Multi-thread risk detection method and device and electronic equipment

Abstract

The invention provides a multi-thread risk detection method and device and electronic equipment. The method comprises the steps that key symbols indicating shared resources are extracted from risk code blocks of a to-be-detected source code file; aiming at each key symbol, searching an associated code block referencing the key symbol in the global source code, screening a write-in code block which performs write-in operation on the shared resource through the key symbol in the associated code block, and identifying whether the write-in code block uses a lock mechanism or not to provide protection for the write-in operation; determining potential risk points for target code blocks which are identified in the write code blocks and do not use the lock mechanism to protect the write operation; generating an associated file result list based on the risk information of the potential risk point of each key symbol, the file path of the to-be-detected source code file and the risk code block; and analyzing the associated file result list based on the risk large model to obtain an analysis report. According to the method, symbol association and intelligent large model analysis are combined, and efficient and accurate multi-thread risk detection is achieved.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a multi-threaded risk detection method, device and electronic device. Background Technology

[0002] As mobile applications become increasingly complex, multithreaded programming is widely used to improve performance and user experience. However, multithreading also introduces numerous concurrency security risks, making it crucial to ensure application stability and data security in multithreaded environments.

[0003] Multithreading risk detection refers to the analysis and inspection process performed on applications using multithreading technology during software development. Its purpose is to identify potential errors that may cause program instability, data inconsistency, or performance issues. Among multithreading risks, data races are one of the most common and fundamental security vulnerabilities. Data races, as a special case of race conditions, refer to multiple threads concurrently accessing the same memory location without synchronization, involving write operations. Data races not only directly lead to serious consequences such as data inconsistency and program crashes, but are also the direct cause of various difficult-to-reproduce race condition problems. Besides data races, multithreaded environments also face problems such as deadlock, resource leaks, and thread starvation.

[0004] Currently, developers primarily rely on static analysis tools and dynamic detection methods to discover multithreading vulnerabilities, but both have limitations. Static analysis tools are lacking in three main ways: 1. While many static analysis tools can help detect security vulnerabilities in code, they typically focus on general security issues, neglecting the risks of global thread management specific to the iOS platform; 2. Static analysis tools often rely on pattern matching based on predefined rules, making it difficult to cover all risk scenarios and prone to false positives and false negatives; 3. Static analysis tools often require complex configurations and struggle to fully utilize the built-in features of Xcode (Apple's official integrated development environment) for accurate analysis, resulting in inaccurate results. Dynamic detection methods, limited by the coverage of test cases, can detect some issues through runtime monitoring but cannot guarantee the comprehensive detection of all potential risks. Furthermore, both methods lack a deep understanding of the source code context, a deficiency that often leads to inaccurate detection results.

[0005] To more effectively identify multithreading risks, existing technologies mainly adopt the following two feasible solutions.

[0006] Option 1: Static code analysis based on AST (Abstract Syntax Tree) parsing This approach parses source code into an Abstract Syntax Tree (AST) to construct a precise code model for in-depth analysis. The implementation involves two steps: 1. Code parsing: Utilizing Xcode's code indexing and AST parsing capabilities. For example, Swift projects call the sourcekitd service to obtain the AST, while Objective-C projects directly use the Clang API (Application Programming Interface); 2. Rule definition: Based on the AST structure, a set of dedicated detection rules is defined to address multi-threading risks, covering issues such as the storage and access of sensitive information in a multi-threaded environment, misuse of synchronization mechanisms, and thread safety defects in the singleton pattern.

[0007] Option 2: Automated detection based on Shell scripts This solution utilizes shell scripts combined with command-line tools to achieve flexible and automated security checks. The detection logic can be customized according to project requirements: it can use regular expressions to quickly scan for hard-coded sensitive information (such as API keys), or it can combine lightweight analysis to check for improper calls to concurrent APIs such as GCD (Grand Central Dispatch), NSLock (mutex lock), and NSThread (thread).

[0008] Existing multi-threaded risk detection solutions, such as deep analysis based on AST and automated detection based on Shell scripts, suffer from the drawback of difficulty in balancing detection accuracy, efficiency, and implementation cost: the former is accurate but has high development and maintenance costs and high performance overhead, while the latter is efficient but has limited detection depth and a high false alarm rate; thus, the application effect in complex projects is not ideal. Summary of the Invention

[0009] Among various multi-threaded risks, data contention has become one of the core security issues that urgently needs attention and resolution due to the prevalence of the problems it causes and the severity of its consequences. This application addresses the current situation where existing detection schemes for data contention risks struggle to balance accuracy, efficiency, and overhead by providing a multi-threaded risk detection method, apparatus, and electronic device, aiming to achieve high-precision, high-efficiency, and low-overhead detection of data contention on the iOS platform.

[0010] In a first aspect, embodiments of this application provide a multi-threaded risk detection method, including: If a risky code block is identified in the source code file to be detected, the key symbols in the risky code block are extracted. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources. For each key symbol, search for the associated code block that references the key symbol in the global source code of the target application, filter the write code block that performs write operations on shared resources through the key symbol in the associated code block, and identify whether the write code block uses a locking mechanism to protect the write operation. In response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, the write operation on the shared resource in the target code block through the key symbol is identified as a potential risk point of multi-threaded data contention. Based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block, a list of associated file results is generated. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs. Based on the analysis of the associated file result list using the high-risk model, an analysis report indicating the overall multi-threaded data competition risk is obtained from the output of the high-risk model.

[0011] Secondly, embodiments of this application provide a multi-threaded risk detection device, comprising: The extraction module is used to extract key symbols from the risky code blocks when a risky code block is identified in the source code file to be detected. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources. The first processing module is used to search for the associated code block that references the key symbol in the global source code of the target application for each key symbol, filter the write code block that performs write operation on the shared resource through the key symbol in the associated code block, and identify whether the write code block uses a locking mechanism to protect the write operation. The first determining module is configured to, in response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, determine the write operation on the shared resource in the target code block through the key symbol as a potential risk point of multi-threaded data contention. The generation module is used to generate a list of associated files based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs. The acquisition module is used to analyze the list of associated file results based on the high-risk model and obtain the analysis report output by the high-risk model indicating the overall multi-threaded data competition risk.

[0012] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0013] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0014] In this embodiment, when a risky code block is identified in the source code file to be detected, key symbols indicating shared resources are extracted from the risky code block. For each key symbol, associated code blocks referencing the key symbol are searched in the global source code. Write code blocks that perform write operations on shared resources through the key symbols are selected from the associated code blocks. Target code blocks that do not use locking mechanisms to protect write operations are identified from the write code blocks, and potential risk points are determined in the target code blocks. Based on the risk information of the potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risky code blocks, a list of associated file results is generated to provide a complete path from the source of risk to all associated risk points. The list of associated file results is analyzed using a large-scale risk model, and a comprehensive analysis report assessing the overall multi-threaded data competition risk is output. This approach combines symbol association with intelligent large-scale model analysis to construct an efficient, accurate, and highly versatile automated multi-threaded risk detection solution, significantly improving detection efficiency, accuracy, and reducing costs. It effectively solves the problem of balancing detection accuracy, efficiency, and implementation cost. Attached Figure Description

[0015] Figure 1 This diagram illustrates the multi-threaded risk detection method provided in this application embodiment. Figure 2 A schematic diagram illustrating the target code block corresponding to the key symbols provided in the embodiments of this application; Figure 3 This is a flowchart illustrating an example of the multi-threaded risk detection method provided in this application. Figure 4 This diagram illustrates the multi-threaded risk detection device provided in an embodiment of this application. Figure 5 This is a schematic diagram of the electronic device structure provided in the embodiments of this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] In existing technologies, identifying multithreading risks primarily relies on static code analysis based on AST parsing and automated detection based on shell scripts. For static code analysis based on AST parsing, the AST provides a detailed view of the code logic, accurately tracking the flow of global data and its usage within the project, resulting in high detection accuracy. However, writing and maintaining custom detection scripts and processing ASTs requires significant time and resources, leading to high development and maintenance costs. Furthermore, in large projects, building and traversing the syntax tree significantly increases compilation time, potentially impacting development efficiency and causing substantial compilation performance overhead. Automated detection based on shell scripts offers high flexibility, allowing for the free combination of various static analysis tools and detection logic; the scripts can be seamlessly integrated into existing CI / CD processes, offering a high degree of automation and ease of integration. However, its lightweight, script-based nature leads to two major limitations: firstly, insufficient accuracy, generating numerous false positives when relying on regular expression matching due to a lack of deep code semantic understanding, increasing the burden of manual review; and secondly, limited detection depth, failing to achieve complete code context and data flow analysis overall.

[0018] Among various multithreading risks, data races, due to their widespread triggering conditions and severe consequences, constitute the core challenge and urgent problem to be solved in multithreading safety. However, existing detection schemes have further amplified their detection shortcomings when dealing with data race risks: while the AST scheme can provide the necessary detection accuracy, its large performance overhead makes it difficult to apply in real-time in development scenarios where data races are frequent; while the Shell script scheme can meet efficiency requirements, its high false positive rate and limited detection depth make it difficult to apply in complex data race scenarios. Therefore, at the data race detection level, there is a problem of difficulty in balancing accuracy, efficiency, and overhead. This application provides a multithreading risk detection method to address the current situation where accuracy, efficiency, and overhead are difficult to balance in existing data race risk detection schemes. The multithreading risk detection method provided in this application is a detection scheme based on the Xcode code index. The Xcode code index is a technology internal to Xcode, which is a structured database automatically built by Xcode during the compilation process by parsing the project source code. It completely records all symbols in the code and their reference relationships. The code index is carried by a code index file. This solution accesses and utilizes code structure data by directly reading and parsing the code index file, thereby achieving accurate analysis.

[0019] The multi-threaded risk detection method provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0020] like Figure 1 As shown, the multi-threaded risk detection method provided in this application includes the following steps: Step 101: If a risky code block is identified in the source code file to be detected, extract the key symbols in the risky code block. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources.

[0021] The target application is a multithreaded application that includes multiple source code files. The source code file to be detected is one of these multiple source code files. For the source code file to be detected, if it is found to contain risky code blocks, key symbols indicating shared resources are extracted from these risky code blocks.

[0022] In this context, risky code blocks in the source code file to be detected are specific code fragments identified within the file that conform to certain predefined rules. Shared resources refer to data objects defined in the code that are concurrently accessed by multiple threads. The key symbols extracted from the risky code blocks serve as indicators of shared resources. As identifiers of code elements shared by multiple threads, they provide clues for tracing the associated context.

[0023] Step 102: For each key symbol, find the associated code block that references the key symbol in the global source code of the target application, filter the write code block that performs write operations on shared resources through the key symbol, and identify whether the write code block uses a locking mechanism to protect the write operation.

[0024] After extracting one or more key symbols from the risky code block, for each key symbol, the code snippets referencing the current key symbol are searched in the target application's global source code to determine the associated code blocks. Furthermore, among the found associated code blocks, write code blocks that perform write operations on shared resources through the current key symbol are further filtered out. Since the core of data contention is write conflicts in memory access, it is safe for multiple threads to concurrently read the same data. Therefore, it is necessary to filter out write code blocks that perform write operations on shared resources by referencing key symbols from the associated code blocks.

[0025] For the selected write code blocks, it is determined whether the write code block uses a locking mechanism to protect the write operation. If the write code block uses a locking mechanism to protect the write operation, it is determined that the write code block has thread safety protection; if the write code block does not use a locking mechanism to protect the write operation, in a concurrent execution environment, multiple threads may execute the write code block at the same time, and the write code block does not have thread safety protection, which may lead to data races.

[0026] Step 103: In response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, the write operation on the shared resource in the target code block through the key symbol is identified as a potential risk point of multi-threaded data contention.

[0027] If a write block without lock protection is identified within the write block, it is considered a potential target block for data races because multiple threads may simultaneously execute write operations on such blocks in a concurrent environment, leading to memory access conflicts. Furthermore, write operations to shared resources via references to key symbols within these target blocks are identified as potential risk points for multi-threaded data races. By performing the aforementioned operations of identifying associated code blocks, filtering write blocks, and identifying target code blocks for each key symbol, it is possible to determine the target code blocks associated with each key symbol and the potential risk points associated with it. A single key symbol can be associated with one or more potential risk points.

[0028] Step 104: Generate a list of associated files based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs.

[0029] For any given key symbol, one or more target code blocks are identified within the written code block, and potential risk points are determined for each target code block. A list of associated file results is generated based on the risk information of the potential risk points corresponding to each key symbol, the risky code blocks in the source code file to be detected, and the file path of the source code file to be detected. The risk information of the potential risk points includes the key symbols involved and their corresponding shared resources, the target code blocks involved (write code blocks that do not use locking mechanisms to protect write operations to shared resources via key symbols), and the file path of the source code file to which the target code blocks belong. The generated list of associated file results is a structured dataset that centrally stores all associated risks and their complete context. By generating this list, data competition risk points scattered across different files can be associated, thus clearly showing the complete path from the risk source to all associated risk points.

[0030] Step 105: Analyze the list of related files based on the high-risk model and obtain the analysis report output by the high-risk model indicating the overall multi-threaded data competition risk.

[0031] After generating the list of associated file results, the list is analyzed based on a large-scale risk model. This large-scale risk model is a language model with code semantic understanding and multi-threaded risk identification capabilities. By using this model to analyze the list of associated file results, potential data race patterns can be identified and the severity of risks assessed based on a deep understanding of the code's contextual semantics, thereby generating a comprehensive analysis report assessing the overall multi-threaded data race risk.

[0032] The above-described implementation scheme of this application, upon identifying risky code blocks in the source code file to be detected, extracts key symbols indicating shared resources from the risky code blocks. For each key symbol, it searches for associated code blocks referencing the key symbols in the global source code, filters out write code blocks that perform write operations on shared resources through the key symbols from the associated code blocks, and identifies target code blocks that do not use locking mechanisms to protect write operations from the write code blocks, and determines potential risk points in the target code blocks. Based on the risk information of the potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risky code blocks, it generates a list of associated file results to provide a complete path from the source of risk to all associated risk points. It uses a large-scale risk model to analyze the list of associated file results and outputs a comprehensive analysis report assessing the overall multi-threaded data competition risk. This scheme combines symbol association with intelligent large-scale model analysis to build an efficient, accurate, and highly versatile automated multi-threaded risk detection solution, significantly improving detection efficiency, detection accuracy, and reducing costs, effectively solving the problem of balancing detection accuracy, efficiency, and implementation cost.

[0033] The following describes the process of filtering and identifying write blocks and target code blocks. Optionally, for each key symbol, when searching for associated code blocks referencing the key symbol in the global source code of the target application, and filtering for write blocks that perform write operations on shared resources through the key symbol from the associated code blocks, the following steps are included: For each key symbol, the reference location of the key symbol is found in the code index file of the target application. The code index file is generated by parsing the global source code and stores the metadata, definition location and reference relationship of the identified symbols. The associated source code file is determined based on the reference location of the key symbol, and the associated code block that references the key symbol is extracted from the associated source code file; Perform code content analysis on related code blocks; Based on the code content analysis results, write code blocks that perform write operations on shared resources through key symbols are selected from the associated code blocks to determine the write code blocks corresponding to the key symbols.

[0034] After extracting one or more key symbols from the risky code block, the reference locations of each key symbol are located based on the target application's code index file. This code index file is generated by parsing the global source code and stores the metadata, definition locations, and reference relationships of all symbols identified through the parsing of the global source code. The symbol's metadata defines its static attributes, including but not limited to: symbol name, symbol type (e.g., variable, method, class), and data type. The symbol's definition location records its specific coordinates in the source code (e.g., file path, line number, and column number), which is crucial for precise location. The symbol's reference relationships depict the dynamic interactions of the symbol in the code, including the type of each reference (e.g., read, write, call) and its specific contextual location, forming the basis for correlation analysis. Through the reference relationships recorded in the code index file, all reference locations of key symbols in the global source code can be quickly and accurately located; combined with the symbol's definition location, this provides a complete code context data foundation for subsequent correlation analysis.

[0035] Reference locations typically include information such as file paths, line numbers, and column numbers. For any key symbol, after determining its reference location, the associated source code file is identified based on the reference location. Then, the associated code blocks referencing that key symbol are extracted from the associated source code file based on the reference location. The extracted associated code blocks include those performing read operations via the key symbol, those performing write operations via the key symbol, and those performing call operations via the key symbol. Code content analysis is performed on the extracted associated code blocks to filter out those that perform write operations on shared resources via the key symbol, thus identifying the write code blocks and precisely narrowing the analysis scope from broad relevance to write operations with potential risks.

[0036] After identifying the write code block corresponding to the key symbols, it is necessary to further identify whether the write code block uses a locking mechanism to protect the write operation. This process includes the following steps: The write block determines the write location for the shared resource using the key symbol; Starting from the write position, search upwards within a reasonable range for lock mechanism calls. The reasonable range is the effective boundary range of the search upwards from the write position. If no lock mechanism call is found within a reasonable range, it is determined that the write block does not use a lock mechanism to protect the write operation and there is a risk of multi-threaded data race.

[0037] For a write block identified in an associated code block, the write position for writing to the shared resource via a key symbol is determined within the write block. Starting from the write position, the lock mechanism call is searched upwards within a reasonable range, such as searching upwards within the current function scope, searching upwards within the current method body, or tracing back a specific number of lines.

[0038] If no lock mechanism call is found within a reasonable range, it is determined that the current write code block does not use a lock mechanism to protect the write operation to the shared resource through the key symbol, and thus it is determined that the write operation has a risk of multi-threaded data competition and the current write code block is the target code block.

[0039] The above implementation scheme, for any key symbol, finds the reference location of the key symbol in the global source code, determines the associated code block that references the key symbol based on the reference location, identifies the write code block in the associated code block, and identifies the target code block based on whether the write code block uses a locking mechanism to protect the write operation. This can accurately locate the code segment in the target application that has a data race risk for the shared resource indicated by the key symbol, and thus determine the potential risk points of multi-threaded data race.

[0040] The following describes the process of identifying the target code block corresponding to key symbols using an implementation flowchart, such as... Figure 2 As shown, it includes the following steps: Step 201: After extracting a key symbol in the risky code block, find the reference position of the current key symbol.

[0041] Step 202: Determine the associated source code file based on the reference position of the current key symbol, and extract the associated code block that references the current key symbol from the associated source code file.

[0042] Step 203: Analyze the code content of the associated code blocks and select the code blocks to be written from the associated code blocks.

[0043] Step 204: Identify code blocks within the write block that do not use locking mechanisms to protect write operations, in order to determine the target code block.

[0044] In the above implementation process, the first step is to find the associated code blocks that reference key symbols, filter out the write code blocks from the associated code blocks, narrow the analysis scope to write operations with potential risks, and then identify the target code block by identifying the use of locking mechanisms in the write code block. This allows for the precise location of code segments in the target application that pose a data contention risk to shared resources.

[0045] The following describes the process of identifying risky code blocks and extracting key symbols from them. When identifying risky code blocks in a source code file to be inspected, the process includes: The code in the source code file to be detected is matched with the risk pattern rules defined in the risk code library. The risk code library includes at least one risk pattern rule, which describes the code structure characteristics and / or code execution logic patterns that cause multi-threaded data races. In response to the existence of code fragments that conform to the risk pattern rules in the source code file to be detected, the code fragments are identified as risky code blocks in the source code file to be detected.

[0046] Identifying risky code blocks in the source code file to be tested involves the following operations: matching the code in the source code file to be tested with predefined risk pattern rules in the risk code library; if there is a code segment in the source code file to be tested that matches the predefined risk pattern rules, then the code segment is identified as a risky code block in the source code file to be tested.

[0047] The risk code library, as a collection of predefined rules, provides the basis for determining risk pattern matching. By matching the code in the source code file to be tested with the predefined risk pattern rules in the risk code library, risky code blocks that meet the potential risk characteristics can be filtered out from the source code file to be tested, thus providing a data foundation for subsequent location of multi-threaded data race risks.

[0048] When a risky code block is identified in the source code file to be detected, the extraction of key symbols from the risky code block includes: In response to the presence of risky code blocks in the source code file to be detected, candidate symbols are identified from the risky code blocks based on pattern matching and / or syntax analysis, and the confidence level of the candidate symbols indicating shared resources is verified by combining context analysis; Based on a preset confidence threshold, key symbols are selected from candidate symbols.

[0049] If risky code blocks exist in the source code file to be detected, at least one of pattern matching and syntax analysis is used to identify candidate symbols from the risky code blocks. Candidate symbols are symbols initially selected from all symbols in the risky code block using specific technical means, and are deemed worthy of further attention. The identified candidate symbols constitute an initial set of symbols that require subsequent verification. This set includes symbols with potential shared resource characteristics and symbols without such characteristics. If only pattern matching is used to identify candidate symbols, regular expressions are relied upon to scan the code text and extract candidate symbols. If only syntax analysis is used to identify candidate symbols, an abstract syntax tree is constructed to understand the code structure, thereby extracting candidate symbols. If both pattern matching and syntax analysis are used to identify candidate symbols, regular expressions are first used to scan the code text to initially extract a list of candidate symbols. Subsequently, an abstract syntax tree is constructed for the risky code block, and in-depth syntax structure verification is performed using the abstract syntax tree to further filter candidate symbols from the list.

[0050] After identifying candidate symbols from risky code blocks based on pattern matching and / or syntax analysis, the confidence level of the candidate symbols indicative of shared resources is verified by context analysis. This confidence level is compared with a preset confidence threshold. Candidate symbols whose confidence level indicative of shared resources is greater than the preset threshold are identified as key symbols, thus filtering out key symbols from the candidate symbols. One or more key symbols can be filtered out from the candidate symbols; however, there are also cases where no key symbols are found among the candidate symbols.

[0051] In the above implementation scheme, based on the risk pattern rules defined in the risk code library, code segments that conform to the risk pattern rules are identified in the source code file to be detected to determine the risky code blocks in the source code file to be detected; candidate symbols are identified from the risky code blocks based on pattern matching and / or syntax analysis, and the confidence level of the candidate symbols indicating shared resources is verified by combining context analysis; key symbols are screened based on the comparison between the confidence level and the confidence level threshold, which can provide credible key symbols and provide a high-quality data foundation for subsequent processing.

[0052] The process of generating the associated file result list is described below. When generating the associated file result list based on the risk information of the potential risk points corresponding to each key symbol, the file path of the source code file to be checked, and the risky code block, the process includes: Initialize a risk association list; Add the file path of the source code file to be detected and the risky code block in the source code file to the risk association list, and add the risk information of the potential risk points corresponding to each key symbol to the risk association list, and generate a list of associated files.

[0053] After identifying risky code blocks in the source code file to be inspected, a risk association list is initialized. Alternatively, a risk association list is initialized when the potential risk points corresponding to each key symbol are determined and data assembly is required. If a risk association list is initialized after identifying risky code blocks, the file path of the source code file to be inspected and the risky code blocks in the source code file are added to the risk association list. This list serves as the core container for subsequently adding detailed information about each associated potential risk point; each key symbol corresponds to one or more potential risk points. After determining potential risk points, the risk information of the potential risk points (including the key symbols involved and their corresponding shared resources, the target code blocks involved, and the file path of the source code file to which the target code blocks belong) is added to the risk association list. Based on the risk information of the potential risk points corresponding to each key symbol, the file path of the source code file to be inspected, and the risky code blocks, an association file result list is generated.

[0054] If, when identifying the potential risk points corresponding to each key symbol and data assembly is required, a risk association list is initialized, the file path of the source code file to be tested, the risk code block, and the risk information of the potential risk points corresponding to each key symbol are directly added to the risk association list, so as to generate a list of associated file results through data assembly.

[0055] The above implementation scheme generates a structured dataset that centrally stores all associated risks and their complete context by adding the file path of the source code file to be detected and the risk code blocks in the source code file to the risk association list, and adding the risk information of the potential risk points corresponding to each key symbol to the risk association list. This enables the association of data competition risk points scattered in different files, thereby clearly showing the complete path from the risk source to all associated risk points.

[0056] The following describes the process of analyzing the result list of related files based on a large-scale model. When analyzing the result list of related files based on a large-scale risk model and obtaining the analysis report output by the large-scale risk model indicating the overall multi-threaded data contention risk, the process includes: Based on the analysis task of analyzing the overall multi-threaded data competition risk based on the results list and indicators of the associated files, prompt words are generated. Input the prompt word information into the high-risk model; Obtain an analysis report from the high-risk model that is adapted to the prompt word information.

[0057] After generating the list of associated file results, prompt words are generated based on this list and the analysis task. This analysis task instructs the analysis of overall multi-threaded data contention risk to construct an effective prompt for the large model. The generated prompt words transform the structured data in the associated file results list into natural language descriptions, and require the large model to identify and assess the severity and relevance of all potential data contention risk points. Specific code remediation suggestions and best practice guidance are provided to leverage the large model to obtain a comprehensive, accurate, and actionable overall multi-threaded data contention risk analysis report.

[0058] Among them, after obtaining the analysis report provided by the risk model that matches the prompt word information, verifying the risk points in the analysis report to determine the real risk points, the real risk points are prioritized according to the probability of risk occurrence and / or the degree of business impact. Code remediation tasks are created and assigned based on priority for at least some of the real risk points; In response to the successful verification of code fixes, the risk feature descriptions corresponding to the problematic source code and the verified fix solutions are used as training data pairs to update the risk model.

[0059] After obtaining the analysis report provided by the risk big data model, the risk points in the report are first manually verified to screen out the real risk points. Then, considering the probability of risk occurrence derived from code structure features and / or the degree of business impact assessed based on business scenarios, the real risk points are prioritized. Based on the priority ranking, code remediation tasks are created and assigned to at least some of the real risk points. In specific implementation, any of the following strategies can be adopted: 1. Comprehensive remediation strategy: Code remediation tasks are created and assigned to all real risk points (including high-risk, medium-risk, and low-risk points) in order of priority; 2. Tiered remediation strategy: For high-risk points, code remediation tasks are created and assigned immediately, requiring resolution within a specified timeframe; for medium-risk points, work orders are created, and resources are uniformly assessed and allocated for remediation at specific times (such as during subsequent version planning); for low-risk points, records are kept in the risk knowledge base for future reference, serving as training data for the big data model and risk monitoring items.

[0060] For code repair tasks, after developers complete the repair and pass code review and automated testing verification, the risk feature descriptions corresponding to the problematic source code and the verified repair solutions are used as training data pairs to update and optimize the risk model, thereby achieving continuous optimization of detection capabilities.

[0061] In the above implementation scheme, a large model is used to intelligently analyze the list of associated files containing all related risks and their complete contexts, which are centrally stored, to obtain a comprehensive overall multi-threaded data competition risk analysis report. After verifying the authenticity of the risk points involved in the analysis report, code repair tasks are created and assigned to at least some of the real risk points based on priority. After the code repair verification is passed, the risk feature descriptions and repair solutions corresponding to the problematic source code are used as training data pairs to update the risk large model, so as to continuously optimize the large model and improve its analytical capabilities.

[0062] The following example illustrates the multithreading risk detection method provided in this application. This example uses a mutex lock (NSLock) to illustrate the lock mechanism call. NSLock implements mutual exclusion access to shared resources through the lock (acquire lock) and unlock (release lock) methods. The specific process is as follows: Figure 3 As shown: Step 301: Obtain the currently edited source code file based on the cursor position, identify the code segments in the current source code file that hit the risky code library, determine the risky code block, and the current source code file is one of multiple source code files corresponding to the target application.

[0063] Step 302: Add the identified risky code blocks and their corresponding source code file paths as initial risk information to the risk association list.

[0064] Step 303: Identify lock mechanism calls (such as lock and unlock methods) in risky code blocks, check their pairing and integrity, and for critical section code between lock mechanisms, extract all key symbols indicating shared resources and record the extracted key symbols into a key symbol array.

[0065] Step 304: For each key symbol, perform the following operations: Locate all associated code blocks that reference the key symbol, filter out the write code blocks that perform write operations on shared resources through the key symbol, identify the synchronization state of each write code block, and identify the code blocks that are not protected by the lock mechanism (i.e., no lock / unlock method calls) as target code blocks. In the target code blocks, identify the write operations on shared resources through the key symbol as potential risk points for multi-threaded data contention.

[0066] Step 305: Add the risk information of the potential risk points corresponding to each key symbol to the risk association list, and generate a list of association file results that centrally stores all associated risks and their complete context.

[0067] Step 306: Based on the analysis task of analyzing the overall multi-threaded data competition risk based on the result list of associated files and indicators, construct structured prompt word information for large models.

[0068] Step 307: Submit the prompt word information to the risk model for analysis and obtain a comprehensive analysis report on the overall multi-threaded data competition risk.

[0069] The above process identifies risky code blocks in the source code, extracts key symbols and finds related write operations, filters out unprotected code blocks to determine risk points, integrates all risk information and generates an overall data competition risk assessment report through large model analysis, so as to obtain a comprehensive, accurate and actionable overall multi-threaded data competition risk analysis report by utilizing the large model.

[0070] This application provides a multi-threaded risk detection device, such as... Figure 4 As shown, it includes: The extraction module 401 is used to extract key symbols in the risky code block when a risky code block is identified in the source code file to be detected. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources. The first processing module 402 is used to search for the associated code block that references the key symbol in the global source code of the target application for each key symbol, filter the write code block that performs write operation on the shared resource through the key symbol in the associated code block, and identify whether the write code block uses a locking mechanism to protect the write operation. The first determining module 403 is configured to, in response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, determine the write operation on the shared resource in the target code block through the key symbol as a potential risk point of multi-threaded data contention. The generation module 404 is used to generate a list of associated files based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs. The acquisition module 405 is used to analyze the list of associated file results based on the high-risk model and obtain the analysis report output by the high-risk model indicating the overall multi-threaded data competition risk.

[0071] Optionally, the first processing module includes: The lookup submodule is used to find the reference location of each key symbol in the code index file of the target application. The code index file is generated by parsing the global source code and stores the metadata, definition location and reference relationship of the identified symbols. The extraction submodule is used to determine the associated source code file based on the reference position of the key symbol, and extract the associated code block that references the key symbol from the associated source code file; The analysis submodule is used to perform code content analysis on the associated code block; The filtering submodule is used to filter out the write code blocks that perform write operations on shared resources through the key symbols from the associated code blocks based on the code content analysis results, so as to determine the write code blocks corresponding to the key symbols.

[0072] Optionally, the first processing module further includes: The first determining submodule is used to determine the write position in the write code block where the write operation on the shared resource is performed through the key symbol; The search submodule is used to search upwards from the write position within a reasonable range for lock mechanism calls. The reasonable range is the effective boundary range of the upward search starting from the write position. The second determining submodule is used to determine, in response to the absence of a lock mechanism call within the reasonable range, that the write code block does not use a lock mechanism to protect the write operation and there is a risk of multi-threaded data contention.

[0073] Optionally, the device further includes: The matching module is used to match the code in the source code file to be detected with the risk pattern rules defined in the risk code library. The risk code library includes at least one risk pattern rule, which describes the code structure features and / or code execution logic patterns that cause multi-threaded data races. The second determining module is used to determine the code segment as a risky code block in the source code file to be detected in response to the presence of a code segment that conforms to the risk pattern rules in the source code file to be detected.

[0074] Optionally, the extraction module includes: The first processing submodule is configured to, in response to the presence of the risky code block in the source code file to be detected, identify candidate symbols from the risky code block based on pattern matching and / or syntax analysis, and verify the confidence level of the candidate symbols indicative of the shared resource in conjunction with context analysis; The filtering submodule is used to filter out the key symbols from the candidate symbols based on a preset confidence threshold.

[0075] Optionally, the generation module includes: The initialization submodule is used to initialize a risk association list; A submodule is added to add the file path of the source code file to be detected and the risky code blocks in the source code file to the risk association list, and to add the risk information of the potential risk points corresponding to each key symbol to the risk association list, thereby generating the associated file result list.

[0076] Optionally, the acquisition module includes: A generation submodule is used to generate prompt word information based on the analysis task of analyzing the overall multi-threaded data competition risk based on the associated file result list and indications. The input submodule is used to input the prompt word information into the high-risk model; The acquisition submodule is used to acquire the analysis report output by the high-risk model that is adapted to the prompt word information.

[0077] Optionally, the device further includes: The classification module is used to prioritize the real risk points based on their probability of occurrence and / or degree of business impact after verifying and identifying the real risk points in the analysis report. The allocation module is used to create and assign code fixation tasks for at least some of the real risk points based on priority. The update module is used to update the risk model in response to the code fix verification passing, using the risk feature description corresponding to the problematic source code and the verified fix solution as training data pairs.

[0078] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0079] This application also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described multi-threaded risk detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0080] For example, Figure 5 A schematic diagram of the physical structure of an electronic device is shown. (For example...) Figure 5As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540. The processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions stored in the memory 530. The processor 510 is used to execute various processes of the multi-threaded risk detection method of this application embodiment, which will not be described in detail here.

[0081] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0082] This application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described multi-threaded risk detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0083] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0084] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0085] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A multi-threaded risk detection method, characterized in that, include: If a risky code block is identified in the source code file to be detected, the key symbols in the risky code block are extracted. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources. For each key symbol, search for the associated code block that references the key symbol in the global source code of the target application, filter the write code block that performs write operations on shared resources through the key symbol in the associated code block, and identify whether the write code block uses a locking mechanism to protect the write operation. In response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, the write operation on the shared resource in the target code block through the key symbol is identified as a potential risk point of multi-threaded data contention. Based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block, a list of associated file results is generated. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs. Based on the analysis of the associated file result list using the high-risk model, an analysis report indicating the overall multi-threaded data competition risk is obtained from the output of the high-risk model.

2. The method according to claim 1, characterized in that, For each key symbol, the process of searching for associated code blocks referencing the key symbol in the global source code of the target application, and then filtering out write code blocks from these associated code blocks that perform write operations on shared resources through the key symbol, includes: For each key symbol, the reference location of the key symbol is found in the code index file of the target application. The code index file is generated by parsing the global source code and stores the metadata, definition location and reference relationship of the identified symbols. The associated source code file is determined based on the reference position of the key symbol, and the associated code block referencing the key symbol is extracted from the associated source code file; Perform code content analysis on the associated code blocks; Based on the code content analysis results, write code blocks that perform write operations on shared resources through the key symbols are selected from the associated code blocks to determine the write code blocks corresponding to the key symbols.

3. The method according to claim 1 or 2, characterized in that, The step of identifying whether the write code block uses a locking mechanism to protect the write operation includes: The write location for performing a write operation on the shared resource using the key symbol is determined within the write code block; Starting from the write position, search upwards within a reasonable range for lock mechanism calls, where the reasonable range is the effective boundary range of the upward search starting from the write position; If no lock mechanism call is found within the reasonable range, it is determined that the write code block does not use a lock mechanism to protect the write operation and there is a risk of multi-threaded data contention.

4. The method according to claim 1, characterized in that, Also includes: The code in the source code file to be detected is matched with the risk pattern rules defined in the risk code library. The risk code library includes at least one risk pattern rule, which describes the code structure features and / or code execution logic patterns that cause multi-threaded data races. In response to the presence of a code segment in the source code file to be detected that conforms to the risk pattern rules, the code segment is identified as a risky code block in the source code file to be detected.

5. The method according to claim 1 or 4, characterized in that, When a risky code block is identified in the source code file to be detected, the key symbols in the risky code block are extracted, including: In response to the presence of the risky code block in the source code file to be detected, candidate symbols are identified from the risky code block based on pattern matching and / or syntax analysis, and the confidence level of the candidate symbols indicative of the shared resource is verified in conjunction with context analysis; Based on a preset confidence threshold, the key symbols are selected from the candidate symbols.

6. The method according to claim 1, characterized in that, The list of associated files generated based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risky code block includes: Initialize a risk association list; The file path of the source code file to be detected and the risky code block in the source code file to be detected are added to the risk association list, and the risk information of the potential risk points corresponding to each key symbol is added to the risk association list to generate the associated file result list.

7. The method according to claim 1, characterized in that, The analysis of the associated file result list based on the high-risk model yields an analysis report output by the high-risk model indicating the overall multi-threaded data competition risk, including: Based on the list of associated file results and the analysis task indicating the overall multi-threaded data competition risk, prompt word information is generated. Input the prompt word information into the high-risk model; Obtain the analysis report output by the high-risk model that is adapted to the prompt word information.

8. The method according to claim 1 or 7, characterized in that, Also includes: After verifying and identifying the actual risk points in the analysis report, the actual risk points are prioritized based on the probability of occurrence and / or the degree of business impact. Code remediation tasks are created and assigned based on priority for at least some of the real risk points; In response to the successful verification of code repair, the risk feature descriptions corresponding to the problematic source code and the verified repair solutions are used as training data pairs to update the risk model.

9. A multi-threaded risk detection device, characterized in that, include: The extraction module is used to extract key symbols from the risky code blocks when a risky code block is identified in the source code file to be detected. The source code file to be detected is one of multiple source code files corresponding to the target application, and the key symbols are indicators of shared resources. The first processing module is used to search for the associated code block that references the key symbol in the global source code of the target application for each key symbol, filter the write code block that performs write operation on the shared resource through the key symbol in the associated code block, and identify whether the write code block uses a locking mechanism to protect the write operation. The first determining module is configured to, in response to the identification of a target code block in the write code block that does not use a locking mechanism to protect the write operation, determine the write operation on the shared resource in the target code block through the key symbol as a potential risk point of multi-threaded data contention. The generation module is used to generate a list of associated files based on the risk information of potential risk points corresponding to each key symbol, the file path of the source code file to be detected, and the risk code block. The risk information includes the key symbols involved and their corresponding shared resources, the target code block involved, and the file path of the source code file to which the target code block belongs. The acquisition module is used to analyze the list of associated file results based on the high-risk model and obtain the analysis report output by the high-risk model indicating the overall multi-threaded data competition risk.

10. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the multi-threaded risk detection method as described in any one of claims 1 to 8.

Images