uses a large model trained based on L code samples to perform dynamic analysis on the target code to evaluate the maintainability, data processing and business logic consistency of the target code, and obtains a second detection result, finally, the two types of detection results are summarized to provide comprehensive code quality detection results, thereby effectively reducing the false alarm rate, thereby realizing the technical effect of improving the reliability of the code review of the financial institution, and further solving the technical problems of high false positive rate and low accuracy in detecting program code in the prior art.

[0170] In summary, the present application has the following innovations in terms of technology and function:

[0171] (1) Technically, by continuously feeding back the inspection results and supplementing the training of rules, the inspection accuracy of the present detection system can be continuously improved, and the artificial pressure can be released.

[0172] (2) The visualization report of the statistical push can intuitively feedback the changes of the development quality, facilitate timely decision-making on development strategies, development architecture, personnel capability improvement, and the like, and improve the development capability.

[0173] (3) The constant maintenance of the commonly used code block rules can facilitate the quick joining of new developers in engineering research and development, shorten the learning period, and improve the development efficiency.

[0174] The embodiment of the present application can also provide a code detection device based on a large model. It should be noted that the code detection device based on a large model provided by the embodiment of the present application can be used to execute the code detection method based on a large model provided by the embodiment of the present application. The code detection device based on a large model provided by the embodiment of the present application is introduced as follows.

[0175] According to the embodiment of the present application, a device for implementing the code detection method based on a large model is also provided, Figure 8 is a schematic diagram of an optional code detection device based on a large model according to the embodiment of the present application, as Figure 8 shown, the device comprises a creating unit 801, a first analysis unit 802, a second analysis unit 803, and a determining unit 804.

[0176] Optionally, the creating unit 801 is configured to create an abstract syntax tree based on the target code; the first analysis unit 802 is configured to perform static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code; the second analysis unit 803 is configured to perform dynamic analysis on maintainability, input data / output data, and business logic of the target code through a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer; and the determining unit 804 is configured to determine a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score of the target code, a code defect list, and a code modification suggestion.

[0177] In an optional embodiment, the code detection device based on a large model further comprises a source code acquisition unit, a first processing unit, and a second processing unit.

[0178] Optionally, a source code collecting unit is configured to collect program source code corresponding to a code change request on a preset platform, wherein the code change request corresponds to a request identifier, and the program source code is program code written in at least one programming language; a first processing unit is configured to perform standard processing on the program source code to obtain first code with uniform code format; and a second processing unit is configured to perform comment deletion, code block splitting and sensitive information filtering operations on the first code by using a preset regular expression to obtain target code.

[0179] In an optional embodiment, the first analysis unit 802 includes a flow graph creating subunit, a first analysis subunit and a first determination subunit.

[0180] Optionally, the flow graph creating subunit is configured to create a data flow graph and a control flow graph based on node information of the abstract syntax tree, wherein the data flow graph is used to represent a dependency relationship between data in the target code, and the control flow graph is used to represent all paths traversed by the target code in an execution process; the first analysis subunit is configured to analyze the data flow graph and the control flow graph based on preset static rules to obtain a first code quality sub-score, a first code defect sub-list and a first code modification sub-suggestion, wherein the preset static rules are used to detect at least a reference package, an exception throwing manner, a variable scope, a variable data flow direction, a conditional branch, a loop structure and an interface type of the target code; and the first determination subunit is configured to take the first code quality sub-score, the first code defect sub-list and the first code modification sub-suggestion as the first detection result.

[0181] In an optional embodiment, the second analysis unit 803 includes a second analysis subunit, a first processing subunit, a second processing subunit, a second determination subunit and a third analysis subunit.

[0182] Optionally, the second analysis subunit is configured to perform lexical analysis on the target code by using a target model to obtain a first word sequence after the target code is input to the target model; the first processing subunit is configured to perform tokenization processing on the first word sequence to obtain a second word sequence, wherein the tokenization processing is used to uniformly process identifiers and characters in the target code; the second processing subunit is configured to perform subword segmentation processing on the second word sequence to obtain a target word, wherein the subword segmentation processing is used to separate processing on keywords and operators in the target code, and the target word includes the keywords and the operators; the second determination subunit is configured to determine a preset model rule hit by the target code based on the target word, wherein the preset model rule is used to at least perform maintainability evaluation on the target code, perform business logic consistency verification on the target code and detect integrity of an input / output communication area of the target code; and the third analysis subunit is configured to perform dynamic analysis on the target code based on the preset model rule to obtain a second detection result.

[0183] In an optional embodiment, the third analysis subunit comprises an analysis module and a determination module.

[0184] Optionally, the analysis module is configured to analyze the target code based on preset model rules to obtain a second code quality sub-score, a third code quality sub-score, a second code defect sub-list, and a second code modification sub-suggestion, wherein the second code quality sub-score is used to represent the integrity and business logic consistency of the target code, and the third code quality sub-score is used to represent the maintainability of the target code; and the determination module is configured to take the second code quality sub-score, the third code quality sub-score, the second code defect sub-list, and the second code modification sub-suggestion as the second detection result.

[0185] In an optional embodiment, the determination unit 804 comprises a first merging subunit, a second merging subunit, a third determination subunit, a weighted summation subunit, and a fifth determination subunit.

[0186] Optionally, the first merging subunit is configured to merge the first code defect sub-list in the first detection result and the second code defect sub-list in the second detection result to obtain a code defect list of the target code; the second merging subunit is configured to merge the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result to obtain a code modification suggestion of the target code; the third determination subunit is configured to determine a fourth code quality sub-score based on the target code modification suggestion, wherein the fourth code quality sub-score is used to represent the adoption rate of the target modification suggestion by the user; the weighted summation subunit is configured to perform weighted summation on the first code quality sub-score in the first detection result, the second code quality sub-score in the second detection result, the third code quality sub-score, and the fourth code quality sub-score to obtain a code quality score of the target code; and the fifth determination subunit is configured to take the code defect list, the code modification suggestion, and the code quality score of the target code as the target detection result.

[0187] In an optional embodiment, the large model-based code detection apparatus comprises a generation unit.

[0188] Optionally, the generation unit is configured to generate a prompt information in a case where the adoption rate of the target code modification suggestion is less than or equal to a preset adoption rate, wherein the prompt information is used to prompt the developer to update the preset static rules and / or the preset model rules.

[0189] From the above, the application adopts the mode of combining abstract syntax tree and large model analysis, performs static analysis on the abstract syntax tree of the target code, uses the large model to intelligently detect the maintainability of the target code, input data / output data and business logic, achieves the purpose of improving the detection accuracy of the target code, and thus realizes the technical effects of precise code quality evaluation and precise code defect positioning.

[0190] Specifically, the application first performs static data flow analysis and control flow analysis based on the abstract syntax tree to obtain a first detection result, ensures the basic code specification, then uses the large model trained based on L code samples to perform dynamic analysis on the target code, evaluates the maintainability of the target code, data processing and business logic consistency, obtains a second detection result, finally aggregates the two types of detection results, provides comprehensive code quality detection results, effectively reduces the false alarm amount, realizes the technical effect of improving the reliability of the code review of the financial institution, and solves the technical problems of high false positive rate and low accuracy in the prior art.

[0191] It should be noted that the creation unit 801, the first analysis unit 802, the second analysis unit 803 and the determination unit 804 correspond to steps S201 to S204 in the method embodiment, and the four units have the same instances and application scenarios as the corresponding steps, but are not limited to the disclosed contents in the above embodiments. It should be noted that the above modules or units can be hardware components or software components stored in the memory (for example, the memory 104) and processed by one or more processors (for example, the processors 102a, 102b, …, 102n), and the above modules can also be run in the computer terminal 10 provided in the embodiments as a part of the device.

[0192] The embodiments of the application can also provide an electronic device, Figure 9 is a structural block diagram of an electronic device according to an embodiment of the application, as Figure 9 shown, the electronic device includes one or more (only one in the figure) processors 902, a memory 904, a storage controller, and a peripheral interface, wherein the peripheral interface is connected with a radio frequency module, an audio module and a display. Figure 9

[0193] ​The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the method and device in the embodiments of the present application. The processor executes various functions and data processing by running the software programs and modules stored in the memory, that is, implements the above method. The memory can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0194] The processor can call information and applications stored in the memory through the transmission device to perform the following steps: creating an abstract syntax tree based on the target code; performing static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code; performing dynamic analysis on maintainability, input data / output data, and business logic of the target code through a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer; and determining a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score, a code defect list, and a code modification suggestion of the target code.

[0195] By adopting the embodiments of the present application, a code detection scheme based on a large model is provided. By adopting the way of combining abstract syntax tree and large model analysis, through static analysis on the abstract syntax tree of the target code, and by using the means of intelligent detection of the large model on the maintainability, input data / output data, and business logic of the target code, the purpose of improving the detection accuracy of the target code is achieved, thereby realizing the technical effects of accurate code quality evaluation and accurate code defect positioning.

[0196] Specifically, the present application first performs static data flow analysis and control flow analysis based on the abstract syntax tree to obtain a first detection result, ensuring the basic code specification, then uses a large model trained based on L code samples to perform dynamic analysis on the target code to evaluate the maintainability, data processing, and business logic consistency of the target code, obtains a second detection result, and finally aggregates the two types of detection results to provide comprehensive code quality detection results, thereby effectively reducing the false alarm amount, realizing the technical effect of improving the reliability of code review of financial institutions, and solving the technical problems of high false positive rate and low accuracy in detecting program code in the prior art.

[0197] Those skilled in the art can understand that, Figure 9 The structure shown is only schematic, and the electronic device can also be a smart phone, a tablet computer, a palm computer, a mobile Internet device, a PAD, and the like. Figure 9 It does not limit the structure of the electronic device. For example, the electronic device can further include more or fewer components (such as a network interface, a display device, and the like) than those shown in the figure, or have a different configuration from that shown in the figure. Figure 9 Figure 9 The person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device by a program, and the program can be stored in a computer readable storage medium, which can include a flash disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like.

[0198] The embodiments of the present application can also provide a storage medium.

[0199] The embodiments of the present application can also provide a storage medium.

[0200] Optionally, in the embodiments of the present application, the storage medium can be used to save the program code executed by the code detection method based on a large model provided by the method embodiments.

[0201] Optionally, in the embodiments of the present application, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0202] The present application also provides a computer program product adapted to execute the steps of the code detection method based on a large model when executed on a data processing device.

[0203] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0204] In the above embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0205] ​In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other ways. Among them, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, units or modules, and can be electrical or other forms.

[0206] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0207] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0208] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0209] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled persons in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.< / num> < / identifier> < / num> < / str> < / str> < / num>

Claims

1. A large model-based code detection method, characterized in that, Comprise: Create an abstract syntax tree based on the target code; Static analysis of the target code based on node information of the abstract syntax tree, obtaining a first detection result, wherein the static analysis is used to detect the data flow and control flow of the target code; Through the target model, the maintainability, input data / output data and business logic of the target code are dynamically analyzed, and a second detection result is obtained, wherein the target model is a large language model trained based on L code samples, and L is a positive integer; Based on the first detection result and the second detection result, the target detection result of the target code is determined, wherein the target detection result at least includes the code quality score, the code defect list and the code modification suggestion of the target code.

2. The large model-based code detection method according to claim 1, wherein, Before creating an abstract syntax tree based on the target code, the code detection method based on a large model comprises: Collecting program source code corresponding to a code change request on a preset platform, wherein the code change request corresponds to a request identifier, and the program source code is a program code written in at least one programming language; The program source code is processed to obtain a first code with uniform code format; Through a preset regular expression, the first code is executed to delete comments, split code blocks, and filter sensitive information to obtain the target code.

3. The large model-based code detection method of claim 1, wherein, Based on the node information of the abstract syntax tree, the target code is statically analyzed to obtain a first detection result, comprising: Based on the node information of the abstract syntax tree, a data flow graph and a control flow graph are created, wherein the data flow graph is used to represent the dependency relationship between data in the target code, and the control flow graph is used to represent all paths traversed in the execution process of the target code; Based on a preset static rule, the data flow graph and the control flow graph are analyzed to obtain a first code quality sub-score, a first code defect sub-list and a first code modification sub-suggestion, wherein the preset static rule is at least used to detect the reference package, the exception throwing mode, the variable scope, the variable data flow, the conditional branch, the loop structure and the interface type of the target code; The first code quality sub-score, the first code defect sub-list and the first code modification sub-suggestion are taken as the first detection result.

4. The large model-based code detection method of claim 1, wherein, Through the target model, the maintainability, input data / output data and business logic of the target code are dynamically analyzed, and a second detection result is obtained, comprising: After inputting the target code into the target model, the target code is lexically analyzed by the target model to obtain a first word sequence; The first word sequence is tokenized to obtain a second word sequence, wherein the tokenization processing is used to uniformly process identifiers and characters in the target code; The second word sequence is processed by sub-word segmentation to obtain a target word, wherein the sub-word segmentation processing is used to separate the keywords and operators in the target code, and the target word includes the keywords and operators; determine a preset model rule hit by the target code based on the target word, wherein the preset model rule is used at least for maintainability evaluation of the target code, business logic consistency verification of the target code, and integrity detection of an input / output communication area of the target code; perform dynamic analysis on the target code based on the preset model rule to obtain the second detection result.

5. The large model-based code detection method according to claim 4, characterized in that, perform dynamic analysis on the target code based on the preset model rule to obtain the second detection result, including: perform analysis on the target code based on the preset model rule to obtain a second code quality sub-score, a third code quality sub-score, a second code defect sub-list, and a second code modification sub-suggestion, wherein the second code quality sub-score is used to represent integrity and business logic consistency of the target code, and the second code quality sub-score is used to represent maintainability of the target code; take the second code quality sub-score, the third code quality sub-score, the second code defect sub-list, and the second code modification sub-suggestion as the second detection result.

6. The large model-based code detection method according to claim 1, wherein, determine a target detection result of the target code based on the first detection result and the second detection result, including: merge a first code defect sub-list in the first detection result and a second code defect sub-list in the second detection result to obtain a code defect list of the target code; merge a first code modification sub-suggestion in the first detection result and a second code modification sub-suggestion in the second detection result to obtain a code modification suggestion of the target code; determine a fourth code quality sub-score based on the target code modification suggestion, wherein the fourth code quality sub-score is used to represent a user adoption rate of the target modification suggestion; perform weighted summation on a first code quality sub-score in the first detection result, a second code quality sub-score in the second detection result, a third code quality sub-score, and the fourth code quality sub-score to obtain a code quality score of the target code; take the code defect list, the code modification suggestion, and the code quality score of the target code as the target detection result.

7. The large model-based code detection method of claim 6, wherein, after merging the first code modification sub-suggestion in the first detection result and the second code modification sub-suggestion in the second detection result to obtain a target code modification suggestion, the code detection method based on a large model includes: in a case where the adoption rate of the target code modification suggestion is less than or equal to a preset adoption rate, generate a prompt information, wherein the prompt information is used to prompt a developer to update a preset static rule and / or a preset model rule. 8.A large model-based code detection apparatus, characterized by, including: a creating unit configured to create an abstract syntax tree based on a target code; a first analysis unit configured to perform static analysis on the target code based on node information of the abstract syntax tree to obtain a first detection result, wherein the static analysis is used to detect data flow and control flow of the target code; A second analysis unit is configured to perform dynamic analysis on maintainability, input data / output data, and business logic of the target code by using a target model to obtain a second detection result, wherein the target model is a large language model trained based on L code samples, and L is a positive integer. A determination unit is configured to determine a target detection result of the target code based on the first detection result and the second detection result, wherein the target detection result at least includes a code quality score, a code defect list, and a code modification suggestion of the target code.

9. A computer program product, characterised in that, The computer program product includes a computer program, wherein the computer program controls the computer program product to execute the large model-based code detection method in any one of claims 1 to 7 when the computer program runs.

10. An electronic device, comprising: The computer program product includes one or more processors and a memory, and the memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the large model-based code detection method in any one of claims 1 to 7.

Images