Object code auditing method and device
By acquiring rule file datasets and knowledge graph structures, a syntax tree rule plugin is generated to perform multi-level audits on target code. This solves the compliance blind spot problem caused by the lag in updating audit rules in existing technologies, improves real-time performance and accuracy, and promotes the effectiveness of code audits and business logic verification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAMEN BRANCH OF CHINA CONSTRUCTION BANK CO LTD
- Filing Date
- 2025-12-01
- Publication Date
- 2026-04-21
AI Technical Summary
Existing code review methods suffer from compliance blind spots due to outdated review rules, and lack of deep semantic understanding, which hinders the effective verification of business logic and the promotion of code reuse.
By acquiring the rule file dataset and knowledge graph structure, a syntax tree rule plugin is generated. Based on the syntax tree rule plugin and knowledge graph structure, multi-level audits are performed on the target code to obtain code audit scores. Based on the scores, an execution strategy is determined for processing.
It improved the real-time nature and accuracy of code review, reduced compliance risks, and enabled effective verification of business logic and promoted code reuse.
Smart Images
Figure CN121900764A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for object code review. Background Technology
[0002] In enterprise applications with high security and compliance requirements, business logic is complex and constantly evolving, and the external business standards and internal policies that must be followed are frequently updated. To ensure that application code strictly adheres to these dynamically changing requirements, a code review methodology is needed.
[0003] In related technologies, existing code review methods mainly rely on static code analysis tools (such as SonarQube and PMD). While these methods can detect syntax errors, security vulnerabilities, and coding style issues, they lack a deep understanding of high-level business logic and compliance semantics. When external business specifications or internal policies change, a time-consuming cycle of manual interpretation, coding, testing, and deployment is required to update the review rules. This leads to an inability to respond promptly to changes in external business specifications or internal policies, creating review blind spots before rule updates are completed, and resulting in compliance risks. Summary of the Invention
[0004] The purpose of this application is to provide a target code review method and apparatus to solve the compliance blind spots caused by the lag in updating review rules in existing code review methods, and the inability to effectively verify business logic and promote code reuse due to the lack of deep semantic understanding. The specific technical solution is as follows: In a first aspect of this application, a method for reviewing object code is provided, the method comprising: Obtain the rule file dataset and knowledge graph structure; Based on the rule file dataset, a syntax tree rule plugin is generated; Upon receiving the target code, a multi-level review is performed on the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a code review score; An execution strategy is determined based on the code review score, and the target code is processed according to the execution strategy.
[0005] In an optional implementation, the plugin for generating syntax tree rules based on the rule file dataset includes: Semantic parsing is performed on the rule file dataset to generate a structured rule table; The structured rule table is compiled to generate the syntax tree rule plugin.
[0006] In one optional implementation, the knowledge graph structure is constructed in the following manner: Obtain at least one code repository; Perform code analysis on at least one code repository to obtain code elements, business tags, and compliance constraints; The knowledge graph structure is constructed based on the code elements, the business tags, and the compliance constraints.
[0007] In an optional implementation, the step of performing multi-level review on the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a code review score includes: The target code is subjected to a syntax level review based on the syntax tree rule plugin to obtain a syntax score. The target code is reviewed at the business level based on the syntax tree rule plugin and the knowledge graph structure to obtain a business score. Based on the syntax tree rule plugin, the target code is reviewed at the rule level to obtain a rule score; The code review score is obtained based on the syntax score, the business score, and the rule score.
[0008] In an optional implementation, the step of performing a syntax-level review of the target code based on the syntax tree rule plugin to obtain a syntax score includes: Obtain syntax rules from the syntax tree rule plugin; The target code is parsed using a syntax tree, and the parsing results are generated. The parsing results are analyzed based on the grammar rules to obtain the grammar score.
[0009] In an optional implementation, the step of performing a business-level review of the target code based on the syntax tree rule plugin and the knowledge graph to obtain a business score includes: The target code is parsed to obtain the target tags; Based on the target label, at least one target compliance constraint is obtained from the knowledge graph structure; Obtain business logic rules from the syntax tree rule plugin; The target code is analyzed based on the business logic rules and the at least one target compliance constraint to obtain the business score.
[0010] In an optional implementation, the step of performing a rule-level review of the target code based on the syntax tree rule plugin to obtain a rule score includes: Obtain the regulatory logic from the syntax tree rule plugin; The target code is reviewed based on the regulatory logic to obtain the rule score.
[0011] In an optional implementation, determining the execution strategy based on the code review score includes: If the code review score is less than a preset first threshold, then the automatic repair strategy will be determined as the execution strategy. If the code review score is between the preset first threshold and the preset second threshold, then the manual review strategy will be determined as the execution strategy. If the code review score is greater than the preset second threshold, then the termination strategy will be determined as the execution strategy.
[0012] In an optional implementation, processing the target code according to the execution strategy includes: If the execution strategy is the automatic repair strategy, then a candidate patch corresponding to the target code is generated; The target code is repaired based on the candidate patches; If the execution strategy is the manual review strategy, then the target code is pushed to the manual review queue; If the execution strategy is the termination strategy, then the submission of the target code is prevented.
[0013] In a second aspect of this application, an object code review apparatus is also provided, the apparatus comprising: The data acquisition module is used to acquire rule file datasets and knowledge graph structures; The plugin generation module is used to generate syntax tree rule plugins based on the rule file dataset; The code review module is used to perform multi-level review of the target code based on the syntax tree rule plugin and the knowledge graph structure upon receiving the target code, and to obtain a code review score. The code processing module is used to determine the execution strategy based on the code review score, and process the target code according to the execution strategy.
[0014] In an optional implementation, the plugin generation module is specifically used for: Semantic parsing is performed on the rule file dataset to generate a structured rule table; The structured rule table is compiled to generate the syntax tree rule plugin.
[0015] In one optional implementation, the knowledge graph structure is constructed in the following manner: Obtain at least one code repository; Perform code analysis on at least one code repository to obtain code elements, business tags, and compliance constraints; The knowledge graph structure is constructed based on the code elements, the business tags, and the compliance constraints.
[0016] In one optional implementation, the code review module includes: A syntax scoring unit is used to perform a syntax level review of the target code based on the syntax tree rule plugin to obtain a syntax score. The business scoring unit is used to perform business-level review of the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a business score. The rule scoring unit is used to perform rule-level review on the target code based on the syntax tree rule plugin to obtain a rule score; The code review scoring unit is used to obtain the code review score based on the syntax score, the business score, and the rule score.
[0017] In an optional implementation, the grammar scoring unit is specifically used for: Obtain syntax rules from the syntax tree rule plugin; The target code is parsed using a syntax tree, and the parsing results are generated. The parsing results are analyzed based on the grammar rules to obtain the grammar score.
[0018] In an optional implementation, the business scoring unit is specifically used for: The target code is parsed to obtain the target tags; Based on the target label, at least one target compliance constraint is obtained from the knowledge graph structure; Obtain business logic rules from the syntax tree rule plugin; The target code is analyzed based on the business logic rules and the at least one target compliance constraint to obtain the business score.
[0019] In an optional implementation, the rule scoring unit is specifically used for: Obtain the regulatory logic from the syntax tree rule plugin; The target code is reviewed based on the regulatory logic to obtain the rule score.
[0020] In an optional implementation, the code processing module includes: The first determining unit is configured to determine the automatic repair strategy as the execution strategy if the code review score is less than a preset first threshold. The second determining unit is configured to determine the manual review strategy as the execution strategy if the code review score is between the preset first threshold and the preset second threshold. The third determining unit is used to determine the termination strategy as the execution strategy if the code review score is greater than the preset second threshold.
[0021] In an optional implementation, the code processing module further includes: The first processing unit is configured to, if the execution strategy is the automatic repair strategy, generate a candidate patch corresponding to the target code; and repair the target code according to the candidate patch. The second processing unit is used to push the target code to the manual review queue if the execution strategy is the manual review strategy. The third processing unit is configured to prevent the submission of the target code if the execution strategy is the termination strategy.
[0022] In a third aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor, when executing a program stored in memory, implements the object code auditing method described in any one of the first aspects above.
[0023] In a fourth aspect of the embodiments of this application, a storage medium is also provided, wherein the storage medium stores instructions that, when executed on a computer, cause the computer to perform any of the target code auditing methods described in the first aspect above.
[0024] In a fifth aspect of the embodiments of this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the target code review methods described in the first aspect above.
[0025] The technical solution provided in this application involves acquiring a rule file dataset and a knowledge graph structure; generating a syntax tree rule plugin based on the rule file dataset; performing multi-level audits on the target code upon receiving the target code, based on the syntax tree rule plugin and the knowledge graph structure, to obtain a code audit score; determining an execution strategy based on the code audit score, and processing the target code according to the execution strategy. This multi-level audit of the target code based on the syntax tree rule plugin and the knowledge graph structure to determine the execution strategy can solve the compliance blind spots caused by the lag in updating audit rules in existing code audit methods, as well as the problem of not being able to effectively verify business logic and promote code reuse due to a lack of deep semantic understanding. This improves the real-time performance and accuracy of code audits and reduces compliance risks. Attached Figure Description
[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0028] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.
[0029] Figure 1 A schematic diagram illustrating the implementation process of a target code review method provided in this application embodiment; Figure 2 A schematic diagram illustrating the implementation process of another object code review method provided in this application embodiment; Figure 3 A schematic diagram illustrating the implementation process of another object code review method provided in this application embodiment; Figure 4 A system architecture diagram for object code review provided in this application embodiment; Figure 5 This is a schematic diagram of the structure of a target code review device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0031] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.
[0032] To address the compliance blind spots caused by lagging review rule updates in existing technologies, and the technical problems of ineffective business logic verification and code reuse promotion due to a lack of deep semantic understanding, this application provides a target code review method and apparatus. The method involves acquiring a rule file dataset and a knowledge graph structure; generating a syntax tree rule plugin based on the rule file dataset; performing multi-level reviews on the target code upon receiving it, based on the syntax tree rule plugin and the knowledge graph structure, and obtaining a code review score; determining an execution strategy based on the code review score, and processing the target code according to the execution strategy. This multi-level review of the target code based on the syntax tree rule plugin and knowledge graph structure to determine the execution strategy improves the real-time performance and accuracy of code review, and reduces compliance risks.
[0033] Figure 1 This is a schematic diagram illustrating the implementation process of a target code review method provided in an embodiment of this application, such as... Figure 1 As shown, the specific steps may include: S101, Obtain the rule file dataset and knowledge graph structure.
[0034] The aforementioned rule file dataset refers to the unprocessed, raw set of compliance requirements, which may be policy documents issued by industry regulatory agencies to provide source data and policy basis for the subsequent generation of dynamic rules.
[0035] The aforementioned knowledge graph structure refers to a pre-built, structured network containing code, business, and compliance knowledge, used to provide semantic context and relational support for code analysis during the audit process.
[0036] In this embodiment, a rule file dataset and a knowledge graph structure are obtained. Specifically, rule files can be automatically captured or manually uploaded via an API interface to form a rule file dataset. The knowledge graph structure can be constructed by analyzing historical code; however, this embodiment does not limit this approach.
[0037] S102, a plugin for generating syntax tree rules based on a rules file dataset.
[0038] In this embodiment of the application, a syntax tree rule plugin is generated based on the rule file dataset. Here, the syntax tree rule plugin refers to a module capable of executing detection logic.
[0039] S103: Upon receiving the target code, multi-level review is performed on the target code based on the syntax tree rule plugin and knowledge graph structure to obtain a code review score.
[0040] In this embodiment, upon receiving the target code, a multi-level review is performed on the target code based on a syntax tree rule plugin and a knowledge graph structure to obtain a code review score. The target code refers to newly submitted source code awaiting compliance and quality review, which can be a single code file, module, or complete project. The code review score is a quantitative value (e.g., 2, 5, etc.) that comprehensively reflects the overall risk level of the target code under multi-level review. Multi-level review can include syntax-level review, business-level review, and rule-level review. This embodiment does not limit this aspect.
[0041] S104: Determine the execution strategy based on the code review score, and process the target code according to the execution strategy.
[0042] In this embodiment, an execution strategy is determined based on the code review score, and the target code is processed according to the execution strategy. The execution strategy refers to the code handling method selected based on the code review score.
[0043] Based on the above description of the technical solution provided in the embodiments of this application, a rule file dataset and a knowledge graph structure are obtained; a syntax tree rule plugin is generated based on the rule file dataset; upon receiving the target code, a multi-level review is performed on the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a code review score; an execution strategy is determined based on the code review score, and the target code is processed according to the execution strategy. This multi-level review of the target code based on the syntax tree rule plugin and the knowledge graph structure to determine the execution strategy can solve the compliance blind spots caused by the lag in updating review rules in existing code review methods, as well as the problem of not being able to effectively verify business logic and promote code reuse due to a lack of deep semantic understanding. This improves the real-time performance and accuracy of code review and reduces compliance risks.
[0044] Figure 2 This is a schematic diagram illustrating the implementation process of another object code review method provided in this application embodiment, such as... Figure 2 As shown, it can specifically include the following: S201, Obtain the rule file dataset and knowledge graph structure.
[0045] In this embodiment, a rule file dataset and a knowledge graph structure are obtained. Specifically, this can be achieved by acquiring at least one code repository, performing code analysis on the repository to obtain code elements, business tags, and compliance constraints, and then constructing the knowledge graph structure based on these elements, tags, and constraints. Here, a code repository refers to a version control repository storing application source code, providing the raw code data required to build the knowledge graph. Code elements refer to structured units extracted from the application source code, including classes, methods, functions, variables, interfaces, and their calling relationships, forming the basis of code entities in the knowledge graph. Business tags are semantic identifiers describing the business functions implemented by code fragments, such as user authentication and transaction processing, used to establish associations between code and business concepts in the knowledge graph structure. Compliance constraints are specific representations of policy requirements that the code must meet, used to mark the compliance boundaries that the code must follow in the knowledge graph structure. For example, customer identification must be performed.
[0046] Specifically, code analysis is performed on at least one code repository to obtain code elements, which may include: extracting class definitions, method declarations, and function call relationships from the code repository through abstract syntax tree parsing technology; determining the reference relationships between code modules through dependency analysis; and tracing the propagation paths of key variables through data flow analysis, thereby constructing a complete set of code elements.
[0047] Code analysis is performed on at least one code repository to obtain business tags, which may include: analyzing code snippets, comment text, and call chain features using a business intent classifier based on the Transformer architecture to identify the business function purpose implemented by the code; calculating the similarity between code vectors and predefined business concept vectors using a code semantic embedding model, and using the business concept with the highest similarity as the business tag of the code snippet.
[0048] Code analysis is performed on at least one code repository to obtain compliance constraints, which may include: establishing a rule and clause knowledge base to transform compliance requirements in policy documents into structured representations; calculating the semantic correlation between code elements and rule and clauses through a compliance mapping module, and labeling the code element with the corresponding compliance constraint when the correlation exceeds a preset threshold.
[0049] Based on code elements, business tags, and compliance constraints, a knowledge graph structure can be constructed, which may include: using code elements, business tags, and compliance constraints as nodes, and using the implementation relationships, call relationships, and satisfaction relationships between them as edges, to build a triple network in a graph database; calculating the semantic similarity between nodes through graph embedding algorithms; and establishing a cross-repository code reuse relationship index to form a knowledge graph structure that supports multi-hop queries and semantic reasoning.
[0050] S202, perform semantic parsing on the rule file dataset to generate a structured rule table.
[0051] In this embodiment, semantic parsing is performed on the rule file dataset to generate a structured rule table. The structured rule table refers to the structured data that transforms the natural language policy provisions in the rule file dataset into machine-readable logical conditions, field constraints, and risk thresholds, providing standardized input for the generation of syntax tree rule plugins. Specifically, a pre-trained large language model can be used to perform sentence segmentation, lexical analysis, and context encoding on the policy text through its hybrid encoding layer, identifying key logical relationships and constraints, and outputting a structured table containing clause numbers, conditional logic, involved fields, and thresholds. This embodiment does not limit this approach.
[0052] The pre-trained large language model can be constructed in the following ways: a basic large language model based on the Transformer architecture is pre-trained using professional texts from relevant fields (such as the legal field) for domain-adaptive learning; logical structure reinforcement learning is introduced during the pre-training process to enable the model to recognize conditional statements, constraints, and exception clauses in policy texts; and finally, a domain-specific large language model that can understand the semantic structure and logical relationships of policy texts is formed.
[0053] In one optional embodiment, the pre-trained large language model can employ a BERT-GPT hybrid architecture. The BERT layer is responsible for semantic vectorization and contextual feature extraction of policy clauses from the rule file dataset, while the GPT layer is responsible for logical template generation and rule inference output. To further enhance the model's parsing capabilities, a logical gating layer can be embedded between layers 5 and 7 of the decoding layer. This layer dynamically allocates contextual weights through a gating attention mechanism to accurately capture and maintain complex logical relationships such as "parallel constraints," "nested conditions," and "exclusion clauses" in the rule file dataset, ensuring the logical integrity and consistency of the generated structured rules.
[0054] S203 compiles the structured rule table to generate a syntax tree rule plugin.
[0055] In this embodiment of the application, the structured rule table is compiled to generate a syntax tree rule plugin. The syntax tree rule plugin refers to an executable rule module based on abstract syntax tree technology that can be directly called, and is used to detect compliance issues that violate the definitions in the structured rule table in real time during the code review process.
[0056] Specifically, the ANTLR syntax recognition tool can be used to convert the conditional expressions in the structured rule table into domain-specific language scripts, and further compile them into plugin code in languages such as Java or Python. Finally, hot deployment and version management of the plugin can be achieved through modular frameworks such as OSGi.
[0057] S204: Upon receiving the target code, based on the syntax tree rule plugin and knowledge graph structure, a multi-level review is performed on the target code to obtain a code review score.
[0058] In this embodiment of the application, this step is similar to step S103 above, and will not be described in detail here.
[0059] S205. If the code review score is less than the preset first threshold, the automatic repair strategy will be determined as the execution strategy.
[0060] In this embodiment, if the code review score is less than a preset first threshold, the automatic repair strategy is determined as the execution strategy. The preset first threshold refers to a pre-set critical score that distinguishes between low-risk and medium-risk codes, serving as a boundary condition for triggering the automatic repair process, such as 2 points or 5 points.
[0061] S206, If the code review score is between the preset first threshold and the preset second threshold, then the manual review strategy will be determined as the execution strategy.
[0062] In this embodiment, if the code review score falls between a preset first threshold and a preset second threshold, then the manual review strategy is determined as the execution strategy. The preset second threshold is a pre-set critical score that distinguishes between medium-risk and high-risk code, used to determine the risk boundary at which code submission should be blocked. The preset first threshold is less than the preset second threshold.
[0063] S207 If the code review score is greater than the preset second threshold, the termination policy will be determined as the execution policy.
[0064] In this embodiment of the application, if the code review score is greater than a preset second threshold, the termination policy will be determined as the execution policy.
[0065] S208, process the target code according to the execution strategy.
[0066] In this embodiment of the application, the target code is processed according to the execution strategy.
[0067] Specifically, if the execution strategy is an automatic remediation strategy, candidate patches corresponding to the target code are generated. The target code is then repaired based on the candidate patches. If the execution strategy is a manual review strategy, the target code is pushed to the manual review queue. If the execution strategy is a termination strategy, the submission of the target code is blocked. The candidate patches provide specific code modification solutions for detected non-compliance issues, which may include modifications such as field addition, logic correction, and function replacement. The manual review queue is an ordered set storing code items awaiting manual review. Each queue item can contain the target code, violation details, suggested remediation solutions, and risk assessment information to assist reviewers in making efficient decisions.
[0068] Figure 3 This is a schematic diagram illustrating the implementation process of another object code review method provided in this application embodiment, such as... Figure 3 As shown, it can specifically include the following: S301, Obtain the rule file dataset and knowledge graph structure.
[0069] In this embodiment of the application, this step is similar to step S101 above, and will not be described in detail here.
[0070] S302 is a plugin that generates syntax tree rules based on a rules file dataset.
[0071] In this embodiment of the application, this step is similar to step S102 above, and will not be described in detail here.
[0072] S303: Upon receiving the target code, perform a syntax-level review of the target code and obtain a syntax score.
[0073] In this embodiment of the application, upon receiving the target code, a syntactic level review is performed on the target code to obtain a syntactic score. The syntactic score is a quantitative evaluation value obtained by matching and analyzing the parsing results based on syntactic rules, reflecting the syntactic compliance level of the target code. The parsing result refers to the structured representation obtained after converting the target code into an abstract syntax tree, which may contain information about code elements and their interrelationships.
[0074] The syntax tree rule plugin performs a syntax-level review of the target code to obtain a syntax score. This process includes: retrieving syntax rules from the plugin, parsing the target code into a syntax tree, generating a parsing result, and analyzing the parsing result based on the syntax rules to obtain a syntax score. Syntax rules refer to the set of basic constraints used to detect code structure compliance, including rules for code style, naming conventions, and security vulnerability patterns. For example, it can detect unused variables, code segments that may contain null pointer exceptions, and identifiers that do not conform to naming conventions, assigning corresponding deduction values to each type of violation, and finally summing them to obtain the syntax score. S304 performs business-level review of the target code based on the syntax tree rule plugin and knowledge graph structure, and obtains a business score.
[0075] In this embodiment, the target code is reviewed at the business level based on the syntax tree rule plugin and the knowledge graph structure to obtain a business score. The business score is a quantitative value obtained by evaluating the target code in conjunction with business logic rules and target compliance constraints, reflecting the level of compliance risk of the target code at the business logic level.
[0076] The process involves reviewing the target code at the business level using a syntax tree rule plugin and a knowledge graph structure to obtain a business score. This can include: parsing the target code to obtain target tags; based on the target tags, retrieving at least one target compliance constraint from the knowledge graph structure; retrieving business logic rules from the syntax tree rule plugin; and analyzing the target code based on the business logic rules and at least one target compliance constraint to obtain a business score. Target tags refer to functional semantic identifiers extracted from the target code through business intent identification, used to characterize the business purpose implemented by the code. Target compliance constraints refer to the set of policy requirements associated with the target tags, obtained through semantic association queries within the knowledge graph structure. Business logic rules refer to the detection rules used to verify the integrity and correctness of business operations, including verification logic for core business attributes such as transaction atomicity and data consistency.
[0077] S305 uses a syntax tree rule plugin to perform rule-level review of the target code and obtain a rule score.
[0078] In this embodiment, the target code is reviewed at a rule-level hierarchy using a syntax tree rule plugin to obtain a rule score. The rule score is a quantitative evaluation value obtained after matching the target code with regulatory logic, reflecting the degree of compliance between the target code and specific policy provisions. Specifically, regulatory logic can be obtained from the syntax tree rule plugin, and the target code is reviewed based on this logic to obtain the rule score. The regulatory logic refers to the formal representation of specific compliance requirements extracted from policy documents, and may include specific rules such as field constraints, operational restrictions, and conditional judgments.
[0079] S306, based on syntax scoring, business scoring, and rule scoring, yields a code review score.
[0080] In this embodiment of the application, the code review score is obtained based on syntax score, business score, and rule score.
[0081] In an optional implementation, a weighted summation method can be used to calculate the code review score, specifically: Code Review Score = Syntax Score × W1 + Business Score × W2 + Rule Score × W3, where W1 is the weight coefficient for the syntax score level, W2 is the weight coefficient for the business score level, and W3 is the weight coefficient for the rule score level, and W1 + W2 + W3 = 1. The weight coefficients can be set according to the importance of each level in the risk assessment. For example, the weight W2 for the business level can be set to 0.5, the weight W1 for the syntax level can be set to 0.3, and the weight W3 for the rule level can be set to 0.2.
[0082] Furthermore, the weighting coefficients W1, W2, and W3 are not fixed and can be adaptively adjusted based on historical review feedback. Specifically, the final decision result of each manual review and the code review score can be recorded. When a significant deviation is found between the score of a certain level (such as the business layer) and the manual decision result over a long period, the weight of that level can be automatically increased or decreased. For example, if code with a low score in the business layer is repeatedly judged as low-risk by manual review, the weight W2 of the business layer can be appropriately reduced.
[0083] S307 determines the execution strategy based on code review scores and processes the target code according to the execution strategy.
[0084] In this embodiment of the application, this step is similar to step S104 above, and will not be described in detail here.
[0085] Furthermore, the control method of the ice-making system provided in this application embodiment is described with reference to specific examples: Figure 4 A system architecture diagram for object code review provided in this application embodiment is shown below. Figure 4 As shown, it can specifically include: an input layer, a processing layer, and an output layer. The input layer is used to receive policy documents (PDF and Word formats) issued by regulatory agencies and industry compliance documents.
[0086] The processing layer includes a dynamic rule encoder, a cross-warehouse knowledge graph engine, and an AI auditing engine.
[0087] The dynamic rule encoder receives regulatory documents (PDF, Word, web API) from regulatory agencies and internal policy repositories. It parses policy clauses using a semantic big data model (such as FinGPT or a dedicated Transformer model) to extract regulatory logic, field constraints, and risk conditions. An AST plugin is generated via the ANTLR syntax compiler, and then deployed to the AI auditing engine using the OSGi framework for minute-level hot deployment.
[0088] A cross-repository knowledge graph engine is used to integrate code repository information from different systems, forming a "code-business-compliance" triple graph structure. By performing AST parsing and dependency tracing on each repository, elements such as functions, interfaces, and annotations are extracted. Relationships between nodes are stored using a graph database (Neo4j), and graph embedding algorithms are used to identify the semantic similarity of functionally similar modules in different repositories. This enables module reuse suggestions, risk control consistency analysis, and historical issue tracing.
[0089] The AI auditing engine is divided into three levels: the syntax layer, the business layer, and the compliance layer. The syntax layer is responsible for static structure detection; the business layer is responsible for analyzing transaction rollback and data integrity; and the compliance layer is used to perform audits in conjunction with dynamically generated rule plugins.
[0090] Corresponding to the above method embodiments, this application also provides a target code review device, such as... Figure 5 As shown, the device may include a data acquisition module 501, a plugin generation module 502, a code review module 503, and a code processing module 504.
[0091] Data acquisition module 501 is used to acquire rule file datasets and knowledge graph structures; The plugin generation module 502 is used to generate syntax tree rule plugins based on the rule file dataset; The code review module 503 is used to perform multi-level reviews of the target code based on the syntax tree rule plugin and knowledge graph structure when the target code is received, and to obtain a code review score. The code processing module 504 is used to determine the execution strategy based on the code review score and process the target code according to the execution strategy.
[0092] In an optional implementation, the plug-in generation module 501 is specifically used for: Semantic parsing is performed on the rule file dataset to generate a structured rule table; The structured rule table is compiled to generate the syntax tree rule plugin.
[0093] In one optional implementation, the knowledge graph structure is constructed in the following manner: Obtain at least one code repository; Perform code analysis on at least one code repository to obtain code elements, business tags, and compliance constraints; The knowledge graph structure is constructed based on the code elements, the business tags, and the compliance constraints.
[0094] In an optional implementation, the code review module 503 includes: Syntax scoring unit 5031 is used to perform a syntax level review on the target code according to the syntax tree rule plugin and obtain a syntax score. Business scoring unit 5032 is used to perform business-level review of the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a business score. The rule scoring unit 5033 is used to perform rule-level review on the target code based on the syntax tree rule plugin to obtain a rule score. The code review scoring unit 5034 is used to obtain the code review score based on the syntax score, the business score, and the rule score.
[0095] In an optional implementation, the grammar scoring unit 5031 is specifically used for: Obtain syntax rules from the syntax tree rule plugin; The target code is parsed using a syntax tree, and the parsing results are generated. The parsing results are analyzed based on the grammar rules to obtain the grammar score.
[0096] In an optional implementation, the business scoring unit 5032 is specifically used for: The target code is parsed to obtain the target tags; Based on the target label, at least one target compliance constraint is obtained from the knowledge graph structure; Obtain business logic rules from the syntax tree rule plugin; The target code is analyzed based on the business logic rules and the at least one target compliance constraint to obtain the business score.
[0097] In an optional implementation, the rule scoring unit 5033 is specifically used for: Obtain the regulatory logic from the syntax tree rule plugin; The target code is reviewed based on the regulatory logic to obtain the rule score.
[0098] In an optional implementation, the code processing module 504 includes: The first determining unit 5041 is used to determine the automatic repair strategy as the execution strategy if the code review score is less than a preset first threshold. The second determining unit 5042 is used to determine the manual review strategy as the execution strategy if the code review score is between the preset first threshold and the preset second threshold. The third determining unit 5043 is used to determine the termination strategy as the execution strategy if the code review score is greater than the preset second threshold.
[0099] In an optional implementation, the code processing module 504 further includes: The first processing unit 5044 is configured to, if the execution strategy is the automatic repair strategy, generate a candidate patch corresponding to the target code; and repair the target code according to the candidate patch. The second processing unit 5045 is used to push the target code to the manual review queue if the execution strategy is the manual review strategy. The third processing unit 5046 is configured to prevent the submission of the target code if the execution strategy is the termination strategy.
[0100] This application also provides an electronic device, such as... Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. Memory 603 is used to store computer programs; In one embodiment of this application, when the processor 601 executes a program stored in the memory 603, it performs the following steps: Obtain the rule file dataset and knowledge graph structure; generate a syntax tree rule plugin based on the rule file dataset; upon receiving the target code, perform multi-level review on the target code based on the syntax tree rule plugin and knowledge graph structure to obtain a code review score; determine the execution strategy based on the code review score, and process the target code according to the execution strategy.
[0101] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.
[0102] The communication interface is used for communication between the aforementioned electronic devices and other devices.
[0103] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.
[0104] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0105] In another embodiment provided in this application, a storage medium is also provided, which stores instructions that, when run on a computer, cause the computer to execute any of the target code auditing methods described in the above embodiments.
[0106] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the target code auditing methods described in the above embodiments.
[0107] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a storage medium or transmitted from one storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).
[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0109] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0110] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the protection scope of this application.
Claims
1. A method for processing target code, characterized in that, The method includes: Obtain the rule file dataset and knowledge graph structure; Based on the rule file dataset, a syntax tree rule plugin is generated; Upon receiving the target code, a multi-level review is performed on the target code based on the syntax tree rule plugin and the knowledge graph structure to obtain a code review score; An execution strategy is determined based on the code review score, and the target code is processed according to the execution strategy.
2. The method according to claim 1, characterized in that, The plugin for generating syntax tree rules based on the rule file dataset includes: Semantic parsing is performed on the rule file dataset to generate a structured rule table; The structured rule table is compiled to generate the syntax tree rule plugin.
3. The method according to claim 1, characterized in that, The knowledge graph structure is constructed in the following way: Obtain at least one code repository; Perform code analysis on at least one code repository to obtain code elements, business tags, and compliance constraints; The knowledge graph structure is constructed based on the code elements, the business tags, and the compliance constraints.
4. The method according to claim 1, characterized in that, The code review process, based on the syntax tree rule plugin and the knowledge graph structure, performs multi-level reviews of the target code to obtain a code review score, including: The target code is subjected to a syntax level review based on the syntax tree rule plugin to obtain a syntax score. The target code is reviewed at the business level based on the syntax tree rule plugin and the knowledge graph structure to obtain a business score. Based on the syntax tree rule plugin, the target code is reviewed at the rule level to obtain a rule score; The code review score is obtained based on the syntax score, the business score, and the rule score.
5. The method according to claim 4, characterized in that, The syntax tree rule plugin performs a syntax-level review of the target code to obtain a syntax score, including: Obtain syntax rules from the syntax tree rule plugin; The target code is parsed using a syntax tree, and the parsing results are generated. The parsing results are analyzed based on the grammar rules to obtain the grammar score.
6. The method according to claim 4, characterized in that, The step of performing a business-level review of the target code based on the syntax tree rule plugin and the knowledge graph to obtain a business score includes: The target code is parsed to obtain the target tags; Based on the target label, at least one target compliance constraint is obtained from the knowledge graph structure; Obtain business logic rules from the syntax tree rule plugin; The target code is analyzed based on the business logic rules and the at least one target compliance constraint to obtain the business score.
7. The method according to claim 4, characterized in that, The rule-based hierarchical review of the target code based on the syntax tree rule plugin, resulting in a rule score, includes: Obtain the regulatory logic from the syntax tree rule plugin; The target code is reviewed based on the regulatory logic to obtain the rule score.
8. The method according to claim 1, characterized in that, The process of determining the execution strategy based on the code review score includes: If the code review score is less than a preset first threshold, then the automatic repair strategy will be determined as the execution strategy. If the code review score is between the preset first threshold and the preset second threshold, then the manual review strategy will be determined as the execution strategy. If the code review score is greater than the preset second threshold, then the termination strategy will be determined as the execution strategy.
9. The method according to claim 8, characterized in that, The process of processing the target code according to the execution strategy includes: If the execution strategy is the automatic repair strategy, then a candidate patch corresponding to the target code is generated; The target code is repaired based on the candidate patches; If the execution strategy is the manual review strategy, then the target code is pushed to the manual review queue; If the execution strategy is the termination strategy, then the submission of the target code is prevented.
10. A target code review device, characterized in that, The device includes: The data acquisition module is used to acquire rule file datasets and knowledge graph structures; The plugin generation module is used to generate syntax tree rule plugins based on the rule file dataset; The code review module is used to perform multi-level review of the target code based on the syntax tree rule plugin and the knowledge graph structure upon receiving the target code, and to obtain a code review score. The code processing module is used to determine the execution strategy based on the code review score, and process the target code according to the execution strategy.