Sample generation method, model training method, code processing method and device

Abstract

The present disclosure provides a sample generation method, a model training method, a code processing method, an apparatus, an intelligent agent, an electronic device, a storage medium and a program product, relating to the technical field of artificial intelligence, and in particular to the technical field of deep learning, large model, code generation, software development and the like. The specific implementation scheme is: based on the code attribute information of each of a plurality of code files, identifying the plurality of code files respectively, and determining a target code file from the plurality of code files; updating the target code file to obtain a variant code file containing a vulnerability code segment; testing the variant code file to obtain a test result; and in the case where the test result indicates that the test fails due to the vulnerability code segment, generating a training sample based on the variant code file and the target code file.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, particularly to the fields of deep learning, large models, code generation, and software development, and specifically to a sample generation method, a model training method, a code processing method, a device, an intelligent agent, an electronic device, a storage medium, and a program product. Background Technology

[0002] In the rapidly evolving internet era, software development faces increasingly complex business requirements and frequent technological iterations. To address these challenges, AI-driven code generation technology has emerged. This technology can understand user needs and automatically generate corresponding code, thus becoming an important tool for improving development efficiency and reducing development costs. However, improving code performance has become a major research focus. Summary of the Invention

[0003] This disclosure provides a sample generation method, a model training method, a code processing method, an apparatus, an intelligent agent, an electronic device, a storage medium, and a program product.

[0004] According to one aspect of this disclosure, a sample generation method is provided, comprising: identifying multiple code files based on their respective code attribute information, and determining a target code file from the multiple code files; updating the target code file to obtain a mutated code file containing a vulnerable code segment; testing the mutated code file to obtain a test result; and generating training samples based on the mutated code file and the target code file if the test result indicates that the test failed due to the vulnerable code segment.

[0005] According to another aspect of this disclosure, a method for training a model is provided, comprising: acquiring training samples, wherein the training samples include a variant code file and a target code file; inputting the variant code file into a model to be trained to obtain a corrected code file; and adjusting the parameters of the model to be trained based on the target code file and the corrected code file to obtain a trained model; wherein the training samples are obtained by processing multiple code files according to the above-described sample generation method.

[0006] According to another aspect of this disclosure, a code processing method is provided, comprising: inputting a code file to be processed into a correction model to obtain corrected code; wherein the correction model is trained according to the training method of the above-mentioned model.

[0007] According to another aspect of this disclosure, a sample generation apparatus is provided, comprising: a file identification module, configured to identify multiple code files respectively based on their respective code attribute information, and determine a target code file from the multiple code files; a file update module, configured to update the target code file to obtain a mutated code file containing a vulnerable code segment; a file testing module, configured to test the mutated code file to obtain test results; and a sample generation module, configured to generate training samples based on the mutated code file and the target code file when the test results indicate that the test failed due to the vulnerable code segment.

[0008] According to another aspect of this disclosure, a model training apparatus is provided, comprising: a sample acquisition module for acquiring training samples, wherein the training samples include a variant code file and a target code file; a file input module for inputting the variant code file into a model to be trained to obtain a modified code file; and a model training module for adjusting the parameters of the model to be trained based on the target code file and the modified code file to obtain a trained model; wherein the training samples are obtained by processing multiple code files according to the sample generation apparatus described above.

[0009] According to another aspect of this disclosure, a code processing apparatus is provided, comprising: a code correction module for inputting a code file to be processed into a correction model to obtain corrected code; wherein the correction model is trained according to a training device for the aforementioned model.

[0010] According to another aspect of this disclosure, an intelligent agent is provided, comprising: an input module for receiving input information; a processing module for determining a target task based on the input information received by the input module, determining a large language model based on the target task, and obtaining output information by calling the large language model to execute the method described above; and an output module for outputting the output information obtained by the processing module.

[0011] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0012] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described above.

[0013] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described above.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0015] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0016] Figure 1 The illustration schematically depicts an exemplary system architecture of a sample generation method, a model training method, a code processing method, and an apparatus according to embodiments of the present disclosure;

[0017] Figure 2 A flowchart illustrating a sample generation method according to an embodiment of the present disclosure is shown schematically;

[0018] Figure 3 This schematically illustrates a data flow diagram of the sample generation method for determining recognition results according to an embodiment of the present disclosure;

[0019] Figure 4 A timing diagram illustrating the execution of concurrent tests using a sample generation method according to an embodiment of the present disclosure is shown schematically.

[0020] Figure 5 A flowchart illustrating a training method for a model according to an embodiment of the present disclosure is shown schematically.

[0021] Figure 6 A flowchart illustrating a code processing method according to an embodiment of the present disclosure is shown schematically.

[0022] Figure 7 A block diagram of a sample generation apparatus according to an embodiment of the present disclosure is shown schematically;

[0023] Figure 8 A block diagram of a training apparatus for a model according to an embodiment of the present disclosure is shown schematically;

[0024] Figure 9 A block diagram of a code processing apparatus according to an embodiment of the present disclosure is shown schematically;

[0025] Figure 10 A schematic diagram illustrating the structure of an intelligent agent according to embodiments of the present disclosure is shown; and

[0026] Figure 11 A schematic block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0027] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0028] In related technologies, manually writing vulnerability code has problems such as low sample generation efficiency and insufficient accuracy. Using automated models for vulnerability injection does not pre-screen the code files in the code library, so it is difficult to ensure that multiple code files are suitable for injecting the same type of vulnerability. Therefore, it is difficult to guarantee the quality of the generated training samples and cannot meet the training requirements of high-precision code repair models.

[0029] In view of this, this disclosure provides a sample generation method, comprising: identifying the multiple code files based on their respective code attribute information, and determining a target code file from the multiple code files; updating the target code file to obtain a mutated code file containing a vulnerable code segment; testing the mutated code file to obtain a test result; and generating a training sample based on the mutated code file and the target code file when the test result indicates that the test failed due to the vulnerable code segment.

[0030] Figure 1 The illustration schematically depicts an exemplary system architecture of a sample generation method, a model training method, a code processing method, and an apparatus according to embodiments of the present disclosure.

[0031] It is important to note that Figure 1 The examples shown are merely examples of system architectures that can be applied to embodiments of this disclosure, to help those skilled in the art understand the technical content of this disclosure, but do not imply that embodiments of this disclosure cannot be used in other devices, systems, environments, or scenarios. For example, in another embodiment, an exemplary system architecture to which sample generation methods, model training methods, code processing methods, and apparatus can be applied may include a terminal device, but the terminal device can implement the sample generation methods, model training methods, code processing methods, and apparatus provided by embodiments of this disclosure without interacting with a server.

[0032] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the terminal devices 101, 102, and 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0033] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as knowledge reading applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software, etc. (for example only).

[0034] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports the content browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the sample generation method, model training method, and code processing method provided in the embodiments of this disclosure can generally be executed by terminal devices 101, 102, or 103. Accordingly, the sample generation device, model training device, and code processing device provided in the embodiments of this disclosure can also be disposed in terminal devices 101, 102, or 103.

[0037] Alternatively, the sample generation method, model training method, and code processing method provided in this embodiment can generally be executed by server 105. Correspondingly, the sample generation device, model training device, and code processing device provided in this embodiment can generally be located in server 105. The sample generation method, model training method, and code processing method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103, and / or server 105. Correspondingly, the sample generation device, model training device, and code processing device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103, and / or server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0039] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of any type of information, such as user personal information, comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0040] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0041] It should be noted that the sequence numbers of the operations in the following methods are for descriptive purposes only and should not be considered as indicating the execution order of the operations. Unless explicitly stated otherwise, the method does not need to be executed in the exact order shown.

[0042] Figure 2 A flowchart illustrating a sample generation method according to an embodiment of the present disclosure is shown schematically.

[0043] like Figure 2 As shown, the method includes operations S210~S240.

[0044] In operation S210, based on the code attribute information of each of the multiple code files, the multiple code files are identified separately, and the target code file is determined from the multiple code files.

[0045] During the S220 operation, the target code file was updated, resulting in a mutated code file containing the vulnerable code segment.

[0046] The S230 was used to test the mutated code file, and the test results were obtained.

[0047] When operating S240, if the test results indicate that the test failed due to a vulnerable code segment, training samples are generated based on the mutated code file and the target code file.

[0048] Code files can be pre-written plain text files written in a programming language. They can be obtained locally or downloaded from online collaborative development platforms built around the code.

[0049] The code attribute information of a code file can include information that characterizes the purpose of the code file and information that characterizes the importance of the code file. The importance of a code file can be determined based on the complexity of the code file and the frequency with which the code file is used.

[0050] Therefore, based on the code attribute information of multiple code files, each file can be identified to determine its purpose and importance. Furthermore, a score is assigned based on purpose and importance to filter the code files and identify the target code file. The target code file is the one that meets both the requirements for purpose and importance.

[0051] It is understandable that, based on the sample generation requirements, the number of target code files to be determined is preset, multiple code files are sorted according to the above scoring, and multiple target code files are selected based on the number of files.

[0052] The process of updating target code files can be used to inject vulnerabilities into them, resulting in mutated code files containing vulnerable code segments. These vulnerable code segments can be obtained by changing the order of portions of the original code segments in the target code file, by modifying or replacing the content of portions of the original code segments, or by changing the order of completely independent variable definition or assignment statements, independent functions, comment statements, etc., within the original code segments. Any method that injects a vulnerability (bug) will suffice.

[0053] Testing the mutated code file can include compilation and execution. If the mutated code file encounters an error during compilation, or if it compiles and runs successfully but the result is inconsistent with the expected result, the test result indicates that the test failed due to the vulnerable code segment. The expected result is the result obtained by running the target code file. Conversely, if the mutated code file compiles and runs successfully, and the result is consistent with the expected result, the test result indicates that the vulnerable code did not affect the execution of the mutated code file.

[0054] If the test result indicates that the test failed due to the vulnerable code segment, it means that the vulnerable code segment affected the execution of the target code file. In other words, the execution result of the mutated code file, including the vulnerable code segment, will be incorrect. Therefore, training samples can be generated based on the mutated code file and the target code file.

[0055] According to embodiments of this disclosure, a process of first screening target code files, then implanting vulnerable code segments, and finally verifying the effectiveness of the vulnerabilities and generating samples achieves accurate and highly effective training sample generation. Only mutated code files that have failed testing due to the vulnerable code segments are retained, ensuring that the vulnerability features in the mutated code files are clear and significantly different from normal code files. This solves the problems of invalid vulnerabilities and ambiguous features in traditional training sample generation, thus improving the quality of training samples.

[0056] According to embodiments of this disclosure, code attribute information may include code function information, unit attribute information, and code dependency information. The code function information indicates the function implemented by the code file, and the code file includes multiple functional code units that implement the function. The unit attribute information includes attribute information of the functional code units, and the code dependency information indicates the association relationship between multiple code files.

[0057] Specifically, a functional code unit can include code encapsulation units of different granularities such as functions (func) and classes (class). The unit attribute information of each functional code unit can represent the function implemented by that functional code unit.

[0058] Code dependency information can be determined based on the file inclusion directives included in multiple code files. File inclusion directives can include import directives and include directives. For example, in code file A, the file inclusion directive is #include<B.h> In this case, it means that code file A and code file B are related, and the execution of code file A depends on code file B.

[0059] According to embodiments of this disclosure, in Figure 2 In the operation S210 shown, multiple code files are identified based on their respective code attribute information, and a target code file is determined from the multiple code files. This includes: identifying the importance of the code files based on at least one of code function information, unit attribute information of multiple functional code units, and code dependency information, and obtaining identification results; and determining the target code file from the multiple code files based on the identification results of the multiple code files.

[0060] The code attribute information of multiple code files can be determined through regular expression matching and syntax analysis.

[0061] Specifically, for a code file to be analyzed, the number of functional code units it contains can be determined through regular expression matching and syntax analysis. Each functional code unit is then parsed to determine its individual unit attribute information, and the code function information of the code file is determined based on this unit attribute information. Furthermore, regular expression matching and syntax analysis can be performed on multiple code files to determine the relationships between them.

[0062] In one example of this disclosure, the importance of a code file can be identified based on one of the following: code function information, unit attribute information of each of the multiple functional code units, and code dependency information, to obtain the identification result.

[0063] In another example of this disclosure, the importance of a code file can be identified based on two items from the code function information, the unit attribute information of each of the multiple functional code units, and the code dependency information, and the identification result can be obtained.

[0064] Specifically, the importance of the code file can be identified based on the three factors mentioned above, yielding a single importance identification result for each factor. Furthermore, based on the information used in the importance identification, multiple single importance identification results are weighted and summed to obtain the code file identification result.

[0065] Based on the identification results of multiple code files, the most important code files can be selected as target code files. The number of code files selected can be preset according to the needs of sample generation.

[0066] According to embodiments of this disclosure, the importance of code files is identified from multiple dimensions, including code functionality, unit attributes, and code dependencies, enabling precise selection of target code files. High-importance code files are prioritized for generating training samples, ensuring that the training samples cover core code scenarios, avoiding redundant generation of low-value training samples, and improving the adaptability of training samples to real-world code vulnerability scenarios.

[0067] In another embodiment of this disclosure, the importance of a code file can be identified based on three factors: code function information, unit attribute information of each of the multiple functional code units, and code dependency information, to obtain an identification result. Specifically, identifying the importance of a code file based on code function information, unit attribute information of each of the multiple functional code units, and code dependency information to obtain an identification result includes: identifying the function implemented by the code file based on the code function information and target function information of the code file to obtain a first identification result; identifying the complexity of the code file based on the unit attribute information of each of the multiple functional code units to obtain a second identification result; identifying the importance of the code file based on the code dependency information of the code file to obtain a third identification result; and obtaining an identification result based on the first identification result, the second identification result, and the third identification result.

[0068] Regarding code function information, a first identification result indicating whether the function implemented by the code file is consistent with the target function information can be obtained using preset target function information. Target function information may include function information corresponding to the target function.

[0069] Among the code files for different functions involved in the software lifecycle, non-production-level temporary files such as code files for test functions and code files for repair functions have lower requirements for data anonymization. Therefore, using these code files to generate training samples may cause data leakage or pollution. Therefore, the target function information can be set as test functions, repair functions, etc.

[0070] By using the target function information to obtain the first identification result, files used to perform test functions (e.g., test_patch) and files used to perform fix functions (e.g., fix_patch) can be filtered out. This allows for the filtering out of these code files during the process of identifying the importance of code files based on code function information, thus avoiding the aforementioned data leakage or contamination issues.

[0071] Furthermore, the initial identification result can also indicate whether a code file belongs to a non-code asset and whether it belongs to a non-core path. Non-code assets can include text files, configuration files, etc., while non-core paths can include paths specifically used to store code for test functions. Based on the initial identification result, non-code assets and code files in non-core paths can be filtered out.

[0072] When code files are downloaded from an online collaborative development platform, the first identification result can also indicate the commit type of the commit history associated with the code files. For example, a commit operation might indicate that it only involves document modifications. A commit is an atomic operation on an online collaborative development platform that modifies files and permanently saves changes to code or documentation in the platform's repository. Based on the first identification result, code files that only involve document modifications can also be filtered out.

[0073] Based on the unit attribute information, the number of functional code units in the code file can be counted according to their individual unit attribute information. Then, a second identification result representing the complexity of the code file is determined based on the number of functional code units. The more functional code units a code file contains, the higher its complexity.

[0074] Regarding code dependency information, the number of times each code file is referenced by other code files can be determined based on the code dependency information of each code file. The number of times a file is referenced is used as the importance of each code file, thus obtaining a third identification result.

[0075] The code attribute information used to determine the recognition result can be flexibly set according to the needs of sample generation, and the overall recognition result can be determined according to the recognition result corresponding to the code attribute information.

[0076] Figure 3 The diagram illustrates a data flow graph of the sample generation method for determining recognition results according to an embodiment of the present disclosure.

[0077] like Figure 3As shown, the code file 310 can be parsed to determine the first identification result 331, the second identification result 332, and the third identification result 333 based on the code function information 321, the unit attribute information 322 of each of the multiple functional code units, and the code dependency information 323.

[0078] In operation S301, based on the first identification result 331, it is determined whether the function of the code file is consistent with the function indicated by the target function information. If they are consistent, operation S302 is executed; otherwise, operation S303 is executed.

[0079] In operation S302, it was determined that the identification result indicated that the code file could not be selected as the target code file.

[0080] If the first identification result indicates that the function of the code file is inconsistent with the function indicated by the target function information, it can be determined that the code file can be selected as the target code file.

[0081] In operation S303, the first recognition result 331, the second recognition result 332 and the third recognition result 333 are weighted and summed to obtain the overall score of the code file, and the overall score is used as the recognition result 340 of the code file.

[0082] According to embodiments of this disclosure, the importance of code files is decomposed into three dimensions: functional matching degree, complexity, and dependency correlation degree, which are identified separately and then comprehensively judged to achieve a refined and quantitative assessment of importance. Multi-dimensional evaluation avoids the one-sidedness of single-dimensional judgment, ensuring that the selected target code files not only fit the core functions but also possess sufficient complexity and correlation, further enhancing the training value of training samples.

[0083] According to embodiments of this disclosure, in Figure 2 In the operation S220 shown, updating the target code file to obtain a mutated code file containing the vulnerable code segment may include: updating the code segment to be updated in the target code file that is associated with the vulnerability description information to obtain the mutated code file, wherein the vulnerability description information is used to describe the problem of the vulnerable code segment.

[0084] Based on the sample generation requirements, the vulnerabilities in the code segments that need to be tested can be identified. These vulnerabilities can be non-explicit logical flaws, including incorrect calculation order, incorrect boundary conditions, and incorrect variable assignment.

[0085] Generate vulnerability description information to describe the problem, determine the code segment to be updated associated with the problem from the target code file based on the vulnerability description information, and update the code segment to be updated so that the updated code segment has the above-mentioned problem.

[0086] In one example, updating the code segment to be updated in the target code file that is associated with the vulnerability description information to obtain a mutated code file may include: parsing the target code file to obtain the code syntax tree of the target code file; determining the code segment to be updated from the target code file based on the code syntax tree and the vulnerability description information; and updating the code segment to be updated to obtain the mutated code file.

[0087] Syntax tree parsing can be used to transform target code files into code syntax trees according to the formal syntax specifications of programming languages ​​through lexical and syntactic analysis. Abstract Syntax Trees (ASTs) can be used as the code syntax trees. An AST is an intermediate representation of the source code's syntactic structure using a tree-like structure. It can ignore the specific syntactic details of the target code file's source code, retaining only the core logical structure of the code.

[0088] A code syntax tree consists of nodes and edges connecting multiple nodes. Nodes represent syntactic structural units in normal code, such as functions, variables, and expressions. Each node includes node attributes, such as the type, function, location information, and variable value of the syntactic structural unit. Edges indicate relationships between two connected nodes, such as references between two syntactic structural units.

[0089] Based on the vulnerability description information, it is possible to determine the characteristics required for the vulnerable code segment to exhibit the error indicated by the vulnerability description. Furthermore, based on these characteristics and node attributes, the node corresponding to the code segment to be updated can be determined from the code syntax tree. Based on the correspondence between nodes in the code syntax tree and code segments in the target code file, the code segment to be updated can be identified from the target code file.

[0090] By updating the code segment to be updated in the target code file based on the vulnerability description information, the mutated code file can be obtained.

[0091] According to embodiments of this disclosure, code segment to be updated is located through code syntax tree parsing, achieving precise vulnerability implantation location. Code syntax tree parsing can delve into the code structure level to identify related code segments, avoiding positioning errors caused by relying solely on text matching, ensuring that the vulnerable code segment is implanted in a logically related location, and improving the effectiveness and plausibility of the vulnerability.

[0092] In another example, updating the code segment to be updated in the target code file that is associated with the vulnerability description information to obtain a mutated code file may include: generating a prompt message to indicate code updates based on the vulnerability description information; and inputting the prompt message and the target code file into a large model to obtain the mutated code file.

[0093] Specifically, the prompt message can be determined based on the vulnerability description information. For example, if the vulnerability description information is that there is an array out-of-bounds error, the prompt message could be "Modify this code to cause an array out-of-bounds bug".

[0094] The prompt message and the target code file can be input into the large model used for rewriting the code. The large model will automatically determine the location in the target code file that is more suitable for inserting the error indicated by the vulnerability description information, identify this part of the code segment as the code segment to be updated, and update the code segment to be updated according to the prompt message to obtain the mutated code file.

[0095] Large models can have the same model architecture as Large Language Models (LLMs), which are deep learning models with relatively complex network structures. There are no restrictions on this, as long as the model can take the hint information and the target code file as input, update the code, and obtain a mutated code file injected with vulnerabilities.

[0096] According to embodiments of this disclosure, a large model is used to generate mutated code files, enabling intelligent and diversified implantation of vulnerable code segments. The large model can generate vulnerable code that conforms to code syntax and logic based on vulnerability descriptions, solving the problems of low efficiency and limited format of manual vulnerability implantation, and increasing the richness of vulnerability types in the samples. Furthermore, based on vulnerability description information, the model accurately locates the code segment to be updated and implants the vulnerability, achieving targeted generation of vulnerable code segments. This avoids the chaotic vulnerability implantation caused by indiscriminate code modification, ensuring a high degree of matching between the vulnerable code segment and the vulnerability description, and improving the targeting and clarity of vulnerability features in the training samples.

[0097] According to embodiments of this disclosure, in Figure 2 In the operation S230 shown, testing the mutated code file and obtaining test results may include: if there are multiple mutated code files, determining the concurrency level for testing based on the multiple mutated code files and hardware resource information, wherein the hardware resource information indicates the resource information of the processor used for testing; and testing the multiple mutated code files concurrently based on the concurrency level to obtain multiple test results.

[0098] Before testing the mutated code files, the number of mutated code files to be tested can be determined first. If it is determined that there are multiple mutated code files, the concurrency for testing can be determined based on the multiple mutated code files and hardware resource information.

[0099] Concurrency can be used to control the number of variant code files that can be tested simultaneously on a processor used for testing. Hardware resource information can be allocated according to the amount of resources required when testing variant code files to determine the concurrency level.

[0100] The amount of processor resources required for testing multiple variant code files can be determined based on their complexity.

[0101] The number of lines of code in a mutated code file can be counted, and this number can be used to represent the complexity of the mutated code file. Resource requirements can be represented by the number of processor cores. For example, if each processor core can process 2000 lines of code, and the complexity of a mutated code file is indicated by its 4000-6000 lines of code, then the required resources are three processor cores. Therefore, it can be determined that the resources needed to execute the test task for this mutated code file include three processor cores.

[0102] The concurrency can be determined by dividing the hardware resource information based on the actual number of processor cores included in the processor and the resource requirements of each of the multiple variant code files.

[0103] Once the concurrency level is determined, the `-cpuset-cpus` command can be used to achieve precise binding of processor cores, thereby reducing the overhead of processor context switching.

[0104] By using the above settings, it is possible to ensure that smaller variant code files can run at high concurrency during concurrent testing, and to ensure that larger variant code files can exclusively use more processor cores, avoiding resource contention.

[0105] By performing concurrent tests on multiple mutated code files based on concurrency, the test results for each mutated code file can be obtained.

[0106] According to embodiments of this disclosure, the test concurrency level is determined by combining hardware resource information, and multiple variant code files are tested concurrently to achieve resource adaptation and efficiency improvement in the sample testing phase. This avoids resource waste or test lag caused by a fixed concurrency level, significantly shortens the testing time for multiple variant files while ensuring test accuracy, and improves the overall efficiency of training sample generation.

[0107] According to embodiments of this disclosure, multiple variant code files are subjected to concurrent testing based on concurrency levels to obtain multiple test results. This includes: loading the code repository image into multiple containers, deploying operating systems for running the variant code files in each container, wherein the multiple containers are configured on a processor, the number of containers is determined based on concurrency levels, the code repository image is determined based on the code repository, and the multiple variant code files belong to the code repository; writing the variant code files into the containers via a data transfer process, wherein the data transfer process is created via container commands; and performing concurrent testing on the variant code files of each of the multiple containers to obtain multiple test results.

[0108] Once the concurrency level is determined, a corresponding number of containers can be configured on the processor, and operating systems for running the mutated code files can be deployed in multiple containers. A codebase is then determined based on the multiple mutated code files. After generating a codebase image, the codebase image is loaded into multiple containers.

[0109] The container's data transfer process can write the contents of mutated code files into the container using a zero-copy method, thus eliminating I / O (write or read) bottlenecks. This data transfer process can be created and invoked using the `docker exec -i` command.

[0110] Using the data transfer process, mutated code files can be written to containers used for testing them. After writing to multiple containers is complete, concurrent tests can be performed on the mutated code files in each container according to their concurrency level, yielding individual test results for each mutated code file.

[0111] In one embodiment, thread-level container scheduling can also be achieved through queue commands. These commands can enable concurrent testing through multi-threaded concurrency, thus leveraging the container's independent runtime environment to circumvent the Global Interpreter Lock (GIL). Furthermore, an automatic retry mechanism for reset failures can be configured in the workspace, with a preset time threshold for automatic circuit breaking in case of test timeout, achieving fine-grained fault tolerance.

[0112] According to embodiments of this disclosure, the number of containers is configured based on concurrency levels, and isolated concurrent testing of mutated code files is achieved through containerized deployment. The containerized environment avoids mutual interference between tests of different mutated code files, while utilizing container data transfer processes to efficiently write mutated code files, ensuring the consistency of the testing environment and the stability of the testing process, thereby improving the reliability of test results.

[0113] According to embodiments of this disclosure, test cases for testing mutated code files can be obtained as follows: Sample test cases are set up, the target code file is tested, and if the test passes, the sample test cases are used as subsequent test cases for testing the mutated code files. A test is considered passed if the test results indicate that the target code file compiles successfully, can run, and the running results are consistent with expectations.

[0114] The test results can be analyzed in the following ways to determine whether the test failure was caused by the vulnerable code segment: If the test result indicates that the modified code file passed (Pass), the result is Pass to Pass (P2P), indicating that the vulnerable code segment did not cause the test failure. If the test result indicates that the modified code file failed (Fail), and the error message or the error in the execution result matches the vulnerability description information corresponding to the vulnerable code segment, the result is Fail to Pass (F2P), indicating that the test failure was caused by the vulnerable code segment. If the test result indicates that the modified code file failed (Fail), but the error message or the error in the execution result is inconsistent with the vulnerability description information corresponding to the vulnerable code segment, the result is Pass to Fail (P2F) or Fail to Fail (F2F), indicating that the test failure was not caused by the vulnerable code segment.

[0115] Figure 4 A timing diagram illustrating the concurrent testing performed by the sample generation method according to an embodiment of the present disclosure is shown.

[0116] like Figure 4 As shown, the interaction process includes operations S401 to S409. The task queue, scheduler, controller, and container participate in this interaction process, and all of these components can be located on the same server (also known as the host machine).

[0117] When operating S401, the scheduler will retrieve the stored mutated code file from the task queue.

[0118] The mutated code file is obtained by the controller updating the target code file, which is selected by the controller from multiple code files.

[0119] In operation S402, the scheduler reads the mutated code file and determines the number of lines of code in the mutated code file.

[0120] When operating S403, the scheduler determines the number of processor cores pre-allocated for the mutated code file based on the number of lines of code.

[0121] When operating S404, the scheduler sends processor core binding requests to the controller according to the pre-allocated number of processor cores.

[0122] When operating S405, the controller partitions the processor cores within a processor based on processor core binding requests and deploys containers. If a processor has not been partitioned according to a processor core binding request, the controller performs the partitioning operation; if a processor has already been partitioned according to a processor core binding request, the controller sends a reuse instruction.

[0123] When operating S406, the scheduler sends a data transmission request to the controller.

[0124] When operating S407, the controller establishes a data transfer process with the container and transfers the variant code file to the container.

[0125] While operating S408, the mutated code file is tested in the container.

[0126] In operation S409, the test results of the mutated code file are returned to the scheduler.

[0127] Understandably, for multiple code files in an open-source repository list, a mirror of that list can be pulled, and a scheduler can assign tasks to inspect and process the multiple code files in order to determine the target code file from among them.

[0128] For the target code file, the target code file can be updated to obtain the mutated code file by using methods such as automatic generation of large models or code syntax tree parsing.

[0129] In the case of multiple mutated code files, each mutated code file performs the above operations S401 to S409 to achieve concurrent testing of multiple mutated code files.

[0130] According to embodiments of this disclosure, in performing Figure 2 Prior to operation S230, the sample generation method further includes updating the difference description file and the variant code file to the code repository. The difference description file characterizes the differences between the variant code file and the target code file, and the code repository is used to store multiple code files.

[0131] By comparing the mutated code file and the target code file, a difference analysis file can be generated that describes the differences between the two. This comparison can be performed in a local temporary directory using the command `git diff --no-index`, generating the difference analysis file.

[0132] It should be noted that after generating the difference description file, the path of the difference description file can be standardized by using regular expression replacement. The header path of the difference description file is corrected to a standard format that meets the requirements of the code repository, so as to ensure that the difference description file can be directly obtained from the code repository or code repository mirror in the future.

[0133] According to embodiments of this disclosure, updating the difference description file and the variant code file to the code repository ensures that the code repository image includes these files, thereby ensuring that the variant code file can be successfully written to the container for testing through the data transfer process. Furthermore, synchronously updating the difference description file and the variant code file to the code repository enables sample traceability and version management. The difference description file clearly records the differences between the variant code and the original code, facilitating the analysis of vulnerability features during subsequent model training. Simultaneously, the unified storage in the code repository ensures the reusability and traceability of training samples.

[0134] According to embodiments of this disclosure, in Figure 2 In the operation S240 shown, training samples are generated based on the mutated code file and the target code file. This may include generating training samples based on the vulnerability description information of the mutated code file and the vulnerable code segment, and the code library mirror of the code library to which the target code file belongs.

[0135] The vulnerability description information of the vulnerable code segment and the code repository image can be used as labels for training samples, while the mutated code file can be used as input data for training samples. This allows the model to learn the problems existing in the mutated code file based on the vulnerability description information during subsequent training, and to learn the results of fixing the mutated code file based on the target code file in the code repository image.

[0136] According to embodiments of this disclosure, training samples are generated by combining mutated code files, vulnerability description information, and code repository images, providing complete contextual information for model training. The vulnerability description information supplements the vulnerability feature description, and the code repository image provides code runtime environment information, ensuring that the samples not only contain differences in code content but also include vulnerability background and environmental information, thereby improving the model's ability to understand and fix vulnerabilities.

[0137] Figure 5 A flowchart illustrating a training method for a model according to an embodiment of the present disclosure is shown schematically.

[0138] like Figure 5 As shown, the method includes operations S510 to S530.

[0139] Use the S510 to obtain training samples.

[0140] When operating the S520, the mutation code file is input into the model to be trained to obtain the corrected code file.

[0141] When operating the S530, based on the target code file and the correction code file, the parameters of the model to be trained are adjusted to obtain the trained model.

[0142] Training samples may include mutated code files and target code files, and may also include a difference description file to characterize the differences between the compiled code files and the target code files. Training samples can be obtained by processing multiple code files according to the sample generation method provided in the embodiments of this disclosure.

[0143] The model to be trained can be used to process code files containing vulnerable code in order to correct the vulnerabilities in those files. By using the model to train the compiled code files, the corrected code files can be obtained.

[0144] The target code file is the correct code file corresponding to the mutated code file, while the corrected code file is the code file obtained by correcting the mutated code file using the model to be trained. Based on the differences between the target code file and the corrected code file, the parameters of the model to be trained can be adjusted to obtain the trained model.

[0145] The file differences mentioned above can be used as the loss of the model to be trained. If it is determined that the loss has not converged, the parameters of the model to be trained are adjusted based on the loss to obtain the adjusted model. The adjusted model is then used as the model to be trained, and the above operations S510 to S530 are repeated until the loss converges. The model with converged loss can then be used as the trained model.

[0146] According to embodiments of this disclosure, a sample generation method is used to adjust parameters by comparing the corrected code with the target code, thereby achieving precise optimization of the code repair model. The explicit vulnerability features and normal code references in the training samples enable the model to effectively learn vulnerability repair logic, improving the accuracy and generalization of vulnerability repair.

[0147] Figure 6 A flowchart illustrating a code processing method according to an embodiment of the present disclosure is shown schematically.

[0148] like Figure 6 As shown, the method includes operation S610.

[0149] When operating the S610, the code file to be processed is input into the correction model to obtain the corrected code.

[0150] The modified model can be trained according to the model training method provided in the embodiments of this disclosure. Because the modified model learns the differences and characteristics between the mutated code file and the target code file during the training process using the model training method, it learns the repair logic for the vulnerable code. Therefore, the modified model can be used to process code files containing vulnerable code.

[0151] The code file to be processed can be a code file containing vulnerable code. By using the correction model to process the code file to be processed, the vulnerable code can be corrected to obtain the corrected code.

[0152] According to embodiments of this disclosure, the code to be processed is input into a correction model trained by a model training method to achieve automated and high-precision code vulnerability repair. Since the model is trained on high-quality samples, its learned vulnerability identification and repair logic can accurately identify vulnerabilities in the code and output corrective code, solving the problems of low efficiency and poor accuracy in traditional code repair methods, and improving the efficiency and effectiveness of code security processing.

[0153] Figure 7 A block diagram of a sample generation apparatus according to an embodiment of the present disclosure is shown schematically.

[0154] like Figure 7 As shown, the sample generation device 700 of this embodiment includes a file recognition module 710, a file update module 720, a file testing module 730, and a sample generation module 740.

[0155] The file recognition module 710 is used to identify multiple code files based on their respective code attribute information, and to determine the target code file from among the multiple code files.

[0156] The file update module 720 is used to update the target code file to obtain a mutated code file containing the vulnerable code segment.

[0157] The file testing module 730 is used to test the mutated code file and obtain the test results.

[0158] The sample generation module 740 is used to generate training samples based on the mutated code file and the target code file when the test results indicate that the test failed due to the vulnerability code segment.

[0159] According to embodiments of this disclosure, the file recognition module 710 includes a file recognition submodule and a file determination submodule.

[0160] The file recognition submodule is used to identify the importance of code files based on at least one of the following: code function information, unit attribute information of multiple functional code units, and code dependency information, and to obtain the recognition result.

[0161] The file identification submodule is used to identify the target code file from multiple code files based on the identification results of each of the multiple code files.

[0162] According to embodiments of this disclosure, the document recognition submodule includes a first recognition unit, a second recognition unit, a third recognition unit, and a comprehensive recognition unit.

[0163] The first identification unit is used to identify the functions implemented by the code file based on the code function information and target function information of the code file, and obtain the first identification result.

[0164] The second identification unit is used to identify the complexity of the code file based on the unit attribute information of each of the multiple functional code units, and obtain the second identification result.

[0165] The third identification unit is used to identify the importance of code files based on the code dependency information of the code files, and obtain the third identification result.

[0166] The integrated recognition unit is used to obtain the recognition result based on the first recognition result, the second recognition result, and the third recognition result.

[0167] According to embodiments of this disclosure, the file testing module 730 includes a concurrency determination submodule and a concurrency testing submodule.

[0168] The concurrency determination submodule is used to determine the concurrency for testing based on multiple variant code files and hardware resource information when there are multiple variant code files. The hardware resource information indicates the resource information of the processor used for testing.

[0169] The concurrent testing submodule is used to perform concurrent testing on multiple variant code files based on the degree of concurrency, and obtain multiple test results.

[0170] According to embodiments of this disclosure, the concurrent testing submodule includes an image loading unit, a file writing unit, and a concurrent testing unit.

[0171] The image loading unit is used to load the code repository image into multiple containers, and deploy operating systems for running mutated code files in multiple containers. The multiple containers are configured on processors, the number of multiple containers is determined based on concurrency, the code repository image is determined based on the code repository, and the multiple mutated code files belong to the code repository.

[0172] The file writing unit is used to write mutated code files into the container through the container's data transfer process, which is created by container commands.

[0173] The concurrent test unit is used to perform concurrent tests on the variant code files of multiple containers and obtain multiple test results.

[0174] According to embodiments of this disclosure, the sample generation apparatus 700 further includes a codebase update module.

[0175] The code repository update module is used to update the code repository with difference description files and variant code files. The difference description files describe the differences between the variant code files and the target code files. The code repository is used to store multiple code files.

[0176] According to embodiments of this disclosure, the file update module 720 includes a code update submodule.

[0177] The code update submodule is used to update the code segments in the target code file that are associated with the vulnerability description information, resulting in a mutated code file. The vulnerability description information describes the problem of the vulnerable code segment.

[0178] According to embodiments of this disclosure, the code update submodule includes a code parsing unit, a code determination unit, and a code update unit.

[0179] The code parsing unit is used to parse the target code file into a syntax tree, thereby obtaining the code syntax tree of the target code file.

[0180] The code determination unit is used to determine the code segment to be updated from the target code file based on the code syntax tree and vulnerability description information.

[0181] The code update unit is used to update the code segment to be updated, resulting in a mutated code file.

[0182] According to embodiments of this disclosure, the code update submodule includes an information generation unit and an information input unit.

[0183] The information generation unit is used to generate prompts indicating code updates based on vulnerability description information.

[0184] The information input unit is used to input prompts and target code files into the large model to obtain mutation code files.

[0185] According to embodiments of this disclosure, the sample generation module 740 includes a sample generation submodule.

[0186] The sample generation submodule is used to generate training samples based on the vulnerability description information of the mutated code file and the code repository image of the code repository to which the target code file belongs.

[0187] Figure 8 A block diagram of a training apparatus for a model according to an embodiment of the present disclosure is shown schematically.

[0188] like Figure 8 As shown, the training device 800 of the model in this embodiment includes a sample acquisition module 810, a file input module 820, and a model training module 830.

[0189] The sample acquisition module 810 is used to acquire training samples, which include mutated code files and target code files.

[0190] The file input module 820 is used to input the mutation code file into the model to be trained to obtain the corrected code file.

[0191] The model training module 830 is used to adjust the parameters of the model to be trained based on the target code file and the correction code file, so as to obtain the trained model.

[0192] The training samples are obtained by processing multiple code files using the aforementioned sample generation device.

[0193] Figure 9 A block diagram of a code processing apparatus according to an embodiment of the present disclosure is shown schematically.

[0194] like Figure 9 As shown, the code processing apparatus 900 of this embodiment includes a code correction module 910.

[0195] The code correction module 910 is used to input the code file to be processed into the correction model to obtain the corrected code.

[0196] The modified model is trained using the training device of the aforementioned model.

[0197] Figure 10 A schematic block diagram of a smart agent according to an embodiment of the present disclosure is shown.

[0198] In embodiments of this disclosure, such as Figure 10 As shown, the intelligent agent 1000 may include an input module 1010, a processing module 1020, and an output module 1030.

[0199] Input module 1010 is used to receive input information.

[0200] The processing module 1020 is used to determine the target task based on the input information received by the input module, determine the large language model based on the target task, and obtain output information by calling the large language model to execute the sample generation method, model training method or code processing method provided in the embodiments of this disclosure.

[0201] Output module 1030 is used to output the output information obtained by the processing module.

[0202] According to embodiments of this disclosure, the input module 1010 is responsible for receiving or sensing information such as queries, requests, instructions, signals, or data from the outside world (e.g., users or the external environment), and converting it into a format that the intelligent agent 1000 can understand and process. The input module 1010 is the primary link for the intelligent agent 1000 to interact with the outside world, enabling the intelligent agent 1000 to efficiently and accurately obtain necessary "sensory" information from the outside world and respond to this information.

[0203] In the example, input module 1010 can input the code file, variant code file, code file to be processed, etc., as described above.

[0204] In the example, the processing module 1020 is the core support for the agent 1000's ability to handle complex tasks. The processing module 1020 can execute the sample generation method, model training method, and code processing method described above.

[0205] In the example, the performance of the processing module 1020 is closely related to the large model on which the agent 1000 is based. To fully leverage the capabilities of the large model, the internal structure of the processing module 1020 can be designed to be highly configurable and scalable to handle various types of tasks and requirements in real-world scenarios.

[0206] Understandably, while large language models possess excellent language understanding and generation capabilities, like humans, their ability to solve tasks is limited without the aid of any tools. When Agent 1000 is given the ability to invoke tools, it can perform tasks such as using a calculator to perform mathematical calculations, using Python to perform data analysis, and using a search engine to create weather forecasts.

[0207] In the example, output module 1030 can output the training samples, trained model, and corrected code described above.

[0208] The intelligent agent 1000 according to the embodiments of this disclosure can simply and effectively improve the level of intelligence, and enhance flexibility and versatility.

[0209] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0210] According to an embodiment of the present disclosure, an electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0211] According to embodiments of the present disclosure, a non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions are used to cause a computer to perform the method described above.

[0212] According to an embodiment of this disclosure, a computer program product includes a computer program that, when executed by a processor, implements the method described above.

[0213] Figure 11 A schematic block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0214] like Figure 11 As shown, device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in read-only memory (ROM) 1102 or a computer program loaded into random access memory (RAM) 1103 from storage unit 1108. The RAM 1103 may also store various programs and data required for the operation of device 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Input / output (I / O) interface 1105 is also connected to bus 1104.

[0215] Multiple components in device 1100 are connected to input / output (I / O) interface 1105, including: input unit 1106, such as a keyboard, mouse, etc.; output unit 1107, such as various types of displays, speakers, etc.; storage unit 1108, such as a disk, optical disk, etc.; and communication unit 1109, such as a network card, modem, wireless transceiver, etc. Communication unit 1109 allows device 1100 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0216] The computing unit 1101 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above, such as sample generation methods, model training methods, and code processing methods. For example, in some embodiments, the sample generation methods, model training methods, and code processing methods can be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on device 1100 via ROM 1102 and / or communication unit 1109. When the computer program is loaded into RAM 1103 and executed by the computing unit 1101, one or more steps of the sample generation methods, model training methods, and code processing methods described above can be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured in any other suitable manner (e.g., by means of firmware) to perform sample generation methods, model training methods, and code processing methods.

[0217] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0218] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0219] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0220] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0221] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0222] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, distributed system servers, or servers incorporating blockchain technology.

[0223] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0224] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A sample generation method, comprising: Based on the code attribute information of each of the multiple code files, the multiple code files are identified separately, and the target code file is determined from the multiple code files; The target code file is updated to obtain a mutated code file containing the vulnerable code segment; The mutated code file was tested, and the test results were obtained. as well as If the test result indicates that the test failed due to the vulnerable code segment, a training sample is generated based on the mutated code file and the target code file.

2. The method according to claim 1, wherein, The code attribute information includes code function information, unit attribute information, and code dependency information. The code function information indicates the function implemented by the code file. The code file includes multiple functional code units that implement the function. The unit attribute information includes the attribute information of the functional code unit. The code dependency information indicates the association relationship between multiple code files. The step of identifying the multiple code files based on their respective code attribute information and determining the target code file from among the multiple code files includes: Based on at least one of the following: the code function information, the unit attribute information of each of the multiple functional code units, and the code dependency information, the importance of the code file is identified, and an identification result is obtained; and The target code file is determined from the multiple code files based on the identification results of each of the multiple code files.

3. The method according to claim 2, wherein, Based on the code function information, the unit attribute information of each of the multiple functional code units, and the code dependency information, the importance of the code file is identified, and the identification result is obtained, including: Based on the code function information and target function information of the code file, the function implemented by the code file is identified to obtain a first identification result; Based on the unit attribute information of each of the multiple functional code units, the complexity of the code file is identified to obtain a second identification result; Based on the code dependency information of the code files, the importance of the code files is identified, resulting in a third identification result; and The identification result is obtained based on the first identification result, the second identification result, and the third identification result.

4. The method according to any one of claims 1 to 3, wherein, The test results obtained by testing the mutated code file include: When there are multiple variant code files, the concurrency level for testing is determined based on the multiple variant code files and hardware resource information, wherein the hardware resource information indicates the resource information of the processor used for testing; and Based on the concurrency level, multiple variant code files are tested concurrently, resulting in multiple test results.

5. The method according to claim 4, wherein, Based on the concurrency level, concurrent tests are performed on multiple mutated code files to obtain multiple test results, including: The code repository image is loaded into multiple containers, and an operating system for running the mutated code files is deployed in each of the multiple containers. The multiple containers are configured on the processor, the number of the multiple containers is determined based on the concurrency, the code repository image is determined based on the code repository, and the multiple mutated code files belong to the code repository. The mutated code file is written into the container via a data transfer process, wherein the data transfer process is created via container commands; and Concurrent testing was performed on the mutated code files of each of the multiple containers, resulting in multiple test results.

6. The method according to claim 5, further comprising: The difference description file and the variant code file are updated to the code repository, wherein the difference description file characterizes the differences between the variant code file and the target code file, and the code repository is used to store multiple code files.

7. The method according to any one of claims 1 to 6, wherein, The process of updating the target code file to obtain a mutated code file containing the vulnerable code segment includes: The target code file is updated by updating the code segment to be updated that is associated with the vulnerability description information to obtain the mutated code file, wherein the vulnerability description information is used to describe the problem of the vulnerability code segment.

8. The method according to claim 7, wherein, The step of updating the code segment in the target code file that is associated with the vulnerability description information to obtain the mutated code file includes: The target code file is parsed to obtain the code syntax tree of the target code file; Based on the code syntax tree and the vulnerability description information, the code segment to be updated is determined from the target code file; and The code segment to be updated is updated to obtain the mutated code file.

9. The method according to claim 7, wherein, The step of updating the code segment in the target code file that is associated with the vulnerability description information to obtain the mutated code file includes: Based on the vulnerability description information, a prompt message is generated to instruct code updates; and The prompt information and the target code file are input into the large model to obtain the mutation code file.

10. The method according to any one of claims 1 to 9, wherein, The step of generating training samples based on the mutated code file and the target code file includes: The training samples are generated based on the mutated code file, the vulnerability description information of the vulnerable code segment, and the code repository mirror of the code repository to which the target code file belongs.

11. A method for training a model, comprising: Obtain training samples, wherein the training samples include mutated code files and target code files; The mutation code file is input into the model to be trained to obtain the corrected code file; and Based on the target code file and the corrected code file, the parameters of the model to be trained are adjusted to obtain the trained model; The training samples are obtained by processing multiple code files according to any one of claims 1 to 10.

12. A code processing method, comprising: Input the code file to be processed into the correction model to obtain the corrected code; The modified model is trained according to the method described in claim 11.

13. A sample generation apparatus, comprising: The file recognition module is used to identify the multiple code files based on their respective code attribute information, and to determine the target code file from the multiple code files. The file update module is used to update the target code file to obtain a mutated code file containing the vulnerable code segment; The file testing module is used to test the mutated code file and obtain test results; as well as The sample generation module is used to generate training samples based on the mutated code file and the target code file when the test result indicates that the test failed due to the vulnerable code segment.

14. A training device for a model, comprising: A sample acquisition module is used to acquire training samples, wherein the training samples include mutated code files and target code files; A file input module is used to input the mutation code file into the model to be trained, thereby obtaining a corrected code file; and The model training module is used to adjust the parameters of the model to be trained based on the target code file and the corrected code file to obtain the trained model; The training samples are obtained by processing multiple code files using the apparatus described in claim 13.

15. A code processing apparatus, comprising: The code correction module is used to input the code file to be processed into the correction model to obtain the corrected code; The modified model is trained according to the apparatus as described in claim 14.

16. An intelligent agent, comprising: The input module is used to receive input information; The processing module is configured to determine a target task based on the input information received by the input module, determine a large language model based on the target task, and obtain output information by calling the large language model to execute the method of any one of claims 1 to 12; An output module is used to output the output information obtained by the processing module.

17. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 12.

18. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 12.

19. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 12.

Images