Code checking method and device

Abstract

The invention discloses a code checking method and device, and relates to the technical field of code checking. The method comprises the following steps: taking a to-be-checked code; based on a plurality of preset code inspection rules, performing static analysis on the to-be-inspected code to obtain a first inspection result set corresponding to the to-be-inspected code; on the basis of the multiple code inspection rules, the to-be-inspected code is inspected through a pre-trained large language model, and a second inspection result set corresponding to the to-be-inspected code is obtained; and fusing the first check result set and the second check result set based on the confidence corresponding to the code check rule to obtain a third check result set. According to the method and the device, the function shortages of static code checking are avoided, the method and the device do not need to depend on simulation execution which is easily influenced by environmental differences, the problem that code detection is poor in comprehensiveness and accuracy in the prior art is effectively solved, and the comprehensiveness and accuracy of code checking are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of code checking, in particular to a code checking method and device. BACKGROUND

[0002] In the data research and development process, code is the core carrier for implementing data processing logic and business calculation rules, and the quality of the code directly determines the accuracy of the data processing result, the stability of the system operation and the research and development efficiency. If the code has syntax errors, logic defects, security compliance risks, performance hazards, etc., it may cause problems such as database execution bottleneck, data precision loss, sensitive data leakage, and even system abnormal crash in the production environment, which not only causes repeated consumption of research and development resources, but also may cause business losses. Therefore, efficient and comprehensive pre-checking of the code is a key link for early risk identification, code quality assurance and production failure probability reduction.

[0003] In the current technology, there are two common code checking methods: one is static code checking, which does not need to run the code, generates an abstract syntax tree (AST) by parsing the code, analyzes the syntax structure, potential security vulnerabilities and performance problems of the code, and can find defects at the syntax level in advance; the other is simulation execution code checking, which analyzes the query plan by simulating the execution process of the code to check the code.

[0004] However, in the current technology, static code checking cannot detect the logical correctness and runtime errors of the code, and simulation execution code checking has differences between the simulation environment and the actual environment, resulting in deviations between the checking results and the actual execution. Therefore, the comprehensiveness and accuracy of code checking in the current technology are poor. SUMMARY

[0005] To solve the above problems, the present application provides a code checking method and device to perform static analysis on the code based on a plurality of preset code checking rules to obtain a first set of checking results, and then use a pre-trained large language model to check the code to obtain a second set of checking results containing rule identifiers, problem code identifiers and confidence levels, so as to make up for the defects of static checking that cannot detect logical correctness and runtime errors. Then, the third set of checking results is obtained by combining the confidence levels and fusing the two types of results, which not only avoids the functional shortcomings of static code checking, but also does not need to rely on simulation execution which is easily affected by environmental differences. The problem of poor comprehensiveness and accuracy of code detection in the current technology is effectively solved, and the comprehensiveness and accuracy of code checking are greatly improved.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] In a first aspect, the embodiments of the present application provide a code checking method, comprising:

[0008] obtaining to-be-checked code;

[0009] performing static analysis on the to-be-checked code based on a plurality of preset code checking rules to obtain a first checking result set corresponding to the to-be-checked code; wherein the first checking result set comprises first checking results corresponding to the plurality of code checking rules respectively;

[0010] performing checking on the to-be-checked code based on the plurality of code checking rules through a pre-trained large language model to obtain a second checking result set corresponding to the to-be-checked code; wherein the second checking result set comprises second checking results corresponding to the plurality of code checking rules respectively, and the second checking result comprises an identifier of the code checking rule, an identifier of code violating the code checking rule, and a confidence corresponding to the code checking rule;

[0011] fusing the first checking result set and the second checking result set based on the confidence corresponding to the code checking rule to obtain a third checking result set.

[0012] In a possible implementation, the fusing the first checking result set and the second checking result set based on the confidence corresponding to the code checking rule to obtain a third checking result set comprises:

[0013] for each code checking rule, determining whether the confidence corresponding to the code checking rule in the second checking result is greater than a confidence threshold corresponding to the code checking rule;

[0014] when the confidence corresponding to the code checking rule is greater than the confidence threshold corresponding to the code checking rule, performing a union set processing on the first checking result and the second checking result corresponding to the code checking rule to obtain a third checking result corresponding to the code checking rule;

[0015] when the confidence corresponding to the code checking rule is not greater than the confidence threshold corresponding to the code checking rule, taking the first checking result corresponding to the code checking rule as the third checking result corresponding to the code checking rule.

[0016] In a possible implementation, for each confidence threshold corresponding to the code checking rule, the confidence threshold is obtained through a Q-Learning algorithm.

[0017] In a possible implementation, for each confidence threshold corresponding to the code checking rule, the confidence threshold is obtained through the following way:

[0018] S401, triggering the Q-Learning training process of the confidence threshold when the accumulated labeled data reaches a preset number of data; wherein the labeled data is obtained by manually marking whether the third inspection result is correct or incorrect;

[0019] S402: selecting an adjustment action for the current confidence threshold using a greedy strategy, wherein the adjustment action includes increasing the threshold, decreasing the threshold, and keeping it unchanged;

[0020] S403: adjusting the current confidence threshold according to the selected adjustment action to obtain an adjusted confidence threshold, and re-inspecting the accumulated labeled data based on the adjusted confidence threshold to obtain an error rate corresponding to the adjusted confidence threshold;

[0021] S404: based on the error rate corresponding to the adjusted confidence threshold, calculating the reward value of the adjusted confidence threshold, and updating the reward value to the reward value table; wherein the reward value of the adjusted confidence threshold is: the reward value corresponding to the current confidence threshold and the selected adjustment action in the reward value table;

[0022] S405: taking the adjusted confidence threshold as the current confidence threshold, repeating S402-S405;

[0023] S406: when the Q-Learning training reaches a preset condition, stopping the Q-Learning training, and updating the confidence threshold to the confidence threshold corresponding to the maximum reward value selected from the reward value table.

[0024] In a possible implementation, the preset plurality of code inspection rules include an inspection mode identifier, the mode identifier includes a first identifier and a second identifier, the first identifier indicates that the code inspection rules are inspected by a pre-trained large language model, and the second identifier indicates that the code inspection rules are not inspected by a pre-trained large language model; based on the plurality of code inspection rules, the pre-trained large language model is used to inspect the code to be inspected to obtain a second inspection result set corresponding to the code to be inspected, including:

[0025] Based on the code inspection rule with the first identifier of the inspection mode identifier, the pre-trained large language model is used to inspect the code to be inspected to obtain a second inspection result set corresponding to the code to be inspected; wherein the second inspection result corresponding to the code inspection rule with the second identifier of the inspection mode identifier in the second inspection result set is empty.

[0026] In a possible implementation, the fusing the first set of check results and the second set of check results based on the confidence corresponding to the code check rule to obtain a third set of check results comprises:

[0027] For the code check rule whose check mode identifier is the first identifier, the first check result and the second check result corresponding to the code check rule are fused based on the confidence corresponding to the code check rule to obtain a third check result corresponding to the code check rule.

[0028] For the code check rule whose check mode identifier is the second identifier, the third check result corresponding to the code check rule is obtained based on the first check result corresponding to the code check rule.

[0029] The third set of check results is obtained based on the third check result corresponding to each of the plurality of code check rules.

[0030] In a possible implementation, the obtaining the second set of check results corresponding to the to-be-checked code based on the plurality of code check rules by using the pre-trained large language model comprises:

[0031] The target prompt word corresponding to the plurality of code check rules and the to-be-checked code are input to the pre-trained large language model, so that the pre-trained large language model checks the to-be-checked code based on the plurality of code check rules in response to the target prompt word, and outputs the second set of check results corresponding to the to-be-checked code; wherein the target prompt word is a prompt word set in advance based on the plurality of code check rules by prompt word engineering.

[0032] In a possible implementation, the code check rule comprises an identifier, a type, a description, an improvement suggestion, and a management action of the code check rule; the third set of check results comprises the third check result corresponding to each of the plurality of code check rules, and the second check result comprises an identifier of the code check rule and an identifier of code that violates the code check rule; after the fusing the first set of check results and the second set of check results based on the confidence corresponding to the code check rule to obtain a third set of check results, the method further comprises:

[0033] Based on the multiple code inspection rules, the third inspection result corresponding to the code inspection rule is associated with the improvement suggestions and management actions of the code inspection rule to generate a fourth inspection result set corresponding to the code to be inspected; wherein, the fourth inspection result set includes: the fourth inspection result corresponding to each of the multiple code inspection rules, and the fourth inspection result includes: the identifier of the code inspection rule, the identifier of the code that violates the code inspection rule, and the improvement suggestions and management actions of the code inspection rule.

[0034] In one possible implementation, after generating the fourth set of inspection results corresponding to the code to be inspected, the method further includes:

[0035] Based on the management actions corresponding to the code inspection rules in the fourth inspection result set, match the management action commands corresponding to the management actions;

[0036] In response to the management action command corresponding to the management action, a corresponding preset hook is invoked so that the preset hook can execute the management action.

[0037] Secondly, embodiments of this application provide a code inspection apparatus, including:

[0038] The code acquisition module is used to acquire the code to be inspected.

[0039] The static analysis module is used to perform static analysis on the code to be inspected based on multiple preset code inspection rules, and obtain a first inspection result set corresponding to the code to be inspected; wherein, the first inspection result set includes first inspection results corresponding to the multiple code inspection rules respectively:

[0040] The model inspection module is used to inspect the code to be inspected based on the multiple code inspection rules and through a pre-trained large language model to obtain a second inspection result set corresponding to the code to be inspected; wherein, the second inspection result set includes second inspection results corresponding to the multiple code inspection rules respectively, and the second inspection result includes: the identifier of the code inspection rule, the identifier of the code that violates the code inspection rule, and the confidence level corresponding to the code inspection rule;

[0041] The result fusion module is used to fuse the first inspection result set and the second inspection result set based on the confidence level corresponding to the code inspection rule to obtain a third inspection result set.

[0042] Compared with the prior art, the present application has the following beneficial effects: the static check fully plays the stable accuracy of the static check in basic problems such as syntax errors and safety compliance, and retains the advantages of the static check; the large language model has strong generalization ability and pattern recognition ability to load, to make up for the defects that the static check cannot detect logical correctness and runtime errors, and even cover the basic scene, improve the coverage of code checking; the third checking result set is obtained by fusing the first checking result set and the second checking result set with the confidence, the confidence quantifies the reliability of the second checking result output by the large language model, which not only avoids the functional short board of the static code check, but also does not need to rely on the simulation execution which is easily affected by environmental differences, effectively solving the problems of poor comprehensiveness and accuracy of code detection in the current technology, and greatly improving the comprehensiveness and accuracy of code checking. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0044] Figure 1 A flowchart of a code checking method provided by an embodiment of the present application;

[0045] Figure 2 A flowchart of a training process of a large language model provided by an embodiment of the present application;

[0046] Figure 3 An example diagram of a target prompt word provided by an embodiment of the present application;

[0047] Figure 4 A flowchart of a Q-Learning training process provided by an embodiment of the present application;

[0048] Figure 5 A flowchart of another code checking method provided by an embodiment of the present application;

[0049] Figure 6 A structural diagram of a code checking device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0050] As described above, one common code inspection method in the prior art is static code inspection, which does not require running the code, generates an abstract syntax tree by parsing the code, analyzes the syntax structure, potential security vulnerabilities and performance problems of the code, and can find syntax-level defects, but cannot check the logical correctness of the code and runtime errors, resulting in incomplete code inspection.

[0051] Another common code inspection method in the prior art is simulation execution code inspection, for example, for SQL operation code, the execution process of the SQL operation in the database is simulated to analyze the execution process and implement inspection of the SQL operation code (such as judging whether appropriate indexes are used, whether there are performance bottlenecks such as full table scanning, etc.). However, there are differences between the simulation environment and the actual environment (such as differences in data volume, system load, etc.), resulting in inaccurate inspection results obtained by simulation execution code inspection.

[0052] Therefore, the comprehensiveness and accuracy of code inspection in the prior art are poor.

[0053] Further, another common code inspection method in the prior art is to verify the code through test cases, specifically, the functional correctness, interface compatibility, etc. of the code are verified through test cases. However, the coverage of test cases is limited to the designed scenarios, and all inputs and boundary conditions are covered, resulting in poor comprehensiveness of code inspection.

[0054] The present application provides a code inspection method, comprising: obtaining a code to be inspected; based on a plurality of preset code inspection rules, performing static analysis on the code to be inspected to obtain a first inspection result set corresponding to the code to be inspected; based on the plurality of code inspection rules, performing inspection on the code to be inspected through a pre-trained large language model to obtain a second inspection result set corresponding to the code to be inspected; and based on a confidence corresponding to the code inspection rule, fusing the first inspection result set and the second inspection result set to obtain a third inspection result set. In the present application, the code is statically analyzed based on the plurality of preset code inspection rules to obtain the first inspection result set, and then the code is inspected using the pre-trained large language model to obtain the second inspection result set containing rule identifiers, problem code identifiers and confidence, to make up for the defects that static inspection cannot detect logical correctness and runtime errors. Subsequently, the third inspection result set is obtained by fusing the two types of results in combination with the confidence, which not only avoids the functional shortcomings of static code inspection, but also does not rely on simulation execution which is easily affected by environmental differences, effectively solving the problem of poor comprehensiveness and accuracy of code detection in the prior art, and greatly improving the comprehensiveness and accuracy of code inspection.

[0055] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0056] Embodiment one:

[0057] In the following, a code checking method provided by the embodiments of the present application will be described in detail. Figures 1-4

[0058] As shown in the figure, the code checking method provided by the embodiments of the present application includes the following steps: Figure 1

[0059] S101, obtaining the code to be checked.

[0060] The code to be checked refers to various data application codes for implementing data processing logic (such as data query, calculation, storage, and flow).

[0061] Specifically, the code to be checked includes multiple lines of code, and each line of code has a corresponding identifier. For example, the line number of each line of code is its identifier.

[0062] S102, based on a plurality of preset code checking rules, performing static analysis on the code to be checked to obtain a first checking result set corresponding to the code to be checked.

[0063] The first checking result set includes first checking results corresponding to the plurality of code checking rules respectively. For example, the plurality of code checking rules include code checking rule A1, code checking rule A2, and code checking rule A3, and the first checking result set includes first checking result a1 corresponding to code checking rule A1, first checking result a2 corresponding to code checking rule A2, and first checking result a3 corresponding to code checking rule A3.

[0064] Specifically, the first checking result includes the identifier of the code checking rule and the code identifier (code line number) that violates the code checking rule.

[0065] In one possible implementation, the code checking rule includes the identifier of the code checking rule, the type, the description, the improvement suggestion, and the management action.

[0066] The identifier of the code checking rule is a landmark information that uniquely distinguishes each code checking rule, which is used to accurately locate the code checking rule. For example, the identifier of the code checking rule can be the name of the code checking rule. ​​

[0067] The type of the code inspection rule is classified according to the attribute of the code problem to which the code inspection rule is directed. Exemplarily, the types of the code inspection rule include: syntax error, security compliance, logic error, performance optimization, and the like.

[0068] The description of the code inspection rule is a detailed explanation of the cause, manifestation, and potential harm of the code problem to which the code inspection rule is directed, and is used to clarify the use scenario and judgment basis of the code inspection rule. Exemplarily, the description of the code inspection rule “SQL keyword error” is: an SQL statement incorrectly spells or misuses a database reserved keyword (such as writing SELECT as SELCT or FROM as FORM), which causes the database engine to fail to recognize and execute the code.

[0069] The improvement suggestion of the code inspection rule is the correction guide information when the code violates the code inspection rule, which is used to provide clear problem rectification direction for the developer and help quickly fix the code violating the code inspection rule.

[0070] The management action of the code inspection rule is a processing measure triggered when the code violates the code inspection rule, which is used to control the flow of the code violating the code inspection rule through the management action, so as to avoid the code violating the code inspection rule from entering the production environment or prompt the risk in time. Exemplarily, the management actions of the code inspection rule include: interception, prompt, manual review, and the like, such as “SQL keyword error” and “unauthorized deletion of database” triggering “interception” (block the code release, and need to be modified and resubmitted); “data precision loss” triggering “prompt” (only remind the risk, and do not block the flow); and some complex or manually determined problems triggering “manual review” (generate an approval process, and whether the code is allowed to pass is determined by the administrator).

[0071] In the embodiment of the present application, the user sets a plurality of code inspection rules according to the structure of <identification, type, description, improvement suggestion, and management action> in advance. In order to facilitate understanding, three code inspection rules will be introduced in detail below in combination with Table 1.

[0072] Table 1

[0073]

[0074] Specifically, based on the preset plurality of code inspection rules, the static analysis of the to-be-inspected code can be: for syntax analysis related inspection, performing lexical analysis and syntax analysis on the to-be-inspected code to generate an abstract syntax tree (AST) corresponding to the code; then traversing the statement structure, field association, data type conversion and other nodes of the AST, and matching the preset plurality of code inspection rules one by one; for security compliance related inspection, using the regular expression in the code inspection rule to match the plaintext storage or desensitization-free scene of sensitive data in the to-be-inspected code, or checking whether the table accessed in the to-be-inspected code meets the permission requirement by comparing the environment-table-permission mapping relationship in the code inspection rule; for performance related inspection, parsing the to-be-inspected code to obtain its corresponding execution plan, and combining historical execution statistical data to determine whether the code inspection rule is met.

[0075] S103, based on the plurality of code inspection rules, the to-be-inspected code is inspected by the pre-trained large language model, and a second inspection result set corresponding to the to-be-inspected code is obtained.

[0076] Among them, the second inspection result set includes a second inspection result corresponding to each of the plurality of code inspection rules.

[0077] Specifically, the second inspection result includes: the identifier of the code inspection rule, the identifier of the code violating the code inspection rule, and the confidence corresponding to the code inspection rule.

[0078] Confidence is a quantitative indicator of the certainty of the model's prediction, reflecting the "confidence" of the model's output, and is used to represent the certainty of the model's prediction / output.

[0079] For ease of understanding, the following will be introduced by way of example Figure 2 The pre-trained large language model is obtained in the following way:

[0080] S201, based on the model capability, model size and resource demand and open source, selecting a basic large language model from a candidate model pool.

[0081] Among them, the candidate model pool is a model pool formed by screening open source large models that perform well in code tasks with code understanding and error checking ability as the core standard. For example, the candidate model pool includes CodeLlama-34B, DeepSeek-Coder-33B, StarCoder2-15B, Qwen-14B, etc.

[0082] Specifically, the CodeLlama-34B model focuses on code generation and completion, and is optimized for SQL syntax analysis and logical error identification, but has high resource consumption. The DeepSeek-Coder-33B model is good at code logic reasoning, with an accuracy rate of 92% in code security compliance tasks, but requires additional adaptation of enterprise SQL dialect; the StarCoder2-15B model is a lightweight code model that supports multi-language code syntax checking and has fast response speed, but has low coverage for complex logic detection; the Qwen-14B model is a domestic open source model that has more accurate understanding of Chinese annotations and naming conventions, and is suitable for enterprise code with Chinese context.

[0083] wherein the model capability refers to the accuracy and coverage of the large language model in code understanding and error detection. For example, by testing the accuracy, false positive rate and false negative rate of error checking of each model through 1000 SQL code samples with errors, the model capability of the model is measured.

[0084] wherein the model size and resource requirement refers to the size (magnitude) of the large language model and the computing resources required by the large language model. Generally, a large-scale large language model has higher performance and requires more computing resources. Therefore, a large language model with appropriate size needs to be selected according to the computing environment and budget of code checking.

[0085] wherein the open source refers to whether the large language model supports fine-tuning. In the embodiments of the present application, the large language model supporting fine-tuning is preferred.

[0086] S202, collect sample data to obtain a data set.

[0087] Specifically, multi-source code data is collected, for example, a large amount of code data is collected from enterprise code libraries and open source code libraries, etc. These code data cover multiple error types. Each code data is manually annotated to indicate the errors existing in the code data and to give correct code examples, for example, each code data is annotated with "rule type + error location + confidence + correction suggestion" to obtain sample data, thereby obtaining a database. The database is divided into a training set, a validation set and a test set. Generally, 75% of the sample data in the database is used as the training set, 15% of the sample data is used as the validation set, and 10% of the sample data is used as the test set.

[0088] S203, train the base large language model using the training set and evaluate it using the validation set, thereby obtaining a pre-trained large language model.

[0089] Specifically, a suitable fine-tuning framework is selected and fine-tuning parameters are set. The training set is then input into the base large language model for training. The base large language model is fine-tuned, and the fine-tuned large language model is evaluated using a validation set until the evaluation meets the requirements of a large language model, resulting in a pre-trained large language model. The fine-tuning parameters include: learning rate, batch size, and number of training epochs.

[0090] The above combination Figure 2 This application details how the pre-trained large language model is obtained in its embodiments. The following section will continue with... Figure 1 This application introduces a code inspection method provided by an embodiment.

[0091] In one possible implementation, target prompts corresponding to multiple code inspection rules and the code to be inspected are input into a pre-trained large language model, so that the pre-trained large language model, in response to the target prompts, inspects the code to be inspected based on multiple code inspection rules and outputs a second set of inspection results corresponding to the code to be inspected.

[0092] In one possible implementation, the pre-trained large language model also has a timeout check function. If the pre-trained large language model does not output a second check result set within the timeout threshold, the pre-trained large language model directly outputs an empty result.

[0093] Among them, the target prompt words are prompt words that are pre-set through the prompt word project based on multiple code inspection rules.

[0094] Cue word engineering refers to the design, optimization, and adjustment of text instructions input to large language models. Through carefully constructed instruction logic, the model is guided to understand task objectives, focus on core requirements, and ultimately generate output that conforms to the user's expected format and content. This allows large language models to complete different types of tasks and defines the output format of large language models without updating model weights. For example, target cue words can be designed, optimized, and adjusted according to common cue word frameworks (such as CO-STAR, LangGPT, and RTF) and multiple code inspection rules.

[0095] To make it easier to understand, the following will be combined with... Figure 3 For example, a target prompt word is described, which is designed for checking SQL syntax error rules and is constructed through four modules: "role-target-restriction-step".

[0096] like Figure 3As shown, the role module sets the professional identity of the model through the instruction "You are a senior data code inspector with years of experience in handling complex SQL queries, and you are familiar with SQL syntax, good at debugging and optimizing SQL statements", guides the model to understand the task from the perspective of "code inspection expert", and avoids insufficient inspection depth due to ambiguous identity positioning (such as only detecting basic syntax errors and ignoring detailed problems such as "keyword case error").

[0097] As shown in Figure 3 The target module clearly defines the core of the code inspection task as "ensuring that the SQL statement is completely correct in syntax and logic", and focuses on "SQL keyword error (spelling / case / misuse), symbol missing (semicolon / comma / quotation mark / parenthesis)", to clearly define the inspection range for large language models and ensure that the output result does not deviate from the preset rule system.

[0098] As shown in Figure 3 The restriction module eliminates redundant information and historical interference in the model output through the constraint "do not consider previous results, do not need to summarize the answer each time": the former avoids the model from accumulating incorrect cognition due to historical dialogue (such as mistakenly associating the inspection results of other codes to the current code), and the latter prevents the model from outputting "summary text" (such as "a total of 2 types of errors found") that may damage the JSON format, ensuring that the output content only focuses on the problem data.

[0099] As shown in Figure 3 The step module: with the process-oriented instruction "review sentence by sentence, mark error position and type, and summarize according to the specified JSON format", the model's inspection behavior is standardized: "review sentence by sentence" ensures that no errors are missed (such as missing symbol missing problems in multiple-line SQL), "mark error position and type" ensures that the results contain "line number" "rule name" and other key information (matching the field requirements of the second inspection result set in the document), and "specified JSON format" directly defines the output structure, providing a direct basis for "result parsing into an array".

[0100] In the embodiments of the present application, the target prompt word designed through the prompt word engineering can adapt the large language model to specific tasks, avoid the consumption of computing power and time cost caused by model retraining, and ensure that the model output can accurately match the downstream process requirements.

[0101] S104, based on the confidence corresponding to the code inspection rule, fusing the first inspection result set and the second inspection result set, obtaining a third inspection result set.

[0102] Among them, the third inspection result set includes third inspection results corresponding to a plurality of code inspection rules respectively. The third inspection result includes: the identifier of the code inspection rule, the identifier of the code violating the code inspection rule.

[0103] Specifically, for each code inspection rule, it is determined whether the confidence corresponding to the code inspection rule in the second inspection result is greater than the confidence threshold corresponding to the code inspection rule; when the confidence corresponding to the code inspection rule is greater than the confidence threshold corresponding to the code inspection rule, the first inspection result and the second inspection result corresponding to the code inspection rule are processed by set union to obtain the third inspection result corresponding to the code inspection rule; when the confidence corresponding to the code inspection rule is not greater than the confidence threshold corresponding to the code inspection rule, the first inspection result corresponding to the code inspection rule is taken as the third inspection result corresponding to the code inspection rule.

[0104] Each code inspection rule has a corresponding confidence threshold.

[0105] For example, the first inspection result set includes: <code inspection rule A1, code B1>, <code inspection rule A2, code B2>, and <code inspection rule A3, code B3>; the second inspection result set includes: <code inspection rule A1, code B1 and code B2, confidence 85%>, <code inspection rule A2, code B3, confidence 50%>, and <code inspection rule A3, code B4, confidence 95%>; the confidence threshold corresponding to the code inspection rule A1 is 80%, the confidence threshold corresponding to the code inspection rule A2 and code B2 is 70%, and the confidence threshold corresponding to the code inspection rule A3 is 90%. Then, for the code inspection rule A1, the third inspection result is <code inspection rule A1, code B1 and code B2>, for the code inspection rule A2, the third inspection result is <code inspection rule A2, code B2>, and for the code inspection rule A3, the third inspection result is <code inspection rule A3, code B3 and code B4>.

[0106] In the embodiment of the present application, the first inspection result and the second inspection result are fused according to the confidence threshold. When the confidence is less than or equal to the confidence threshold, only the first inspection result is retained, the precision of static analysis in the advantage rule scenario can be completely followed, and at the same time, the low-confidence results of the large model (such as false positives of the “syntax error” rule caused by annotation interference) are avoided from being mixed into the final result, the defect of uncertainty of the large model result is solved, and the detection of basic problems is ensured to be unbiased. When the confidence is greater than the confidence threshold, the first inspection result and the second inspection result are taken by set union. Through the confidence quantification of reliability, the complex problems not detected by static analysis are supplemented to the third inspection result, and the comprehensiveness and accuracy of code inspection are ensured.

[0107] In a possible implementation, for the confidence threshold corresponding to each code inspection rule, the confidence threshold is obtained by dynamically updating the Q-Learning algorithm.

[0108] For the convenience of understanding, the following will introduce in detail how to update the confidence threshold in the embodiments of the present application: Figure 4

[0109] S401, when the accumulated labeled data reaches a preset number, trigger the Q-Learning training process of the confidence threshold.

[0110] Among them, the labeled data is artificially marked whether the third inspection result is correct or wrong. Marking the third inspection result as correct, false positive or false negative.

[0111] In one possible implementation, the user can analyze the error data in the labeled data and determine the cause of the error, for example: understanding bias of the large model, inaccurate target prompt words, unreasonable confidence threshold setting, etc. Further, the user can optimize the target prompt words of the large language model according to the cause of the error.

[0112] Before performing the Q-Learning training process, define the state space, determine the action set, initialize the reward value table and define the reward function.

[0113] Defining the state space means that for each code inspection rule corresponding confidence threshold, the confidence threshold is discretized, for example: a confidence threshold array [0.1, 0.2, 0.3…] is established with a step of 0.1, and each discretized confidence threshold corresponds to an independent state.

[0114] Determine the adjustment action set, the adjustment action includes: increase the threshold, increase the level of the current confidence threshold by 1 (such as the current confidence threshold is 0.3, and after promotion, it is 0.4); Lower threshold: reduce the level of the current confidence threshold by 1 (such as the current confidence threshold is 0.3, and after reduction, it is 0.2); Keep it unchanged: maintain the level of the current confidence threshold without adjustment.

[0115] Initializing the reward value table (Q table) means constructing a two-dimensional table with row identifier state and column identifier action, where element (s, a) represents the expected accumulated reward value of taking action a in state s. If each code inspection rule corresponds to 10 discrete levels of confidence threshold, and the action set contains 3 types of actions, then the Q table is a 10-row 3-column table, and all elements are initially set to 0.

[0116] Defining the reward function is to define the calculation formula of the reward value in advance. In the embodiments of the present application, the reward value can be calculated based on the changes of the false positive rate and the false negative rate, for example: if the false positive rate decreases after taking the action, give a positive reward of +10; if the false negative rate decreases after taking the action, give a positive reward of +15; if the false positive rate or the false negative rate increases after taking the action, give a negative reward of -10.​

[0117] S402, an adjustment action for the current confidence threshold is selected using a greedy strategy.

[0118] Specifically, the adjustment action for the current confidence threshold is selected using a greedy strategy includes: an adjustment action is randomly selected for exploration with a probability of ε, and an adjustment action with the maximum reward value in the current reward value table under the state of the current confidence threshold is selected with a probability of 1-ε.

[0119] S403, the current confidence threshold is adjusted according to the selected adjustment action, to obtain an adjusted confidence threshold, and the accumulated labeled data is rechecked based on the adjusted confidence threshold, to obtain an error rate corresponding to the adjusted confidence threshold.

[0120] Taking an array corresponding to the confidence threshold as [0.1, 0.2, 0.3, 0.4, …] as an example, the current confidence threshold is 0.3, if the adjustment action of increasing the threshold is selected, the adjusted confidence threshold is 0.4; if the adjustment action of reducing the threshold is selected, the adjusted confidence threshold is 0.2; if the adjustment action of keeping unchanged is selected, the adjusted confidence threshold is 0.3.

[0121] For the code checking rule, all the labeled information corresponding to the code checking rule is traversed, and the confidence threshold of each piece of labeled data is determined using the adjusted confidence threshold, and the determination result is compared with the manually labeled true result, to obtain an error rate (including: false positive rate and false negative rate) corresponding to the adjusted confidence threshold.

[0122] S404, the reward value of the adjusted confidence threshold is calculated based on the error rate corresponding to the adjusted confidence threshold, and the reward value is updated to the reward value table.

[0123] The reward value of the adjusted confidence threshold is: the reward value corresponding to the current confidence threshold and the selected adjustment action in the reward value table.

[0124] Specifically, the reward value of the adjusted confidence threshold is calculated based on a pre-defined reward function.

[0125] S405, the adjusted confidence threshold is taken as the current confidence threshold, and S402-S405 are repeated.

[0126] S406, when the Q-Learning training reaches a preset condition, the Q-Learning training is stopped, and the confidence threshold is updated to the confidence threshold corresponding to the maximum reward value selected from the reward value table.

[0127] The preset condition includes that the number of iterations of the Q-Learning reaches a preset number or a maximum variation of the reward value in the reward value table is less than a minimum threshold.

[0128] Specifically, the maximum reward value is selected from the reward value table, and a confidence threshold corresponding to the maximum reward value is determined according to a state (level) corresponding to the maximum reward value and an adjustment action. For example, the confidence threshold corresponding to the maximum reward value is 0.5, the corresponding adjustment action is to reduce the threshold, and the confidence threshold corresponding to the maximum reward value is 0.4.

[0129] In a possible implementation, after obtaining the third set of check results, the third check result corresponding to each code checking rule is associated with the improvement suggestion and the management action of the code checking rule based on the plurality of code checking rules, and a fourth set of check results corresponding to the code to be checked is generated.

[0130] The fourth set of check results includes fourth check results corresponding to the plurality of code checking rules respectively. Specifically, the fourth check result includes the identification of the code checking rule, the identification of the code violating the code checking rule, the improvement suggestion of the code checking rule, and the management action. For example, the fourth check result is: <code checking rule 1, code 1, improvement suggestion 1, management action 1>.

[0131] In a possible implementation, based on the management action corresponding to the code checking rule in the fourth set of check results, a management action command corresponding to the management action is matched; and a corresponding preset hook is called in response to the management action command corresponding to the management action, so that the preset hook executes the management action.

[0132] Specifically, relying on a CICD (Continuous Integration Continuous Deployment) platform, the matching of the management action command and the execution of the management action are implemented.

[0133] Based on the management action corresponding to the code checking rule in the fourth set of check results, a management action command corresponding to the management action is matched by using a mapping relationship library of management action-management action command preset by the CICD platform. In response to the management action command corresponding to the management action, a corresponding preset hook is called, so that the preset hook executes the corresponding management action.

[0134] For example, if the management action is to pass, the matching CICD platform will transfer the code to the next link according to the command, ensuring that the code that does not violate the code checking rules can enter the subsequent release process normally; if the management action is to intercept, the matching CICD platform will block the release of the release package according to the command, and forcibly block the release of the code that violates the code checking rules; if the management action is to manually access, the matching CICD platform will specify the administrator as the approval object according to the command, so as to trigger the manual judgment process; if the management action is to alarm, the matching CICD platform will pop up an alarm notification according to the command, so as to prompt that the code has the risk of violating the code checking rules.

[0135] The code checking method provided in the embodiments of the present application comprises the following steps: obtaining to-be-checked code; performing static analysis on the to-be-checked code based on a plurality of preset code checking rules to obtain a first checking result set corresponding to the to-be-checked code; performing checking on the to-be-checked code based on the plurality of code checking rules by using a pre-trained large language model to obtain a second checking result set corresponding to the to-be-checked code; and fusing the first checking result set and the second checking result set based on a confidence degree corresponding to the code checking rule to obtain a third checking result set. In the embodiments of the present application, the code is statically analyzed based on the plurality of preset code checking rules to obtain the first checking result set, so that the stable accuracy of static checking in basic problems such as syntax errors and security compliance is fully utilized, and the advantages of static checking are retained; and the code is checked by using the pre-trained large language model to obtain the second checking result set containing rule identifiers, code identifiers and confidence degrees. Since the large language model has strong generalization ability and pattern recognition ability, the defects of static checking that cannot detect logical correctness and runtime errors are compensated for, and even basic scenarios are covered, so that the coverage of code checking is improved. The first checking result set and the second checking result set are fused based on the confidence degree to obtain the third checking result set. The confidence degree quantifies the reliability of the second checking result output by the large language model, avoids the functional short board of static code checking, does not need to rely on the simulation execution which is easily affected by environmental differences, effectively solves the problems of poor comprehensiveness and accuracy of code detection in the prior art, and improves the accurate identification ability of code checking for basic problems and the coverage ability of code checking for complex logic and runtime risks, so that the comprehensiveness and accuracy of code checking are greatly improved.

[0136] Embodiment two

[0137] The following Figure 5 , a detailed description of another code checking method provided by the embodiments of the present application is given.

[0138] As Figure 5 shown, the code checking method provided by the embodiments of the present application comprises the following steps:

[0139] S501, obtaining to-be-checked code.

[0140] S502, performing static analysis on the to-be-checked code based on the preset plurality of code checking rules to obtain a first checking result set corresponding to the to-be-checked code.

[0141] The code checking rule includes an identification of the code checking rule, a type, a description, an improvement suggestion, a management action, and an identification of a checking method.

[0142] The identification of the checking method is used to indicate whether the code checking rule is checked by the pre-trained large language model. Specifically, the identification of the checking method is set by an expert in advance for the code checking rule.

[0143] Specifically, the identification of the checking method includes a first identification and a second identification. The first identification indicates that the code checking rule is checked by the pre-trained large language model, and the second identification indicates that the code checking rule is not checked by the pre-trained large language model.

[0144] For some code checking rules, static analysis performs excellently and can stably and accurately detect problems. The large language model has no obvious advantage or even disadvantage. Therefore, the code checking rule does not need to be checked by the pre-trained large language model, which ensures the accuracy of code checking and saves resources.

[0145] It should be noted that S501 and S502 described above are the same as S101 and S102 in Embodiment One, and the specific implementation details of S501 and S502 can be found in the specific implementation of S101 and S102 in Embodiment One, which will not be repeated here.

[0146] S503, for the code checking rule with the first identification of the checking method, checking the to-be-checked code by the pre-trained large language model to obtain a second checking result set corresponding to the to-be-checked code.

[0147] The second checking result set includes a second checking result corresponding to each code checking rule. The second checking result corresponding to the code checking rule with the second identification of the checking method is empty.

[0148] S504, for the code checking rule with the first identification of the checking method, fusing the first checking result and the second checking result corresponding to the code checking rule based on the confidence corresponding to the code checking rule to obtain a third checking result corresponding to the code checking rule.

[0149] For the code inspection rule whose inspection mode identifier is the first identifier, the first inspection result corresponding to the code inspection rule is obtained through the static analysis mode, and the second inspection result corresponding to the code inspection rule is obtained through the pre-trained large language model, so it is necessary to fuse the first inspection result and the second inspection result corresponding to the code inspection rule based on the confidence corresponding to the code inspection rule to obtain the third inspection result corresponding to the code inspection rule.

[0150] S505, for the code inspection rule whose inspection mode identifier is the second identifier, the third inspection result corresponding to the code inspection rule is obtained based on the first inspection result corresponding to the code inspection rule.

[0151] For the code inspection rule whose inspection mode identifier is the first identifier, only the first inspection result corresponding to the code inspection rule is obtained through the static analysis mode, so the first inspection result corresponding to the code inspection rule is the third inspection result corresponding to the code inspection rule.

[0152] S506, based on the third inspection result corresponding to the plurality of code inspection rules respectively, a third inspection result set is obtained.

[0153] In order to facilitate understanding, the following set table 2 shows the code inspection rule, and an example of the code inspection method provided by the embodiment of the application is introduced.

[0154] Table 2

[0155]

[0156] As shown in table 3, it can be known that the inspection mode identifier of rule R1 is the first identifier, indicating that rule R1 is checked through the pre-trained large language model; the inspection mode identifier of rule R2 is the second identifier, indicating that rule R2 is not checked through the pre-trained large language model; the inspection mode identifier of rule R3 is the first identifier, indicating that rule R3 is checked through the pre-trained large language model.

[0157] The code detection method process is as follows: obtaining the code to be checked. Based on rule R1, rule R2 and rule R3, the code to be checked is statically analyzed to obtain a first inspection result set, the first inspection result set includes: the first inspection result S11 corresponding to rule R1, the code I1, the first inspection result S12 corresponding to rule R2, the code I2, and the first inspection result S13 corresponding to rule R3, the code I3. Based on rule R1 and rule R3, the pre-trained large language model is used to check the code to be checked to obtain a second inspection result set, the second inspection result set includes: the second inspection result S21 corresponding to rule R1, the code I4, the confidence C1, the second inspection result S23 corresponding to rule R3, the code I5, and the confidence C2, and the second inspection result corresponding to rule R2 is empty. Assuming that the confidence C1 is greater than the confidence threshold corresponding to rule R1, and the confidence C2 is less than the confidence threshold corresponding to rule R3, then the third inspection result set includes: the third inspection result S31 corresponding to rule R1, the code I1 and the code I4, the third inspection result S32 corresponding to rule R2, the code I2, and the third inspection result S33 corresponding to rule R3, the code I3.

[0158] The code inspection method provided by the embodiment of the application has the advantages that for some code inspection rules, static analysis has excellent performance and can stably and accurately detect problems; and a large language model has no obvious advantages or even has disadvantages. Therefore, for such code inspection rules, the pre-trained large language model does not need to be used to check the code detection rules, which not only ensures the accuracy of code inspection, but also saves resources consumed.

[0159] Embodiment three

[0160] The code inspection method provided by the embodiment of the application has the advantages that for some code inspection rules, static analysis has excellent performance and can stably and accurately detect problems; and a large language model has no obvious advantages or even has disadvantages. Therefore, for such code inspection rules, the pre-trained large language model does not need to be used to check the code detection rules, which not only ensures the accuracy of code inspection, but also saves resources consumed. Figure 6 , a code inspection device provided by an embodiment of the application is described in detail.

[0161] As shown in Figure 6 , a code inspection device provided by an embodiment of the application includes the following modules:

[0162] The code acquisition module 601 is configured to acquire the code to be checked.

[0163] The static analysis module 602 is configured to perform static analysis on the code to be checked based on the plurality of preset code inspection rules, to obtain a first inspection result set corresponding to the code to be checked; wherein the first inspection result set includes first inspection results corresponding to the plurality of code inspection rules respectively:

[0164] The model checking module 603 is configured to check the to-be-checked code based on the plurality of code checking rules and by using the pre-trained large language model, to obtain a second checking result set corresponding to the to-be-checked code; the second checking result set includes second checking results corresponding to the plurality of code checking rules respectively, and each second checking result includes an identifier of a code checking rule, an identifier of a code that violates the code checking rule, and a confidence degree corresponding to the code checking rule.

[0165] The result fusion module 604 is configured to fuse the first checking result set and the second checking result set based on the confidence degrees corresponding to the code checking rules, to obtain a third checking result set.

[0166] In a possible implementation, the result fusion module 604 is specifically configured to: for each code checking rule, determine whether the confidence degree corresponding to the code checking rule in the second checking result is greater than a confidence degree threshold corresponding to the code checking rule; when the confidence degree corresponding to the code checking rule is greater than the confidence degree threshold corresponding to the code checking rule, perform a union set processing on the first checking result corresponding to the code checking rule and the second checking result corresponding to the code checking rule, to obtain a third checking result corresponding to the code checking rule; and when the confidence degree corresponding to the code checking rule is not greater than the confidence degree threshold corresponding to the code checking rule, take the first checking result corresponding to the code checking rule as the third checking result corresponding to the code checking rule.

[0167] In a possible implementation, the apparatus further includes a training triggering module, an action selection module, an adjustment statistics module, a reward calculation module, a threshold iteration module, and a threshold updating module.

[0168] The training triggering module is configured to trigger a Q-Learning training process of the confidence degree threshold when the cumulative labeled data reaches a preset number; the labeled data is obtained by artificially marking whether the third checking result is correct or incorrect.

[0169] The action selection module is configured to select an adjustment action for the current confidence degree threshold by using a greedy strategy, where the adjustment action includes: increasing the threshold, decreasing the threshold, and keeping unchanged.

[0170] The adjustment statistics module is configured to adjust the current confidence degree threshold according to the selected adjustment action, to obtain an adjusted confidence degree threshold, and recheck the cumulative labeled data based on the adjusted confidence degree threshold, to obtain an error rate corresponding to the adjusted confidence degree threshold.

[0171] The reward calculation module is configured to calculate a reward value of the adjusted confidence degree threshold based on the error rate corresponding to the adjusted confidence degree threshold, and update the reward value to a reward value table; the reward value of the adjusted confidence degree threshold is a reward value corresponding to the current confidence degree threshold and the selected adjustment action in the reward value table.

[0172] a threshold iteration module configured to repeat the Q-Learning iteration procedure with the adjusted confidence threshold as the current confidence threshold;

[0173] a threshold updating module configured to, when the Q-Learning training reaches a preset condition, stop the Q-Learning training, and update the confidence threshold to a confidence threshold corresponding to the maximum reward value filtered out from the reward value table.

[0174] In a possible implementation, the preset plurality of code inspection rules include an inspection mode identifier, the inspection mode identifier including: a first identifier and a second identifier, the first identifier indicating that the code inspection rules are inspected by the pre-trained large language model, and the second identifier indicating that the code inspection rules are not inspected by the pre-trained large language model; the model inspection module 603 is specifically configured to, based on the code inspection rule with the inspection mode identifier being the first identifier, inspect the code to be inspected by the pre-trained large language model to obtain a second inspection result set corresponding to the code to be inspected; and the second inspection result corresponding to the code inspection rule with the inspection mode identifier being the second identifier in the second inspection result set is empty.

[0175] In a possible implementation, the result fusion module 604 is specifically configured to: for the code inspection rule with the inspection mode identifier being the first identifier, fuse the first inspection result and the second inspection result corresponding to the code inspection rule based on the confidence corresponding to the code inspection rule to obtain a third inspection result corresponding to the code inspection rule; for the code inspection rule with the inspection mode identifier being the second identifier, obtain the third inspection result corresponding to the code inspection rule based on the first inspection result corresponding to the code inspection rule; and obtain a third inspection result set based on the third inspection result corresponding to the plurality of code inspection rules respectively.

[0176] In a possible implementation, the model inspection module 603 is specifically configured to input the target prompt word corresponding to the plurality of code inspection rules and the code to be inspected into the pre-trained large language model, so that the pre-trained large language model inspects the code to be inspected based on the plurality of code inspection rules in response to the target prompt word, and outputs a second inspection result set corresponding to the code to be inspected; and the target prompt word is a prompt word set in advance based on the plurality of code inspection rules through prompt word engineering.

[0177] In a possible implementation, the code inspection rule includes an identifier, a type, a description, a suggestion for improvement, and a management action; and the third inspection result set includes the third inspection result corresponding to the plurality of code inspection rules respectively, and the second inspection result includes the identifier of the code inspection rule and the identifier of the code violating the code inspection rule.

[0178] The device further comprises an action association module configured to associate, based on the plurality of code inspection rules, the third inspection result corresponding to the code inspection rule with the improvement suggestion and the management action of the code inspection rule, and generate a fourth inspection result set corresponding to the code to be inspected; wherein the fourth inspection result set comprises fourth inspection results corresponding to the plurality of code inspection rules respectively, and each fourth inspection result comprises an identifier of the code inspection rule, an identifier of the code violating the code inspection rule, an improvement suggestion of the code inspection rule, and a management action.

[0179] In a possible implementation, the device further comprises an action execution module configured to match a management action command corresponding to the management action based on the management action corresponding to the code inspection rule in the fourth inspection result set, and invoke a preset hook corresponding to the management action in response to the management action command corresponding to the management action, so that the preset hook executes the management action.

[0180] The code inspection device provided in the embodiment of the present application comprises a code acquisition module 601 configured to acquire code to be inspected; a static analysis module 602 configured to perform static analysis on the code to be inspected based on a plurality of preset code inspection rules, and obtain a first inspection result set corresponding to the code to be inspected; a model inspection module 603 configured to perform inspection on the code to be inspected based on the plurality of code inspection rules through a pre-trained large language model, and obtain a second inspection result set corresponding to the code to be inspected; and a result fusion module 604 configured to fuse the first inspection result set and the second inspection result set based on a confidence corresponding to the code inspection rule, and obtain a third inspection result set. In the embodiment of the present application, the code is statically analyzed based on the plurality of preset code inspection rules to obtain the first inspection result set, which fully utilizes the stable accuracy of static inspection on basic problems such as syntax errors and security compliance, and retains the advantages of static inspection; and the code is inspected by using the pre-trained large language model to obtain the second inspection result set containing the rule identifier, the code identifier and the confidence. Since the large language model has strong generalization ability and pattern recognition ability, it can make up for the defects of static inspection that cannot detect logical correctness and runtime errors, and even cover basic scenarios, thereby improving the coverage of code inspection. Therefore, the third inspection result set is obtained by fusing the first inspection result set and the second inspection result set based on the confidence. The confidence quantifies the reliability of the second inspection result output by the large language model, which not only avoids the functional shortcomings of static code inspection, but also does not need to rely on the simulated execution which is easily affected by environmental differences. The code detection comprehensiveness and accuracy problem in the current technology is effectively solved, and the accurate identification ability of the code inspection on basic problems and the coverage ability of complex logic and runtime risks are improved, thereby greatly improving the comprehensiveness and accuracy of the code inspection.

[0181] It should be noted that each of the embodiments of the present specification is described in a progressive manner, and the same or similar parts between the embodiments can be mutually referred to, and each of the embodiments focuses on the differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, they are described more simply, and the relevant parts can be referred to the part of the description of the method embodiments. The above-described device embodiments are only illustrative, and the units described as separate components can or can not be physically separated, and the components indicated as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to the actual needs. Those skilled in the art can understand and implement it without creative labor.

[0182] The above describes only one specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A code inspection method, characterized by, The method comprises: acquiring code to be checked; performing static analysis on the code to be checked based on a plurality of preset code checking rules to obtain a first set of checking results corresponding to the code to be checked; wherein the first set of checking results comprises first checking results corresponding to the plurality of code checking rules respectively; performing checking on the code to be checked based on the plurality of code checking rules through a pre-trained large language model to obtain a second set of checking results corresponding to the code to be checked; wherein the second set of checking results comprises second checking results corresponding to the plurality of code checking rules respectively, and the second checking results comprise an identifier of the code checking rule, an identifier of code violating the code checking rule, and a confidence corresponding to the code checking rule; fusing the first set of checking results and the second set of checking results based on the confidence corresponding to the code checking rule to obtain a third set of checking results.

2. The method of claim 1, wherein, The fusing the first set of checking results and the second set of checking results based on the confidence corresponding to the code checking rule to obtain a third set of checking results comprises: for each code checking rule, determining whether the confidence corresponding to the code checking rule in the second checking result is greater than a confidence threshold corresponding to the code checking rule; when the confidence corresponding to the code checking rule is greater than the confidence threshold corresponding to the code checking rule, performing a union set process on the first checking result and the second checking result corresponding to the code checking rule to obtain a third checking result corresponding to the code checking rule; when the confidence corresponding to the code checking rule is not greater than the confidence threshold corresponding to the code checking rule, taking the first checking result corresponding to the code checking rule as the third checking result corresponding to the code checking rule.

3. The method of claim 2, wherein, For each confidence threshold corresponding to the code checking rule, the confidence threshold is obtained by dynamically updating a Q-Learning algorithm.

4. The method of claim 3, wherein, For each confidence threshold corresponding to the code checking rule, the confidence threshold is obtained by updating in the following way: S401, when the accumulated labeled data reaches a preset number, triggering the Q-Learning training process of the confidence threshold; wherein the labeled data is obtained by manually marking whether the third checking result is correct or incorrect; S402: selecting an adjustment action for the current confidence threshold using a greedy strategy, wherein the adjustment action comprises increasing the threshold, decreasing the threshold, and keeping it unchanged; S403: adjusting the current confidence threshold according to the selected adjustment action to obtain an adjusted confidence threshold, and rechecking the accumulated labeled data based on the adjusted confidence threshold to obtain an error rate corresponding to the adjusted confidence threshold. S404: Calculate the reward value of the adjusted confidence threshold based on the error rate corresponding to the adjusted confidence threshold, and update the reward value to the reward value table; wherein the reward value of the adjusted confidence threshold is: the reward value corresponding to the current confidence threshold and the selected adjustment action in the reward value table; S405: Take the adjusted confidence threshold as the current confidence threshold, and repeat S402-S405; S406: When the Q-Learning training reaches a preset condition, stop the Q-Learning training, and update the confidence threshold to the confidence threshold corresponding to the maximum reward value filtered out in the reward value table.

5. The method of claim 1, wherein, The preset plurality of code inspection rules include an inspection mode identifier, and the mode identifier includes a first identifier and a second identifier, the first identifier indicating that the pre-trained large language model is used to inspect the code inspection rule, and the second identifier indicating that the pre-trained large language model is not used to inspect the code inspection rule; the second inspection result set corresponding to the code to be inspected is obtained by using the pre-trained large language model to inspect the code to be inspected based on the plurality of code inspection rules, including: The second inspection result set corresponding to the code to be inspected is obtained by using the pre-trained large language model to inspect the code to be inspected based on the code inspection rule whose inspection mode identifier is the first identifier; wherein the second inspection result corresponding to the code inspection rule whose inspection mode identifier is the second identifier in the second inspection result set is empty.

6. The method of claim 5, wherein, The third inspection result set is obtained by fusing the first inspection result set and the second inspection result set based on the confidence corresponding to the code inspection rule, including: For the code inspection rule whose inspection mode identifier is the first identifier, the third inspection result corresponding to the code inspection rule is obtained by fusing the first inspection result and the second inspection result corresponding to the code inspection rule based on the confidence corresponding to the code inspection rule; For the code inspection rule whose inspection mode identifier is the second identifier, the third inspection result corresponding to the code inspection rule is obtained based on the first inspection result corresponding to the code inspection rule; The third inspection result set is obtained based on the third inspection result corresponding to the plurality of code inspection rules respectively.

7. The method of claim 1, wherein, The second inspection result set corresponding to the code to be inspected is obtained by using the pre-trained large language model to inspect the code to be inspected based on the plurality of code inspection rules, including: The target prompt word corresponding to the plurality of code inspection rules and the code to be inspected are input to the pre-trained large language model, so that the pre-trained large language model inspects the code to be inspected based on the plurality of code inspection rules in response to the target prompt word, and outputs the second inspection result set corresponding to the code to be inspected; wherein the target prompt word is a prompt word set in advance based on the plurality of code inspection rules through prompt word engineering.

8. The method of claim 1, wherein, The code inspection rule includes an identification, a type, a description, an improvement suggestion and a management action of the code inspection rule; the third inspection result set includes third inspection results corresponding to the plurality of code inspection rules respectively, and the second inspection result includes an identification of the code inspection rule and a code identification violating the code inspection rule; after the third inspection result set is obtained by fusing the first inspection result set and the second inspection result set based on the confidence degrees corresponding to the code inspection rules, the method further includes: Based on the plurality of code inspection rules, the third inspection result corresponding to the code inspection rule is associated with the improvement suggestion and the management action of the code inspection rule to generate a fourth inspection result set corresponding to the code to be inspected; wherein the fourth inspection result set includes fourth inspection results corresponding to the plurality of code inspection rules respectively, and the fourth inspection result includes an identification of the code inspection rule, a code identification violating the code inspection rule, an improvement suggestion and a management action of the code inspection rule.

9. The method of claim 8, wherein After the fourth inspection result set corresponding to the code to be inspected is generated, the method further includes: Based on the management action corresponding to the code inspection rule in the fourth inspection result set, a management action command corresponding to the management action is matched; In response to the management action command corresponding to the management action, a corresponding preset hook is invoked so that the preset hook executes the management action.

10. A code inspection apparatus characterized by comprising: It includes: A code acquisition module is configured to acquire a code to be inspected. A static analysis module is configured to perform static analysis on the code to be inspected based on a plurality of preset code inspection rules to obtain a first inspection result set corresponding to the code to be inspected; wherein the first inspection result set includes first inspection results corresponding to the plurality of code inspection rules respectively. A model inspection module is configured to perform inspection on the code to be inspected by a pre-trained large language model based on the plurality of code inspection rules to obtain a second inspection result set corresponding to the code to be inspected; wherein the second inspection result set includes second inspection results corresponding to the plurality of code inspection rules respectively, and the second inspection result includes an identification of the code inspection rule, a code identification violating the code inspection rule and a confidence degree corresponding to the code inspection rule. A result fusion module is configured to fuse the first inspection result set and the second inspection result set based on the confidence degrees corresponding to the code inspection rules to obtain a third inspection result set.

Images