Error alarm interpretation method and related equipment

Abstract

The invention discloses a method for explaining an error alarm. The method comprises the following steps of: presenting description information of a plurality of alarm records output by analyzing a code file of a detected item to a user; according to the description information of the multiple alarm records, extracting target code snippets associated with the multiple alarm records and rule description of a target rule; retrieving at least one of a description text of a defect code, a description text of a misinformation scene or an example code snippet identified by the target rule from a knowledge base according to the rule description; according to the description text of the defect code, the description text of the false alarm scene or the example code snippet and the rule description and the target code snippet of the target rule, generating a false alarm conclusion and reason explanation of the multiple alarm records through a language model; and presenting a false alarm conclusion and reason explanation to the user. According to the method, the rule check principle is interpreted through the language model, the program execution process is analyzed and deduced, the reason explanation for generating the misinformation is generated, evidence is provided for the misinformation conclusion, and high availability and reference are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of code development and testing, and particularly relates to a false alarm explanation method, a code management platform, a computing device cluster, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In the code development process, developers usually use code analysis tools to check potential defective codes, such as error codes causing program crashes, execution failures, output not meeting expectations or code with non-standard styles, and alarms are given to the above defective codes so that the defective codes can be repaired in the coding stage, thereby reducing repair and maintenance costs.

[0003] Since static analysis does not execute the code of the program, it cannot accurately determine the logic and results of the program execution, and thus the problems described in the alarm may not be triggered, resulting in false alarms, also known as false positive alarms (FP Alarms). The cost of manual analysis and processing of false positive alarms is very high. Therefore, the industry has proposed an alarm identification scheme that can automatically identify false alarms in the alarms, reduce manual audit time and greatly improve alarm audit efficiency.

[0004] However, the alarm identification scheme can usually only generate the probability of false positives, and cannot provide the reasons for the false positives, lacks explanation, and is difficult to meet the needs of developers. SUMMARY

[0005] The present application provides a false alarm explanation method, which fully utilizes the description information of the alarm record to expand the context, and according to the expanded context and the rule description and the target code segment, the rule checking principle is interpreted through the language model, the program execution process is analyzed and deduced, the reason for generating false positives is generated, the false positive conclusion is provided with evidence, and the method has high usability and referenceability. The present application also provides a code management platform, a computing device cluster, a computer readable storage medium and a computer program product corresponding to the above method.

[0006] In a first aspect, the present application provides a false alarm explanation method. The method is applied to a code management platform. The code management platform is used to explain false alarms in code inspection output. The code management platform can be a software system, which can be a standalone software system or a functional module, plug-in, component or applet integrated in other software. The code management platform can be provided to customers in the form of a software package for self-deployment, such as deployment on a private computing device. The code management platform can also be provided to users in the form of a cloud service, and users can use the corresponding functions or capabilities provided by the code management platform by subscribing to the cloud service. In some examples, the code management platform can also be a hardware system, such as a computing device cluster with false alarm explanation capabilities. The computing device cluster runs and executes the false alarm explanation method of the present application.

[0007] Specifically, the code management platform can present description information of a plurality of alarm records output by analyzing code files of a subject project to a user, extract a target code segment associated with the plurality of alarm records and a rule description of a target rule from the code files of the subject project according to the description information of the plurality of alarm records. Then the code management platform can retrieve at least one of a description text of a defect code, a description text of a false alarm scenario or an example code segment identified by the target rule from a knowledge base according to the rule description of the target rule. The code management platform generates a false alarm conclusion of the plurality of alarm records and a reason explanation corresponding to the false alarm conclusion through a language model according to at least one of the description text of the defect code, the description text of the false alarm scenario or the example code segment, the rule description of the target rule, a false alarm probability and the target code segment, and presents the false alarm conclusion of the plurality of alarm records and the reason explanation corresponding to the false alarm conclusion to the user.

[0008] The method makes full use of the description information of the alarm records, specifically extracts the associated target code segment and the rule description of the target rule according to the description information, retrieves the corresponding description text of the defect code, the description text of the false alarm scenario or the example code segment in the knowledge base based on the rule description to expand the context, and generates the reason explanation for the false alarm according to the expanded context, the rule description and the target code segment through the language model to interpret the rule checking principle, analyze and deduce the program execution process, and provide evidence for the false alarm conclusion, which has high usability and referenceability.

[0009] In some possible implementation manners, the code management platform can generate a prompt according to at least one of the description text of the defect code, the description text of the false positive scenario, or the example code snippet and the rule description of the target rule and the target code snippet, and then infer, according to the prompt, the variable value and the branch path of the code file runtime of the subject project by using the language model, and then generate, according to the variable value and the branch path of the code file runtime of the subject project, the false positive conclusion of the plurality of alarm records and the reason explanation corresponding to the false positive conclusion.

[0010] The method can infer the variable value and the branch path of the code file runtime of the subject project by using the language model, analyze whether the alarm record is a false alarm based on the variable value and the branch path, and thus provide evidence for the false positive conclusion, and has high usability and reference value.

[0011] In some possible implementation manners, the code management platform can further predict, according to the target code snippet associated with the plurality of alarm records and the rule description of the target rule, whether content for explaining the false positive is missing by using the language model. If so, the code management platform can extract the missing content according to the description information of the missing content output by the language model.

[0012] The method can continuously analyze and collect key code content useful for analyzing false positives, including data sources, data flow, and data usage, by using the model question and answer and the agent and the feedback loop of “collection-feedback-re-collection”, and can collect more business-related non-security scenario code content compared with traditional static analysis techniques, and improve the false positive identification accuracy.

[0013] In some possible implementation manners, the code management platform can perform data flow analysis according to the description information of the plurality of alarm records, obtain a data flow propagation path, collect, from the code file of the subject project, a code snippet propagating along the data flow propagation path, and then perform slicing analysis on the code snippet propagating along the data flow propagation path to obtain the target code snippet associated with the plurality of alarm records. In this way, the target code snippet can be accurately extracted by using program analysis techniques such as data flow analysis and slicing analysis, and accurate and comprehensive data can be provided for subsequent false positive reason explanation.

[0014] In some possible implementation manners, the code management platform can further extract a file identifier, a function identifier, or a class identifier associated with the plurality of alarm records, perform slicing analysis on the code snippet propagating along the data flow propagation path to obtain file code, function code, or class code associated with the plurality of alarm records.

[0015] This method models rule descriptions, files / functions / classes, code snippets, and data flow information to learn false alarm code characteristics. It can make full use of code information and alarm record description information. Compared with identification schemes that rely solely on code snippets or data flow information, this method can identify false alarm scenarios with different alarms in different industries and with different inspection rules, thereby improving the accuracy of false alarm identification.

[0016] In some possible implementations, the code management platform can receive the code purpose description and code execution process description associated with the multiple alarm records input by the user, and then extract the target code fragment associated with the multiple alarm records from the code file of the inspected item through the language model based on the code purpose description and the code execution process description.

[0017] In this way, guided by user-input natural language descriptions, the language model can understand code behavior and retrieve target code fragments from code files that match the specified behavior. This allows for the proactive extraction of code matching the query intent from code files through natural language descriptions. This method does not rely on any traditional static analysis tools for data flow and slicing analysis, nor on key performance indicators during program runtime, thus offering high availability.

[0018] In some possible implementations, the code management platform can also infer the false alarm probability of the multiple alarm records based on the target code fragments associated with the multiple alarm records and the rule description of the target rule. Accordingly, the code management platform can generate false alarm conclusions and corresponding explanations for the false alarm conclusions of the multiple alarm records through a language model, based on at least one of the description text of the defective code, the description text of the false alarm scenario, or the example code fragment, as well as the rule description of the target rule, the target code fragment, and the false alarm probability.

[0019] This method can further improve the accuracy of generating false alarm conclusions and explanations of causes by introducing false alarm probability into the prompts.

[0020] In some possible implementations, the code management platform can also obtain and analyze the code files of sample projects, outputting descriptive information of sample alarm records and feedback operations on these records, including blocking or repairing. Then, based on the descriptive information of the sample alarm records, the code management platform extracts the sample code fragments associated with the alarm records and the rule descriptions of the sample rules from the code files of the sample projects. Next, the code management platform fine-tunes the model based on the sample code fragments associated with the alarm records, the rule descriptions of the sample rules, and the feedback operations to obtain an inference model. This inference model is used to infer the false alarm probability.

[0021] In this method, the code management platform collects and analyzes the code files of sample projects, outputting descriptive information of sample alarm records and feedback operations on sample alarm records. The feedback operations can characterize whether the alarm record is a false alarm, and therefore can be used as supervisory information for model fine-tuning, thereby improving the accuracy of the inference model inferring the probability of false alarms.

[0022] Secondly, this application provides a code management platform. The code management platform is used to interpret error alerts output by code inspection, and the code management platform includes:

[0023] The code extraction module is used to present the user with the descriptive information of multiple alarm records output from the analysis of the code file of the inspected item; based on the descriptive information of the multiple alarm records, the module extracts the target code fragments associated with the multiple alarm records and the rule descriptions of the target rules from the code file of the inspected item.

[0024] The false alarm explanation module is used to retrieve at least one of the following from the knowledge base: the description text of the defect code identified by the target rule, the description text of the false alarm scenario, or the example code snippet, based on the rule description of the target rule associated with the multiple alarm records; and to generate a false alarm conclusion and a corresponding explanation of the cause of the false alarm conclusion for the multiple alarm records through a language model based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, the rule description of the target rule, and the target code snippet.

[0025] The false alarm explanation module is also used to present the user with the false alarm conclusions of the multiple alarm records and the explanations of the reasons corresponding to the false alarm conclusions.

[0026] In some possible implementations, the false alarm interpretation module is specifically used for:

[0027] Based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule and the target code snippet, a prompt is generated;

[0028] Based on the prompts, the variable values ​​and branch paths of the code file of the tested item are inferred during runtime using a language model;

[0029] Based on the variable values ​​and branch paths of the code file of the inspected item during runtime, generate false alarm conclusions for the multiple alarm records and corresponding explanations for the reasons for the false alarm conclusions.

[0030] In some possible implementations, the code extraction module is also used for:

[0031] Based on the target code snippets associated with the multiple alarm records and the rule descriptions of the target rules, the language model is used to predict whether content for explaining false alarms is missing.

[0032] If so, the missing content is extracted based on the description information of the missing content output by the language model.

[0033] In some possible implementations, the code extraction module is specifically used for:

[0034] Based on the description information of the multiple alarm records, perform data flow analysis to obtain the data flow propagation path;

[0035] Collect code segments that propagate along the data stream propagation path from the code file of the inspected item;

[0036] Slice analysis is performed on the code segments that propagate along the data flow propagation path to obtain the target code segments associated with the multiple alarm records.

[0037] In some possible implementations, the code extraction module is specifically used for:

[0038] Extract the file identifier, function identifier, or class identifier associated with the multiple alarm records;

[0039] Perform slice analysis on the code segments that propagate along the data flow propagation path to obtain the file code, function code, or class code associated with the multiple alarm records.

[0040] In some possible implementations, the code extraction module is specifically used for:

[0041] Receive the user input of the code purpose description and code execution process description associated with the multiple alarm records;

[0042] Based on the code purpose description and the code execution process description, the target code fragments associated with the multiple alarm records are extracted from the code file of the inspected item using the language model.

[0043] In some possible implementations, the code management platform also includes:

[0044] The false alarm prediction module is used to infer the false alarm probability of the multiple alarm records based on the target code fragment associated with the multiple alarm records and the rule description of the target rule;

[0045] The false alarm interpretation module is specifically used for:

[0046] Based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule, the target code snippet, and the false alarm probability, a language model is used to generate the false alarm conclusions of the multiple alarm records and the corresponding explanations of the causes of the false alarm conclusions.

[0047] In some possible implementations, the false alarm prediction module is further used for:

[0048] The code file of the sample project is obtained and analyzed to output the description information of the sample alarm record and the feedback operation on the sample alarm record, the feedback operation including blocking or repair;

[0049] Based on the description information of the sample alarm record, extract the sample code fragments associated with the sample alarm record and the rule descriptions of the sample rules from the code file of the sample project;

[0050] The model is fine-tuned based on the sample code snippet associated with the sample alarm record, the rule description of the sample rule, and the feedback operation to obtain an inference model, which is used to infer the false alarm probability.

[0051] Thirdly, this application provides a computing device cluster. The computing device cluster includes at least one computing device, which includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is used to execute instructions stored in the at least one memory to cause the computing device or the computing device cluster to perform the error alarm interpretation method as described in the first aspect or any implementation thereof.

[0052] Fourthly, this application provides a computer-readable storage medium storing instructions that instruct a computing device or a cluster of computing devices to execute the error alarm interpretation method described in the first aspect or any implementation thereof.

[0053] Fifthly, this application provides a computer program product containing instructions that, when run on a computing device or a cluster of computing devices, causes the computing device or cluster of computing devices to execute the error alarm interpretation method described in the first aspect or any implementation thereof.

[0054] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0055] To more clearly illustrate the technical methods of this application, the accompanying drawings used will be briefly described below.

[0056] Figure 1 A schematic diagram of the architecture of a code management platform provided in this application;

[0057] Figure 2 A flowchart illustrating the code extraction process provided in this application is provided.

[0058] Figure 3 A flowchart illustrating the prediction of false alarm probability for alarm records by a false alarm prediction module provided in this application;

[0059] Figure 4 A flowchart illustrating the explanation of the causes of false alarms provided in this application is provided.

[0060] Figure 5 A schematic diagram illustrating a service deployment provided for this application;

[0061] Figure 6 A flowchart illustrating a method for interpreting error alarms provided in this application;

[0062] Figure 7 A schematic diagram illustrating an extraction of target code fragments provided in this application;

[0063] Figure 8 A schematic diagram illustrating alarm management for a full-scale engineering code inspection provided in this application;

[0064] Figure 9 A schematic diagram illustrating the explanation of the reasons for generating false alarms provided in this application;

[0065] Figure 10 A schematic diagram of the structure of a computing device provided in this application;

[0066] Figure 11 This application provides a schematic diagram of the structure of a computing device cluster;

[0067] Figure 12 This application provides a schematic diagram of another computing device cluster structure.

[0068] Figure 13 This is a schematic diagram of another computing device cluster provided in this application. Detailed Implementation

[0069] The terms "first" and "second" used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature.

[0070] First, some technical terms involved in the embodiments of this application will be introduced.

[0071] Code inspection refers to the discovery of defective code in a program and the generation of alerts for these defects. Defective code can include, but is not limited to, code that causes program crashes, code that cannot be executed (also simply called error code or bug), code that outputs unexpectedly (also called problematic code or problem), or code with non-standard coding style. Non-standard coding style refers to definitions or assignments that do not conform to coding standards. For example, variable names are not camelCase, or variable names use concatenation operators.

[0072] Code inspection can be achieved by analyzing the code under inspection using code analysis tools. These tools can examine the code according to inspection rules. These rules clearly define the guidelines the code must adhere to, the security issues that may arise from violating these rules, and example code illustrating insecure coding practices.

[0073] False Positives Alarms (FP Alarms) are alarms that do not actually trigger a problem or error. Conversely, alarms that do trigger a problem or error are called Positive Alarms. Specifically, when the code analysis tool is a static analysis tool, static analysis does not execute the program's code and cannot accurately determine the program's execution logic and results. Therefore, the problem described by the alarm may not be triggered, resulting in an erroneous alarm, i.e., a false alarm.

[0074] Currently, the industry offers code inspection false alarm identification solutions to automatically detect false alarms, reduce manual auditing time, and greatly improve alarm auditing efficiency. Code inspection false alarm identification solutions can be divided into three categories: static program analysis, mathematical statistics, and machine learning. Static program analysis-based false alarm identification solutions perform syntax checks, data flow and control flow analysis on the inspected code, extract intermediate representations of the false alarm code, and identify false alarms by developing query rules to retrieve and match these intermediate representations. Mathematical statistics-based false alarm identification solutions statistically analyze the signatures, file dependencies, and other descriptive information of the false alarm code, and build a probabilistic model of the relevant variables affecting false alarms based on the statistical analysis results. The probability of a false alarm is then inferred from the probabilistic model to identify the false alarm. Machine learning-based false alarm identification solutions utilize the code fragment features of positive and false alarms to train a classifier model, which then predicts the probability that an alarm is a false alarm.

[0075] With the rapid development of artificial intelligence (AI) technology, false alarm detection solutions based on machine learning have become mainstream. However, these solutions rely on high-quality alert codes and false alarm annotations to train predictive classifier models. Since predictive classifier models can only generate the probability of false alarms and cannot provide explanations for the causes of these false alarms, they lack interpretability.

[0076] In view of this, this application provides a method for interpreting error alerts. This method is applied to a code management platform. The code management platform is used to interpret error alerts output by code inspection. The code management platform can be a software system, which can be a standalone software system or a functional module, plugin, component, or applet integrated into other software. The code management platform can be provided to customers as a software package, which customers can deploy themselves, for example, on private computing devices. The code management platform can also be provided to users as a cloud service, whereby users subscribe to the cloud service to use the corresponding functions or capabilities provided by the code management platform. In some examples, the code management platform can also be a hardware system, such as a cluster of computing devices with error alert interpretation capabilities. When the computing device cluster is running, the error alert interpretation method of this application is executed.

[0077] Specifically, the code management platform can present users with descriptive information of multiple alarm records output from the analysis of the code files of the inspected project. Based on the descriptive information of the multiple alarm records, it extracts the target code fragments associated with the multiple alarm records and the rule descriptions of the target rules from the code files of the inspected project. Then, based on the rule descriptions of the target rules associated with the multiple alarm records, the code management platform retrieves at least one of the following from the knowledge base: description text of the defective code identified by the target rule, description text of the false alarm scenario, or example code fragment. Based on at least one of the description text of the defective code, description text of the false alarm scenario, or example code fragment, as well as the rule description of the target rule, the false alarm probability, and the target code fragment, the code management platform generates false alarm conclusions and corresponding explanations for the multiple alarm records through a language model, and presents the false alarm conclusions and corresponding explanations for the multiple alarm records to the user.

[0078] This method makes full use of the descriptive information in alarm records. Specifically, it extracts the relevant target code fragments and the rule descriptions of the target rules based on the descriptive information. Based on the rule descriptions, it retrieves the corresponding description texts of defect codes, false alarm scenarios, or example code fragments from the knowledge base to expand the context. Based on the expanded context, rule descriptions, and target code fragments, it interprets the rule checking principle, analyzes and derives the program execution process through a language model, generates explanations of the causes of false alarms, and provides evidence for the conclusions of false alarms. It has high usability and reference value.

[0079] To make the technical solution of this application clearer and easier to understand, the system architecture of the code management platform of this application is described below with reference to the accompanying drawings.

[0080] See Figure 1 The diagram illustrates the architecture of a code management platform 10. The platform includes a code extraction module 102, a false alarm prediction module 104, and a false alarm explanation module 106. The false alarm prediction module 104 is optional; in some examples, the code management platform 10 may not include it, and the false alarm explanation module 106 can directly perform reasoning analysis on alarm records to output false alarm conclusions and provide explanations for the causes of these conclusions. The false alarm explanation module 106 can be a newly added module used to extract key code content and explain the causes of false alarms. The functions of each module are described in detail below.

[0081] The code extraction module 102 is used to present the user with the description information of multiple alarm records output by analyzing the code file of the inspected item, and then extract the target code fragments associated with the multiple alarm records and the rule descriptions of the target rules from the code file of the inspected item based on the description information of the multiple alarm records.

[0082] The target code snippets associated with multiple alarm records can include code snippets related to alarm points, such as alarm point variable definitions and declarations. Alarm points can include the flare-up of a problem or points on the propagation path. The code extraction module 102 can extract target code snippets through static program analysis and large model agents.

[0083] Specifically, the code extraction module 102 performs static analysis on the code files of the inspected project (e.g., all code files within the project) to obtain the lines of code indicating the data source, data flow, and data purpose of the alarms. Based on these lines of code, it obtains the target code fragment. Specifically, for alarm point variables, the code extraction module 102 can perform data flow analysis and program slicing analysis on the code files of the inspected project to obtain the target code fragment. This target code fragment contains crucial information for explaining false alarms and is also known as a critical code fragment.

[0084] In some possible implementations, the code extraction module 102 also supports language model question answering, such as large language model (LLM) question answering, to determine whether sufficient code content has been extracted. If the extracted code content is insufficient, the code extraction module 102 can request the large model to provide information on the code content that has not yet been extracted, so as to continue extraction based on this information. In specific implementations, the code extraction module 102 can predict whether there is missing content for explaining false alarms based on the target code fragments associated with multiple alarm records and the rule descriptions of the target rules, using the language model. If so, the missing content is extracted based on the description information of the missing content output by the language model.

[0085] See Figure 2 The flowchart shown illustrates a code extraction module 102 extracting code. First, the code extraction module 102 performs data flow analysis based on the description information of the multiple alarm records to obtain the data flow propagation path. The data flow propagation path is a graph data structure representing the possible states and flow processes of variables in the code file of the inspected project during execution. The code extraction module 102 collects code segments that propagate along the data flow propagation path from the code file of the inspected project. Then, the code extraction module 102 performs slice analysis on the code segments that propagate along the data flow propagation path to obtain target code segments associated with the multiple alarm records. Specifically, the code extraction module 102 can extract file identifiers, function identifiers, or class identifiers associated with the multiple alarm records, and perform slice analysis on the code segments that propagate along the data flow propagation path to obtain file code, function code, or class code associated with the multiple alarm records. It should be noted that the code extraction module 102 can also extract the rule description of the target rules associated with the multiple alarm records based on the description information of the multiple alarm records.

[0086] Furthermore, the code extraction module 102 can assemble the target code fragments associated with multiple alarm records and the rule descriptions of the target rules to obtain a prompt. Based on the prompt, the large language model predicts whether content used to explain false alarms is missing. If so, it outputs the description information of the missing content to the large model agent. The description information of the missing content may include the identifier of the missing variable, function, class, or configuration information, such as the missing variable name, function name, or class name. The large model agent returns the description information of the missing content output by the large language model to the code extraction module 102, and the code extraction module 102 extracts the missing content based on the description information.

[0087] The false alarm prediction module 104 is used to infer the probability that multiple alarm records are false alarms based on the target code fragments associated with multiple alarm records and the rule descriptions of the target rules. Specifically, the false alarm prediction module 104 can infer the probability that multiple alarm records are false alarms based on the target code fragments and rule descriptions extracted by the code extraction module 102, using an inference model.

[0088] The inference model can be trained. An efficient training method is model fine-tuning. Specifically, the false alarm prediction module 104 can obtain the code file of the sample item, analyze the descriptive information of multiple alarm records output, and the feedback operations on the alarm records. These feedback operations include masking or repairing. Typically, when an alarm record is a false alarm, the feedback operation is masking; when an alarm record is a positive alarm, the feedback operation is repairing. Based on this, the feedback operations can serve as annotation or supervision information for model fine-tuning. The false alarm prediction module 104 can extract sample code fragments associated with multiple alarm records and rule descriptions of sample rules from the code file of the sample item based on the descriptive information of the multiple alarm records. It then performs model fine-tuning based on the sample code fragments associated with the multiple alarm records, the rule descriptions of the sample rules, and the feedback operations to obtain the inference model. The inference model is used to infer the probability that multiple alarm records are false alarms. This allows for full utilization of code information and alarm log descriptions to identify diverse false alarm scenarios that may arise from different industries and inspection rules, and to provide the probability that an alarm log is a false alarm.

[0089] Next, the process of the false alarm prediction module 104 predicting the probability that multiple alarm records are false alarms (also referred to as false alarm probability) will be explained in detail.

[0090] See Figure 3 The flowchart shown illustrates a false alarm prediction module 104 predicting the false alarm probability of alarm records. First, the module inputs a rule description into a text encoder to generate a text embedding vector, and inputs a target code snippet into a code editor to generate a code embedding vector. Further, the module can also input text descriptions such as filenames / function names / class names into the text encoder to generate text embedding vectors, and input a data flow propagation graph into the code encoder to generate code embedding vectors. Then, the module jointly encodes the text embedding vectors and code embedding vectors to obtain a code representation. The inference model, through fine-tuning, can distinguish the differences between the code representations of false alarms and positive alarms. Based on this, the module can input the code representation into the inference model and output the probability that multiple alarm records are erroneous alarms (belonging to the category of false alarms).

[0091] The false alarm explanation module 106 is used to retrieve at least one of the following from the knowledge base: the description text of the defect code identified by the target rule, the description text of the false alarm scenario, or the example code snippet, based on the rule description of the target rule associated with multiple alarm records. Based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule, the false alarm probability, and the target code snippet, the module generates the false alarm conclusions and the corresponding explanations for the false alarm conclusions for multiple alarm records through a language model, and presents the false alarm conclusions and the corresponding explanations for the false alarm conclusions to the user.

[0092] Among them, the false alarm explanation module 106 can explain the false alarm conclusion based on the description information of the alarm record and the target code fragment, guided by the false alarm prediction result of the previous step, and interpret, analyze and deduce the execution process of the rule checking principle through language model prompts (such as large model).

[0093] See Figure 4 The flowchart shown illustrates a false alarm explanation module 106 generating explanations for the causes of false alarms. First, the module retrieves descriptions of defective codes (such as problematic or incorrect codes) identified by the target rules, descriptions of false alarm scenarios, and example code snippets from the knowledge base. These retrieval results are then injected into the prompts as domain knowledge, providing language models, including large-scale models, with context from the code inspection domain to enhance the depth and professionalism of their explanations. Next, the module can also inject a textual description of the false alarm prediction results into the prompts, guiding the language model to answer the reasons for the false alarms and improving the language model's task compliance and the accuracy of its explanations. Finally, the module can parse and evaluate the language model's response, forming a false alarm conclusion and explanation, and presenting this conclusion and explanation to the user.

[0094] Figure 1 The code management platform 10 is introduced from the perspective of functional modularity. The following section describes it from the perspective of hardware physicalization. The code management platform 10 can be deployed in a distributed manner on servers and terminals. The functional modules of the code management platform 10 can be further broken down and deployed as services in containers.

[0095] See Figure 5 The diagram shows a service deployment scenario where six Docker containers are partitioned on the server to deploy the Gateway service, Data Preprocessing service, Model Inference service, Data Management service, Vector Library service, Model Management service, Model Inference Engine, and Task Orchestration service.

[0096] The Gateway service handles requests to the server, requesting false positive conclusions and explanations. It can be deployed within a Docker container (Docker1). The Data Preprocessing service performs data stream and slice analysis, deployed within a Docker container (Docker2). The Vector Library service retrieves rule descriptions, example code for positive and false positives, and the corresponding embedding vectors, calculating similarity between vectors, deployed within a Docker container (Docker5). The Model Inference service inputs the processed data into the requested model to obtain inference results, deployed within a Docker container (Docker3). The Model Management service, Model Inference Engine, Task Orchestration service, Prediction Model, Question Answering Model, and Agent are deployed together within a Docker container (Docker6). The Model Management service maintains the versions, interfaces, and routing tables of the Prediction Model and Question Answering Model; the Task Orchestration service plans the model identifiers (IDs) and calling order of the models to be called based on the tasks to be executed (code extraction / false positive prediction / false positive explanation); and the Model Inference Engine loads the corresponding model based on the model ID.

[0097] Terminals may include code inspection services for integrated development environments (IDEs) or code inspection services for web applications (web apps), providing false positive identification services for code inspection on user devices such as personal computers (PCs) IDE plugins or web platforms (such as continuous integration pipelines).

[0098] Based on the aforementioned code management platform 10, this application also provides a method for interpreting error alarms. The method for interpreting error alarms in this application will be described in detail below with reference to the accompanying drawings.

[0099] See Figure 6 The flowchart shown illustrates a method for interpreting error alarms, which includes the following steps:

[0100] S602, the code management platform 10 presents the user with descriptive information of multiple alarm records output from the analysis of the code files of the inspected project.

[0101] The inspected item refers to the project being inspected, which in turn refers to a software engineering project. The inspected item may include multiple code files. For example, the inspected item may include class files and resource files. The code management platform 10 can analyze the code files to check for defective code and issue alerts for detected defects. The code management platform 10 can use static analysis or dynamic analysis to analyze the code files. For ease of description, this application uses static analysis as an example.

[0102] The code management platform 10 can obtain defective code in the code files of the inspected project through static analysis, such as erroneous code, problematic code, or non-style code, and then output alarm records for the aforementioned defective code. The code management platform 10 can present the user with descriptive information of multiple alarm records output from the analysis of the code files of the inspected project. This descriptive information can include alarm location and alarm type, where alarm location can be the line of code where the alarm is generated, and alarm type can be the type of alarm generated, such as null pointer exception or unsafe random number.

[0103] S604, the code management platform 10 extracts the target code fragments associated with the multiple alarm records and the rule descriptions of the target rules from the code file of the inspected project based on the description information of the multiple alarm records.

[0104] The code management platform 10 can extract code through program analysis or through a question-and-answer method using a language model. These will be explained in detail below.

[0105] In some possible implementations, the code management platform 10 can perform data flow analysis based on the description information of the multiple alarm records to obtain the data flow propagation path. Data flow analysis is a static analysis method, specifically a technique used to obtain information about how data flows along the program execution path. The process of performing data flow analysis may involve calculating a set of values ​​(e.g., state) corresponding to a program point (e.g., a basic block entry / exit point), which includes data-related information. One implementation of data flow analysis is to set a data flow equation for each node in the control flow graph and solve the problem by repeatedly calculating the output of each node's local input until the state no longer changes. The code management platform 10 can then collect code segments that propagate along the data flow propagation path from the code file of the inspected project.

[0106] The code management platform 10 can perform slice analysis on code segments propagating along the data flow propagation path to obtain target code segments associated with multiple alarm records. Slice analysis refers to extracting code segments that meet certain constraints. Slice analysis can include three parts: dependency extraction, slice rule formulation, and slice generation. Dependency extraction can involve extracting data flow and control flow from code files (e.g., code segments propagating along the data flow propagation path based on data flow analysis results), and forming a dependency graph based on these data flow and control flow. Then, the code management platform 10 can design slice criteria according to specific program analysis requirements. Slice criteria identify code segments of interest within a program; these segments can be related to a variable (such as an alarm point variable). The code management platform 10 can select appropriate program slicing methods based on the slice criteria, analyze and process dependencies (such as dependency graphs), and thus generate slices.

[0107] It should be noted that the code management platform 10 can extract file identifiers, function identifiers, or class identifiers associated with multiple alarm records. Then, the code management platform 10 performs slice analysis on the code segments that propagate along the data flow path to obtain the file code, function code, or class code associated with multiple alarm records.

[0108] In other possible implementations, the code management platform 10 can receive user input describing the purpose and execution process of code associated with multiple alarm records. Then, based on these descriptions, it extracts target code fragments associated with the alarm records from the code files of the inspected project using a language model (such as LLM). Compared to extraction based on program analysis, the language model-based question-and-answer approach does not rely on any traditional static analysis tools for data flow and slicing analysis, nor on key performance indicators (KPIs) during program execution. Instead, guided by the user's natural language description, the language model understands the target code behavior and retrieves target code fragments matching that behavior from the code files. This solution allows users to proactively extract code matching their query intent from code files using natural language descriptions, requiring no specialized knowledge and improving user experience.

[0109] The code management platform 10 can extract alarm point variables and alarm types based on the description information of multiple alarm records. Based on these alarm point variables and alarm types, the code management platform 10 can determine the rule description of the target rule associated with the multiple alarm records. Specifically, the code management platform 10 can search the rule base based on the alarm point variables and alarm types to determine the rule description of the target rule associated with the multiple alarm records.

[0110] Furthermore, the code management platform 10 can also predict, through a language model, whether content for explaining false alarms is missing, based on the target code fragments associated with multiple alarm records and the rule descriptions of the target rules. If so, the code management platform 10 can extract the missing content based on the description information of the missing content output by the language model.

[0111] The following example illustrates this. See [link / reference] Figure 7 The diagram illustrates a method for extracting target code snippets. The code management platform 10 can extract source, sink, and intermediate path code through data flow analysis; in this example, this could be code related to the variable `target`. The platform can then extract code that `target` depends on. Furthermore, the platform can extract target code snippets by tracing function calls and class inheritance / polymorphism. The platform can predict whether the extracted content will generate false positives using a model-based question-and-answer approach. If not, it can output a description of the missing content. The platform can then use an agent to collect this missing content. The agent can extract the missing content based on the description of the missing content output by a language model such as an LLM.

[0112] S606, the code management platform 10 infers the false alarm probability of multiple alarm records based on the target code fragments associated with multiple alarm records and the rule descriptions of the target rules.

[0113] The code management platform 10 can infer the probability that multiple alarm records are false alarms through an inference model, i.e., infer the false alarm probability of multiple alarm records. This inference model can be obtained by fine-tuning a language model, such as LLM or tiny LLM. Specifically, the code management platform 10 obtains the code files of sample projects, analyzes the output description information of the sample alarm records, and the feedback operations on the alarm records. These feedback operations include masking or repairing. Then, based on the description information of the sample alarm records, it extracts the sample code fragments associated with the sample alarm records and the rule descriptions of the sample rules from the code files of the sample projects. Next, it fine-tunes the model based on the sample code fragments associated with the sample alarm records, the rule descriptions of the sample rules, and the feedback operations to obtain the inference model. This inference model is used to infer the false alarm probability.

[0114] The code management platform 10 can input the target code fragments associated with multiple alarm records and the rule descriptions of the target rules into the inference model, and obtain the probability that the multiple alarm records output by the inference model are erroneous alarms.

[0115] In alarm management scenarios, the code management platform 10 can not only predict the probability of an alarm being a false alarm or a valid alarm, but also predict the type of false alarm, such as tool-related false alarms, non-problem / risk-free alarms assessed by business, and alarms from third-party components and compatible third-party components. Taking alarm management during a full-scale engineering code inspection as an example, such as... Figure 8 As shown, for each alarm record, the code management platform 10 predicts the probability that the alarm record is a false alarm or a valid alarm. For false alarms, the code management platform 10 can also predict the type of false alarm. For example, for line 29, a null pointer exception, the code management platform 10 predicts through reasoning that the false alarm type is a tool false alarm. Furthermore, the code management platform 10 can determine whether manual handling is required and recommend alarms that require priority manual handling. The code management platform 10 can also provide alarm handling suggestions, which may include blocking or repairing the alarm.

[0116] The above-described S606 is an optional step in the embodiments of this application. The method for interpreting error alarms in this application may also omit S606. For example, the code management platform 10 may construct prompts based on the target code fragment and the rule description of the target rule, without having to include the false alarm probability as part of the prompt.

[0117] S608, the code management platform 10 retrieves at least one of the following from the knowledge base based on the rule description of the target rule associated with multiple alarm records: the description text of the defect code identified by the target rule, the description text of the false alarm scenario, or the example code snippet.

[0118] The knowledge base can store inspection rules, description text of defective codes identified by the inspection rules, description text of false alarm scenarios, and example code snippets. Example code snippets can include at least one of positive or negative example code snippets. The code management platform 10 can search the knowledge base based on the rule description of the target rule to obtain description text of defective codes, description text of false alarm scenarios, or example code snippets that match the rule description of the target rule.

[0119] S610 and the code management platform 10 generate false alarm conclusions and corresponding explanations for multiple alarm records through a language model based on at least one of the following: description text of defective code, description text of false alarm scenarios, or example code snippets, as well as the rule description of the target rule, false alarm probability, and target code snippets.

[0120] The code management platform 10 can generate prompts based on at least one of the following: the description text of the defective code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule, the false alarm probability, and the target code snippet. Then, based on the prompts, it can infer the variable values ​​and branch paths of the code file of the inspected project during runtime through a language model. Subsequently, the code management platform 10 can generate false alarm conclusions and corresponding explanations for the causes of multiple alarm records based on the variable values ​​and branch paths of the code file of the inspected project during runtime.

[0121] The above-described S610 is a specific implementation of generating false alarm conclusions and corresponding explanations for multiple alarm records through a language model, based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule and the target code snippet. In practical applications, false alarm conclusions and their explanations can also be obtained through other methods. For example, when the code management platform 10 does not predict the false alarm probability, it can directly assemble a prompt based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule and the target code snippet, and input the prompt into the language model for reasoning to obtain the false alarm conclusions and their corresponding explanations.

[0122] S612, the code management platform 10 presents users with the false alarm conclusions and explanations of the reasons for the false alarm conclusions for multiple alarm records.

[0123] The code management platform 10 can present the false alarm conclusions and corresponding explanations for multiple alarm records to the user through a graphical interface. Furthermore, the code management platform 10 can also receive user feedback on the false alarm conclusions and corresponding explanations for multiple alarm records. This feedback can include either blocking or fixing false alarms.

[0124] In the defect detection and risk prediction scenarios of code review activities, the code management platform 10 analyzes the target code segment through a language model (such as LLM), interprets the program execution logic of the target code segment (alarm code), infers the values ​​that the alarm code variables may be assigned during the runtime phase, as well as the branches that may be entered, and infers the abnormal and error states that the target code segment may experience during the runtime phase.

[0125] The following example, using the "Ensure resources are shut down after use" check rule, illustrates the process of interpreting false alarms. Figure 9As shown, the code management platform 10 retrieves domain knowledge from the knowledge base based on the rule descriptions of the target rules associated with multiple alarm records. The code management platform 10 then assembles the domain knowledge into a prompt template to generate a prompt. The prompt template may include task descriptions, steps, and response format requirements. The domain knowledge may be structured rule descriptions and rule examples. The code management platform 10 then learns from the prompt using a language model to infer and generate a response. The code management platform 10 can parse the response to generate a false alarm conclusion and corresponding explanations.

[0126] As described above, the error alarm interpretation method of this application makes full use of the descriptive information of the alarm record. Specifically, it extracts the relevant target code fragments and the rule descriptions of the target rules based on the descriptive information. Based on the rule descriptions, it retrieves the corresponding description texts of defective codes, description texts of false alarm scenarios, or example code fragments from the knowledge base to expand the context. Based on the expanded context, rule descriptions, false alarm probabilities, and target code fragments, it interprets the rule checking principle, analyzes and derives the program execution process through a language model, generates explanations of the causes of false alarms, and provides evidence for the conclusions of false alarms. It has high usability and reference value.

[0127] Moreover, compared with identification schemes that rely solely on code snippets or data stream information, this method models rule descriptions, files / functions / classes, code snippets, and data streams to learn false alarm code characteristics. This allows for full utilization of code information and alarm description information, enabling the identification of different false alarm scenarios across various industries and inspection rules, thereby improving the accuracy of false alarm identification.

[0128] Furthermore, this method continuously analyzes and collects key code content that is useful for analyzing false alarms through large model question answering, large model intelligent agents, and a "collection-feedback-recollection" feedback loop. It can collect more business-related non-security scenario code content and improve the accuracy of false alarm identification.

[0129] It should be noted that the above embodiments are mainly illustrated using static analysis scenarios. In practical applications, the technical solutions of this application can also be applied to technical fields such as dynamic code analysis, software component analysis, and open-source vulnerability management. In the field of dynamic analysis, the code extraction module 102 can combine techniques for analyzing program runtime KPIs to infer code segments that may cause problems during program runtime (such as resource contention, blocking, deadlock, etc. due to concurrency). Alternatively, it can combine penetration testing techniques to infer code segments that may cause problems based on the results of penetration testing, and explain the process and cause of the problems. Unlike static analysis scenarios, in dynamic analysis scenarios, the input can also include additional program runtime KPIs (such as code line execution delay, execution return values, or error codes). By monitoring the abnormal state of KPIs, it is possible to infer security problems that may be caused during program execution and issue alarms; the false alarm prediction module 104 analyzes all code segments that may cause problems and their corresponding abnormal KPI states and alarm description information to identify false alarms in the alarms.

[0130] In the field of software component analysis, the false positive explanation module 106 can combine third-party component descriptions and code content to check and analyze the correctness of third-party component versions, vulnerabilities, usage processes, and dependencies, infer the code segments that may cause problems, and explain the process and cause of the problems. The difference from static analysis scenarios is that in software component analysis scenarios, the input includes additional information about the software component analysis process and the analysis results.

[0131] In the field of open-source vulnerability management, the false positive prediction module 104 can predict the classification, risk level, and impact scope of open-source code vulnerabilities. By extracting code snippets related to malicious behavior of vulnerabilities, analyzing the execution process of the code involved in the alert, it infers whether security issues will be caused and the probability of false positives. It also compares and analyzes the results with open-source code vulnerability standards to predict the classification of vulnerabilities and the adverse effects and consequences on programs or systems.

[0132] Based on the aforementioned method for interpreting error alerts, this application also provides a code management platform 10. The code management platform 10 is used to interpret error alerts output by code inspection. For example... Figure 1 As shown, the code management platform 10 includes a code extraction module 102, a false alarm prediction module 104, and a false alarm explanation module 106. The false alarm prediction module 104 is optional. The following is a detailed description of each functional module.

[0133] The code extraction module 102 is used to present the user with the description information of multiple alarm records output by analyzing the code file of the inspected item; and to extract the target code fragments associated with the multiple alarm records and the rule descriptions of the target rules from the code file of the inspected item based on the description information of the multiple alarm records.

[0134] The false alarm explanation module 106 is used to retrieve at least one of the following from the knowledge base: the description text of the defect code identified by the target rule, the description text of the false alarm scenario, or the example code snippet, based on the rule description of the target rule associated with the multiple alarm records; and to generate a false alarm conclusion and a corresponding explanation of the cause of the false alarm conclusion for the multiple alarm records through a language model based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, the rule description of the target rule, and the target code snippet.

[0135] The false alarm explanation module 106 is also used to present the false alarm conclusions of the multiple alarm records and the explanations of the reasons corresponding to the false alarm conclusions to the user.

[0136] For example, the code extraction module 102 and the false alarm explanation module 106 described above can be implemented in hardware or in software.

[0137] When implemented in software, the code extraction module 102 and the false alarm explanation module 106 can be applications running on computing devices, such as computing engines. These applications can also be virtualized and provided to users as virtualization services. Virtualization services can include virtual machine (VM) services, bare metal server (BMS) services, or container services. VM services can be services that use virtualization technology to create virtual machine (VM) resource pools on multiple physical hosts to provide VMs for users to use on demand. BMS services are services that use virtualization technology to create BMS resource pools on multiple physical hosts to provide BMS for users to use on demand. Container services are services that use virtualization technology to create container resource pools on multiple physical hosts to provide containers for users to use on demand. A VM is a simulated virtual computer, that is, a logical computer. A BMS is a scalable, high-performance computing service with computing performance indistinguishable from traditional physical machines and features secure physical isolation. A container is a kernel virtualization technology that can provide lightweight virtualization to isolate user space, processes, and resources. It should be understood that the VM service, BMS service, and container service mentioned above are merely specific examples. In practical applications, virtualization services can also include other lightweight or heavyweight virtualization services, which are not specifically limited here.

[0138] When implemented in hardware, the code extraction module 102 and the false alarm explanation module 106 may include at least one computing device, such as a server. Alternatively, the code extraction module 102 and the false alarm explanation module 106 may also be devices implemented using application-specific integrated circuits (ASICs) or programmable logic devices (PLDs). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0139] In some possible implementations, the false alarm interpretation module 106 is specifically used for:

[0140] Based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule and the target code snippet, a prompt is generated;

[0141] Based on the prompts, the variable values ​​and branch paths of the code file of the tested item are inferred during runtime using a language model;

[0142] Based on the variable values ​​and branch paths of the code file of the inspected item during runtime, generate false alarm conclusions for the multiple alarm records and corresponding explanations for the reasons for the false alarm conclusions.

[0143] In some possible implementations, the code extraction module 102 is further used for:

[0144] Based on the target code snippets associated with the multiple alarm records and the rule descriptions of the target rules, the language model is used to predict whether content for explaining false alarms is missing.

[0145] If so, the missing content is extracted based on the description information of the missing content output by the language model.

[0146] In some possible implementations, the code extraction module 102 is specifically used for:

[0147] Based on the description information of the multiple alarm records, perform data flow analysis to obtain the data flow propagation path;

[0148] Collect code segments that propagate along the data stream propagation path from the code file of the inspected item;

[0149] Slice analysis is performed on the code segments that propagate along the data flow propagation path to obtain the target code segments associated with the multiple alarm records.

[0150] In some possible implementations, the code extraction module 102 is specifically used for:

[0151] Extract the file identifier, function identifier, or class identifier associated with the multiple alarm records;

[0152] Perform slice analysis on the code segments that propagate along the data flow propagation path to obtain the file code, function code, or class code associated with the multiple alarm records.

[0153] In some possible implementations, the code extraction module 102 is specifically used for:

[0154] Receive the user input of the code purpose description and code execution process description associated with the multiple alarm records;

[0155] Based on the code purpose description and the code execution process description, the target code fragments associated with the multiple alarm records are extracted from the code file of the inspected item using the language model.

[0156] In some possible implementations, the code management platform 10 further includes:

[0157] The false alarm prediction module 104 is used to infer the false alarm probability of the multiple alarm records based on the target code fragment associated with the multiple alarm records and the rule description of the target rule;

[0158] The false alarm interpretation module 106 is specifically used for:

[0159] Based on at least one of the description text of the defect code, the description text of the false alarm scenario, or the example code snippet, as well as the rule description of the target rule, the target code snippet, and the false alarm probability, a language model is used to generate the false alarm conclusions of the multiple alarm records and the corresponding explanations of the causes of the false alarm conclusions.

[0160] The false alarm prediction module 104 can be implemented in hardware or software. When implemented in software, the false alarm prediction module 104 can be an application running on a computing device, such as a VM service, BMS service, or container service. When implemented in hardware, the false alarm prediction module 104 can include at least one computing device, such as a server. Alternatively, the false alarm prediction module 104 can also be a device implemented using an ASIC or a PLD.

[0161] In some possible implementations, the false alarm prediction module 104 is further configured to:

[0162] The code file of the sample project is obtained and analyzed to output the description information of the sample alarm record and the feedback operation on the sample alarm record, the feedback operation including blocking or repair;

[0163] Based on the description information of the sample alarm record, extract the sample code fragments associated with the sample alarm record and the rule descriptions of the sample rules from the code file of the sample project;

[0164] The model is fine-tuned based on the sample code snippet associated with the sample alarm record, the rule description of the sample rule, and the feedback operation to obtain an inference model, which is used to infer the false alarm probability.

[0165] This application also provides a computing device 1000. For example... Figure 10 As shown, the computing device 1000 includes a bus 1002, a processor 1004, a memory 1006, and a communication interface 1008. The processor 1004, the memory 1006, and the communication interface 1008 communicate with each other via the bus 1002. The computing device 1000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1000.

[0166] Bus 1002 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 10 The bus 1002 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (e.g., memory 1006, processor 1004, communication interface 1008).

[0167] The processor 1004 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0168] The memory 1006 may include volatile memory, such as random access memory (RAM). The memory 1006 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD). The memory 1006 stores executable program code, which the processor 1004 executes to implement the aforementioned error alarm interpretation method. Specifically, the memory 1006 stores instructions from the code management platform 10 for executing the error alarm interpretation method. For example, the memory 1006 stores instructions for executing the functions of the code extraction module 102 and the false alarm interpretation module 106; furthermore, the memory 1006 may also store instructions for executing the functions of the false alarm prediction module 104.

[0169] The communication interface 1008 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1000 and other devices or communication networks.

[0170] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0171] like Figure 11 As shown, the computing device cluster includes at least one computing device 1000. The memory 1006 of one or more computing devices 1000 in the computing device cluster may store instructions from the same code management platform 10 for executing error alarm interpretation methods.

[0172] In some possible implementations, one or more computing devices 1000 in the computing device cluster can also be used to execute some instructions of the code management platform 10 for executing the error alarm interpretation method. In other words, a combination of one or more computing devices 1000 can jointly execute the instructions of the code management platform 10 for executing the error alarm interpretation method.

[0173] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster can store different instructions for executing some functions of the code management platform 10.

[0174] Figure 12 One possible implementation is shown. For example... Figure 12 As shown, two computing devices 1000A and 1000B are connected via a communication interface 1008. The memory in computing device 1000A stores instructions for executing the functions of the code extraction module 102. The memory in computing device 1000B stores instructions for executing the functions of the false alarm interpretation module 106. Furthermore, the memory in computing device 1000A may also store instructions for executing the functions of the false alarm prediction module 104. In other words, the memory 1006 of computing devices 1000A and 1000B jointly stores instructions used by the code management platform 10 to execute the error alarm interpretation method.

[0175] Figure 12 The connection method between the computing device clusters shown can be considered because the error alarm interpretation method provided in this application requires a large amount of computing resources to infer and generate false alarm conclusions and corresponding explanations. Therefore, it is considered to dedicate the functions implemented by the false alarm interpretation module 106 to independent computing devices. For example, the functions implemented by the code extraction module 102 are dedicated to computing device 1000A, and the functions implemented by the false alarm interpretation module 106 are dedicated to computing device 1000B. Optionally, the code management platform 10 may also include a false alarm prediction module 104, the functions of which can be dedicated to computing device 1000A.

[0176] It should be understood that Figure 12 The functions of computing device 1000A shown can also be performed by multiple computing devices 1000. Similarly, the functions of computing device 1000B can also be performed by multiple computing devices 1000.

[0177] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN), a local area network (LAN), or similar. Figure 13 One possible implementation is shown. For example... Figure 13 As shown, the two computing devices 1000C and 1000D are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this type of implementation, the memory 1006 in computing device 1000C stores instructions for executing the functions of the code extraction module 102 and the false alarm prediction module 104. Simultaneously, the memory 1006 in computing device 1000D stores instructions for executing the functions of the false alarm interpretation module 106.

[0178] Figure 13The connection method between the computing device clusters shown can be based on the fact that the error alarm interpretation method provided in this application requires a large amount of computing resources to generate false alarm conclusions and cause explanations. Therefore, it is considered that the function implemented by the false alarm interpretation module 106 is executed by an independent computing device, such as computing device 1000D.

[0179] It should be understood that Figure 13 The functions of the computing device 1000C shown can also be performed by multiple computing devices 1000. Similarly, the functions of the computing device 1000D can also be performed by multiple computing devices 1000.

[0180] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-described method for interpreting error alarms applied to the code management platform 10.

[0181] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute the aforementioned error alarm interpretation method.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of interpreting false alarms, characterized by The method is applied to a code management platform for interpreting error alarms of code inspection output, and comprises the following steps: presenting description information of a plurality of alarm records output by analyzing a code file of a project under inspection to a user; extracting a target code segment and a rule description of a target rule associated with the plurality of alarm records from the code file of the project under inspection according to the description information of the plurality of alarm records; retrieving at least one of description text of a defect code, description text of a false alarm scenario or an example code segment of the target rule identified by the target rule from a knowledge base according to the rule description of the target rule associated with the plurality of alarm records; generating a false alarm conclusion of the plurality of alarm records and a reason explanation corresponding to the false alarm conclusion by a language model according to at least one of the description text of the defect code, the description text of the false alarm scenario or the example code segment and the rule description of the target rule and the target code segment; presenting the false alarm conclusion of the plurality of alarm records and the reason explanation corresponding to the false alarm conclusion to the user.

2. The method of claim 1, wherein, The method further comprises: predicting whether content for explaining a false alarm is missing by the language model according to the target code segment and the rule description of the target rule associated with the plurality of alarm records; if yes, extracting the missing content according to description information of the missing content output by the language model. The method further comprises:

3. The method according to claim 1 or 2, characterized in that, extracting a target code segment associated with the plurality of alarm records from the code file of the project under inspection according to the description information of the plurality of alarm records, comprising: performing data flow analysis according to the description information of the plurality of alarm records to obtain a data flow propagation path; collecting a code segment propagating along the data flow propagation path from the code file of the project under inspection; 4. The method according to any one of claims 1 to 3, characterized in that, performing slicing analysis on the code segment propagating along the data flow propagation path to obtain the target code segment associated with the plurality of alarm records. The method further comprises: extracting a file identifier, a function identifier or a class identifier associated with the plurality of alarm records; performing slicing analysis on the code segment propagating along the data flow propagation path to obtain file code, function code or class code associated with the plurality of alarm records.

5. The method of claim 4, wherein, ​ ​ ​ 6. The method according to any one of claims 1 to 3, characterized in that, The target code segment associated with the plurality of alarm records is extracted from the code file of the inspected project according to the description information of the plurality of alarm records, and the target rule description is extracted from the target rule associated with the plurality of alarm records. The code purpose description and the code running process description associated with the plurality of alarm records input by the user are received. The target code segment associated with the plurality of alarm records is extracted from the code file of the inspected project according to the code purpose description and the code running process description.

7. The method according to any one of claims 1 to 6, characterized in that, The method further comprises: The false positive probability of the plurality of alarm records is inferred according to the target code segment associated with the plurality of alarm records and the rule description of the target rule. The false positive conclusion of the plurality of alarm records and the reason explanation corresponding to the false positive conclusion are generated by the language model according to at least one of the description text of the defect code, the description text of the false positive scenario or the example code segment, and the rule description of the target rule and the target code segment. The false positive conclusion of the plurality of alarm records and the reason explanation corresponding to the false positive conclusion are generated by the language model according to at least one of the description text of the defect code, the description text of the false positive scenario or the example code segment, and the rule description of the target rule and the target code segment.

8. The method of claim 7, wherein, The method further comprises: The description information of the sample alarm record output by analyzing the code file of the sample project and the feedback operation of the sample alarm record are obtained, and the feedback operation includes shielding or repairing. The sample code segment associated with the sample alarm record and the rule description of the sample rule are extracted from the code file of the sample project according to the description information of the sample alarm record. The inference model is obtained by model fine-tuning according to the sample code segment associated with the sample alarm record, the rule description of the sample rule and the feedback operation, and the inference model is used to infer the false positive probability.

9. A code management platform, characterized by, The code management platform is used to explain the error alarm output by the code inspection, and the code management platform comprises: A code extraction module is configured to present the description information of a plurality of alarm records output by analyzing the code file of an inspected project to a user, extract a target code segment associated with the plurality of alarm records from the code file of the inspected project according to the description information of the plurality of alarm records, and extract a target rule description from a target rule associated with the plurality of alarm records; A false positive explanation module is configured to retrieve at least one of a description text of a defect code, a description text of a false positive scenario or an example code segment identified by the target rule from a knowledge base according to the rule description of the target rule associated with the plurality of alarm records, and generate a false positive conclusion of the plurality of alarm records and a reason explanation corresponding to the false positive conclusion by a language model according to at least one of the description text of the defect code, the description text of the false positive scenario or the example code segment, and the rule description of the target rule and the target code segment. The false positive explanation module is further configured to present the false positive conclusion of the plurality of alarm records and the reason explanation corresponding to the false positive conclusion to the user.

10. The code management platform of claim 9, wherein, The false positive explanation module is specifically configured to: According to at least one of the description text of the defect code, the description text of the false positive scenario or the example code snippet and the rule description of the target rule and the target code snippet, a prompt is generated; According to the prompt, the variable value and the branch path of the code file runtime of the subject item are inferred by the language model; According to the variable value and the branch path of the code file runtime of the subject item, a false positive conclusion of the plurality of alarm records and a reason explanation corresponding to the false positive conclusion are generated.

11. The code management platform of claim 9 or 10, wherein, The code extraction module is further configured to: According to the target code snippet associated with the plurality of alarm records and the rule description of the target rule, whether the content for explaining false positives is missing is predicted by the language model; If yes, the missing content is extracted according to the description information of the missing content output by the language model.

12. The code management platform of any one of claims 9 to 11, wherein, The code extraction module is specifically configured to: According to the description information of the plurality of alarm records, data flow analysis is performed to obtain a data flow propagation path; Code snippets propagating along the data flow propagation path are collected from the code file of the subject item; The code snippets propagating along the data flow propagation path are subjected to slicing analysis to obtain the target code snippet associated with the plurality of alarm records.

13. The code management platform of claim 12, wherein, The code extraction module is specifically configured to: File identifiers, function identifiers or class identifiers associated with the plurality of alarm records are extracted; The code snippets propagating along the data flow propagation path are subjected to slicing analysis to obtain file code, function code or class code associated with the plurality of alarm records.

14. The code management platform of any one of claims 9 to 11, wherein, The code extraction module is specifically configured to: The code purpose description and the code running process description associated with the plurality of alarm records input by the user are received; According to the code purpose description and the code running process description, the target code snippet associated with the plurality of alarm records is extracted from the code file of the subject item by the language model.

15. The code management platform of any one of claims 9 to 14, wherein, The code management platform further comprises: A false positive prediction module configured to infer a false positive probability of the plurality of alarm records according to the target code snippet associated with the plurality of alarm records and the rule description of the target rule; The false positive explanation module is specifically configured to: According to at least one of the description text of the defect code, the description text of the false positive scenario or the example code snippet and the rule description of the target rule and the target code snippet, a prompt is generated; 16. The code management platform of claim 15, wherein, According to the prompt, the variable value and the branch path of the code file runtime of the subject item are inferred by the language model; According to the variable value and the branch path of the code file runtime of the subject item, a false positive conclusion of the plurality of alarm records and a reason explanation corresponding to the false positive conclusion are generated. The false positive prediction module is further configured to: Description information of sample alarm records output by analyzing code files of sample items and feedback operations on the sample alarm records, the feedback operations including shielding or repairing; According to the description information of the sample alarm records, a sample code snippet associated with the sample alarm records and a rule description of a sample rule are extracted from the code files of the sample items; According to the sample code snippet associated with the sample alarm records, the rule description of the sample rule and the feedback operation, a model fine-tuning is performed to obtain an inference model, and the inference model is used to infer the false positive probability.

17. A cluster of computing devices, characterized in that, The computing device cluster comprises at least one computing device, the at least one computing device comprising at least one processor and at least one memory having computer readable instructions stored therein; the at least one processor executes the computer readable instructions to cause the computing device cluster to perform the error alarm interpretation method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that, A computer program product comprising computer readable instructions; the computer readable instructions being configured to implement the error alarm interpretation method according to any one of claims 1 to 8.

19. A computer program product, characterised in that, A computer program product comprising computer readable instructions; the computer readable instructions being configured to implement the error alarm interpretation method according to any one of claims 1 to 8.

Images