A code verification method and system based on twin modeling

Abstract

The application discloses a code verification method and system based on twin modeling, comprising the following steps: obtaining target code, performing analysis processing and line area division on the target code; constructing a code twin model, and performing aggregation processing on running evidence data; obtaining a verification rule set, and converting the verification rule set into a rule constraint set; constructing an abstract semantic mapping relationship according to an abstract analysis parameter; performing iteration propagation processing of an abstract state, and introducing a twin constraint set; performing verification determination on the rule constraint set based on a stable abstract state set, constructing a code side abstract state transition relationship based on a twin behavior track library, and performing differential consistency verification; performing consistency degree determination, updating the abstract analysis parameter and reiterating propagation when a condition is met, and outputting a code verification result. The application adopts twin modeling and abstract state propagation technology, and realizes efficient and accurate code verification and consistency verification.

Description

Technical Field

[0001] This invention relates to the field of code verification technology, and in particular to a code verification method and system based on twin modeling. Background Technology

[0002] As software systems become increasingly larger and more complex, code verification technology plays a crucial role in ensuring program correctness, stability, and security. Existing code verification methods primarily include rule-based verification based on static analysis and behavior analysis based on dynamic runtime monitoring. Static analysis methods typically analyze code using abstract syntax trees, control flow graphs, or call relationship graphs to identify potential rule violations and defects. Their advantage lies in covering a wide range of code paths without actually running the program. However, due to their reliance on pre-defined abstract models and conservative assumptions, they are prone to false positives or overlooking issues related to actual runtime behavior. Dynamic analysis methods, on the other hand, analyze code execution behavior by collecting logs or monitoring data during program execution, reflecting the true runtime state. However, limited by the scope of the test scenario, they struggle to comprehensively reflect all potential execution paths.

[0003] In existing technologies, static and dynamic analysis are often independent of each other, lacking an effective unified modeling mechanism, leading to inconsistencies between static verification results and actual runtime behavior. Furthermore, when dealing with complex program structures, existing methods typically use function or statement levels as analysis units, lacking a unified state propagation and constraint modeling approach based on region-level structures, making it difficult to perform refined verification of rule violations across regions and paths. In addition, existing technologies generally lack mechanisms to use runtime evidence to provide feedback and correction to the abstract analysis process, making it difficult for the verification process to converge to stable analysis results that match actual runtime behavior, thus limiting the accuracy and practicality of code verification results.

[0004] Therefore, how to provide a code verification method and system based on twin modeling is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a code verification method and system based on twin modeling. This invention comprehensively utilizes program structure analysis, code twin modeling, and abstract state propagation techniques to perform unified modeling and joint verification of the static structure and actual runtime behavior of the target code. By introducing an abstract analysis parameter update mechanism driven by runtime evidence, it achieves iterative verification and correction of rule violations and consistency deviations. This invention can integrate real runtime evidence on the basis of static analysis, achieving closed-loop convergence of the code verification process. It possesses advantages such as high consistency between verification results and actual runtime, low false alarm rate, and strong adaptability to complex program structures.

[0006] A code verification method based on twin modeling according to an embodiment of the present invention includes the following steps: The target code is obtained, parsed, and processed to generate a program structure representation. The target code is then divided into regions to generate a set of program regions. Construct a code twin model, aggregate the runtime evidence data, generate twin evidence vectors and evidence confidence weight sets, write the runtime evidence data into the code twin model, and generate a twin behavior trajectory library; Obtain the validation rule set, convert the validation rule set into a rule constraint set, and establish the association between the rule constraint set and the program region set based on the program structure representation; Based on the twin evidence vector and the evidence confidence weight set, abstract analysis parameters are generated, and abstract semantic mapping relationships are constructed based on the abstract analysis parameters to generate a twin constraint set. Using abstract semantic mapping relationships as state propagation rules, iterative propagation processing of abstract states is performed, and a set of twin constraints is introduced to generate a set of stable abstract states; The set of rules and constraints is verified and judged based on the set of stable abstract states. The code-side abstract state transition relationship is constructed based on the twin behavior trajectory library. Differential consistency verification is performed to generate a set of consistency violation candidates. An abstract set of counterexample trajectories is generated based on the candidate set of rule violations and the candidate set of consistency violations. Consistency is determined, and when the conditions are met, the abstract analysis parameters are updated and the propagation is iterated again. The code verification results are then output.

[0007] Optionally, the steps of obtaining the target code, parsing the target code, generating a program structure representation, and dividing the target code into regions to generate a program region set specifically include: Obtain the target code, perform lexical and syntactic analysis on the target code, and construct an abstract syntax tree; Based on the abstract syntax tree, the syntax structure of the target code is traversed and parsed to form a set of functions, a set of basic blocks, and a set of variables; Based on the set of basic blocks, the execution order and jump relationship between the basic blocks in the target code are analyzed, and a control flow graph is constructed. Based on the function set, the call relationships between functions in the target code are analyzed, and a call relationship graph is constructed; The abstract syntax tree, control flow graph, and call relationship graph are integrated into a unified representation of the program structure; Based on the program structure representation, the static structure and execution relationship of the target code are analyzed to generate a set of program regions.

[0008] Optionally, the construction of the code twin model, the aggregation processing of runtime evidence data to generate twin evidence vectors and evidence confidence weight sets, the writing of runtime evidence data into the code twin model, and the generation of a twin behavior trajectory library specifically include: Based on program structure representation and program region set, a code twin model is constructed, and an independent twin representation space is established for the target code in the code twin model; Based on the program region division results in the program region set, a corresponding region twin node is created for each program region in the code twin model; In the code twin model, a twin structure mapping module is constructed to generate a twin structure mapping table based on the program structure representation; In the code twin model, a twin state management module is built, and a corresponding twin state dictionary is established for each regional twin node in the regional twin node set, forming a set of twin state dictionaries; Runtime evidence data is collected from online logs. Based on the twin structure mapping table, each piece of runtime evidence data is structurally aligned and associated with a specific program region in the target code, and further mapped to the region twin node. The execution evidence data mapped to each program region is aggregated according to the program region set to generate evidence vectors. For various statistical information in the twin evidence vectors, a set of evidence confidence weights is generated. A twin behavior trajectory management module is built in the code twin model. Based on the runtime evidence data, the actual execution process of the target code is reconstructed in time sequence to generate a twin behavior trajectory library.

[0009] Optionally, the step of obtaining the verification rule set, converting the verification rule set into a rule constraint set, and establishing the association between the rule constraint set and the program region set based on the program structure representation specifically includes: Obtain the set of verification rules and assign a unique rule identifier to each verification rule in the set; The validation rules in the validation rule set are subjected to structured parsing to form an intermediate representation of the rules; Each validation rule in the intermediate rule representation is constrained to form a rule constraint set; Based on the program structure representation, structural positioning analysis is performed on each rule constraint in the rule constraint set to generate the correspondence between the rule constraints and program structure elements; Based on the correspondence between rule constraints and program structure elements, the rule constraint set and program region set are associated to generate a rule-region association table.

[0010] Optionally, the step of generating abstract analysis parameters based on the twin evidence vector and the evidence confidence weight set, constructing an abstract semantic mapping relationship based on the abstract analysis parameters, and generating a twin constraint set specifically includes: Based on the twin evidence vectors corresponding to the program region and the set of evidence confidence weights corresponding to the twin evidence vectors, the comprehensive evidence index of the program region is calculated. Based on the comprehensive evidence index corresponding to the program area, corresponding abstract analysis parameters are generated for the program area, forming a set of abstract analysis parameters. Based on the abstract analysis parameters corresponding to the program regions, construct corresponding abstract semantic mapping relationships for the program regions, forming a set of abstract semantic mapping relationships; Based on the set of abstract semantic mapping relationships, twin evidence vectors, and the set of evidence confidence weights, a corresponding set of twin constraints is generated for the program region.

[0011] Optionally, the step of using abstract semantic mapping relationships as state propagation rules, performing iterative propagation processing of abstract states, and introducing a set of twin constraints to generate a stable set of abstract states specifically includes: For each program region in the program region set, the abstract state of the program region is initialized according to the abstract analysis parameters corresponding to the program region, generating an initial abstract state and forming an initial abstract state set. Based on the abstract semantic mapping relationship corresponding to the program region, perform abstract state propagation processing on the initial abstract state set to form a propagation intermediate state set; During the current round of abstract state propagation, a set of twin constraints corresponding to the program region is introduced. Constraint fusion processing is performed on the set of intermediate propagation states obtained from the previous round of abstract state propagation to generate the constraint fusion abstract state of the program region in the current round, forming a set of constraint fusion states. For each program region in the program region set, a termination determination is made by comparing the constraint fusion abstract state obtained by the program region in the current round with the abstract state in the previous round. When the termination condition of the abstract state iteration propagation is met, the abstract state corresponding to each program region in the program region set at the termination time is obtained to form a stable abstract state set.

[0012] Optionally, the step of verifying and judging the rule constraint set based on the stable abstract state set, constructing the code-side abstract state transition relationship based on the twin behavior trajectory library, performing differential consistency verification, and generating a consistency violation candidate set specifically includes: Read the set of stable abstract states for each program region and obtain the program region identifier corresponding to each stable abstract state; Read the rule constraint set and the rule-region association table. Based on the rule-region association table, determine the target program region associated with each rule constraint and obtain the stable abstract state. Using a stable abstract state as the verification input, constraint satisfaction is determined for each rule constraint associated with the target program region, forming a candidate set of rule violations; Read the twin behavior trajectory library stored in the code twin model, traverse and analyze the actual running process of the target code recorded in the twin behavior trajectory library, and generate a set of twin transition edges; For each twin transition edge in the twin transition edge set, a twin transition constraint set is generated based on the running evidence data and the evidence confidence weight set; Based on program structure representation, the static control structure and function call structure of the target code are analyzed to construct the abstract state transition relationship on the code side; Based on the set of twin transition edges and the set of twin transition constraints, an abstract state transition relationship is constructed on the twin side; Perform differential consistency checks on the abstract state transition relationships on the code side and the abstract state transition relationships on the twin side to form a candidate set of consistency violations.

[0013] Optionally, the step of generating an abstract negative example trajectory set based on the rule violation candidate set and the consistency violation candidate set, performing consistency determination, updating the abstract analysis parameters and re-iteratio propagation when the conditions are met, and outputting the code verification result specifically includes: Based on the candidate set of rule violations and the candidate set of consistency violations, backtracking or expansion processing is performed to generate a program region-level abstract state transition path. The program region identifiers and their corresponding abstract states arranged in execution order in the program region-level abstract state transition path are combined to form an abstract counterexample trajectory, which is then collected to form an abstract counterexample trajectory set. For each abstract counterexample trajectory in the set of abstract counterexample trajectories, the consistency degree is calculated to obtain the set of counterexample consistency degrees. Based on the set of counterexample consistency, the counterexample consistency corresponding to each abstract counterexample trajectory is judged according to preset conditions. When the preset conditions are met, the abstract analysis parameters corresponding to the program area are updated. Based on the updated abstract analysis parameters, the iterative propagation process of the abstract state is re-executed to generate an updated set of stable abstract states; Write the set of abstract counterexample trajectories and the set of counterexample consistency into the code twin model, establish the correspondence between the abstract counterexample trajectories and the counterexample consistency in the code twin model, and generate a twin counterexample index table; Based on the twin counterexample index table and the updated stable abstract state set, the decision processing of the rule constraint set and differential consistency verification process is re-executed. When the preset termination condition is met, the iteration ends and the code verification result is output.

[0014] A code verification system based on twin modeling according to an embodiment of the present invention includes the following modules: The code structure parsing module is used to parse the target code and generate a program structure representation, perform region division, and obtain a set of program regions. The twin model construction module is used to build code twin models based on program structure representation and region set, and generate twin structure mapping table and twin state dictionary; The rule constraint generation module is used to convert the validation rule set into a rule constraint set and establish the association between the rule constraints and the program area; The abstract analysis module is used to generate abstract analysis parameters based on twin evidence vectors and evidence confidence weights, and to construct abstract semantic mapping relationships and twin constraint sets. The state propagation module is used to perform iterative propagation of abstract states in the program region based on abstract semantic mapping relationships, and introduces twin constraints to generate a stable set of abstract states; The verification and consistency module is used to perform rule verification based on a stable abstract state set, and generate a set of candidate rule violations and a set of twin transition edges; The counterexample generation module is used to generate an abstract set of counterexample trajectories based on rule violations and consistency violations, and to generate a set of counterexample consistency based on consistency determination, and output the code verification results.

[0015] The beneficial effects of this invention are: This invention unifies the modeling of the program structure parsing results and the twin model formed by the runtime logs, enabling the static structure information of the code and the actual runtime behavior to be verified within the same analytical framework. This achieves joint verification of code rule compliance and behavioral consistency. Through an abstract state propagation and rule constraint judgment mechanism based on program regions, it can systematically analyze potential rule violations and state deviations without relying on complete runtime coverage, improving the code verification process's coverage of complex control structures and cross-regional execution paths.

[0016] This invention introduces an abstract analysis parameter generation and update mechanism based on twin evidence vectors and evidence confidence weights, enabling the abstract analysis process to be driven by operational evidence and dynamically adjusted during the verification process. By determining the consistency of the abstract counterexample trajectory and updating the feedback, iterative correction of the abstract state propagation process is achieved, allowing the stable abstract state to gradually approach the actual operating state, thereby reducing the deviation between static analysis and dynamic behavior and improving the effectiveness and stability of the verification results.

[0017] This invention achieves structured identification of the differences between code design logic and actual runtime behavior by constructing abstract state transition relationships on the code side and on the twin side, and performing differential consistency checks on both. Combined with indexed management of negative example trajectories and control of termination conditions, the code verification process is made convergent and controllable, which is beneficial for forming reusable and traceable code verification results in complex software systems, providing a reliable basis for subsequent code optimization and quality assessment. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 Here is a flowchart of a code verification method and system based on twin modeling proposed in this invention; Figure 2 This is a schematic diagram of a code verification method based on twin modeling and the twin model structure in the system proposed in this invention; Figure 3 This invention presents a code verification method based on twin modeling and a flowchart of the generation and updating of abstract analysis parameters in the system. Figure 4 The present invention presents a code verification method and system architecture diagram based on twin modeling. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0020] refer to Figures 1-3 A code verification method based on twin modeling includes the following steps: The target code is obtained, parsed, and processed to generate a program structure representation. The target code is then divided into regions to generate a set of program regions. Construct a code twin model, aggregate the runtime evidence data, generate twin evidence vectors and evidence confidence weight sets, write the runtime evidence data into the code twin model, and generate a twin behavior trajectory library; Obtain the validation rule set, convert the validation rule set into a rule constraint set, and establish the association between the rule constraint set and the program region set based on the program structure representation; Based on the twin evidence vector and the evidence confidence weight set, abstract analysis parameters are generated, and abstract semantic mapping relationships are constructed based on the abstract analysis parameters to generate a twin constraint set. Using abstract semantic mapping relationships as state propagation rules, iterative propagation processing of abstract states is performed, and a set of twin constraints is introduced to generate a set of stable abstract states; The set of rules and constraints is verified and judged based on the set of stable abstract states. The code-side abstract state transition relationship is constructed based on the twin behavior trajectory library. Differential consistency verification is performed to generate a set of consistency violation candidates. An abstract set of counterexample trajectories is generated based on the candidate set of rule violations and the candidate set of consistency violations. Consistency is determined, and when the conditions are met, the abstract analysis parameters are updated and the propagation is iterated again. The code verification results are then output.

[0021] In this embodiment, the steps of obtaining the target code, parsing the target code, generating a program structure representation, and dividing the target code into regions to generate a program region set specifically include: The target code is obtained, and lexical and syntactic analysis are performed on it. Identifiers, keywords, operators and statement structures in the target code are parsed according to the syntax rules of the programming language. Based on the parsing results, an abstract syntax tree is constructed to represent the hierarchical relationship of the syntactic structure of the target code. Based on the abstract syntax tree, the syntax structure of the target code is traversed and parsed. The function definitions, statement block structures and variable declaration information contained in the target code are identified and extracted from the abstract syntax tree to form a set of functions, a set of basic blocks and a set of variables to represent the components of the target code. Assign a unique function identifier to each function in the function set, and assign a unique basic block identifier to each basic block in the basic block set; Based on the set of basic blocks, the execution order and jump relationship between the basic blocks in the target code are analyzed. The control transfer relationship formed between adjacent basic blocks in the case of sequential execution, conditional branching, loop jump and abnormal jump is identified. Based on the control transfer relationship, a control flow graph is constructed to represent the program execution path. The nodes of the control flow graph correspond to each basic block in the set of basic blocks. The edges of the control flow graph are used to represent the control relationship of the transfer from one basic block to another after the execution of one basic block. A unique edge identifier is assigned to each control transfer edge in the control flow graph. Based on the function set, the calling relationship between functions in the target code is analyzed, the function call statements appearing inside the function body are identified, the correspondence between the caller function and the callee function is determined, and a calling relationship graph is constructed to represent the function call dependency relationship based on the correspondence. The nodes of the calling relationship graph correspond to each function in the function set, and the edges in the calling relationship graph are used to represent the calling relationship of one function calling another function during execution. A unique edge identifier is assigned to each calling edge in the calling relationship graph. The abstract syntax tree, control flow graph, and call relationship graph are integrated to form a program structure representation that fully describes the static structure and execution relationship of the target code. The abstract syntax tree is used to represent the syntax hierarchy of the target code, the control flow graph is used to represent the execution path relationship between the target code and each basic block, and the call relationship graph is used to represent the call dependency relationship between each function in the target code. By mapping the above three types of structural information, a unified program structure representation that can simultaneously reflect syntax structure, control flow relationships, and function call relationships is constructed. Based on the program structure representation, the static structure and execution relationship of the target code are analyzed. The basic blocks in the control flow graph are grouped according to the preset region division rules. Multiple basic blocks that are related in terms of control flow relationship, execution path or functional semantics are divided into the same program region, thereby generating a program region set composed of multiple program regions. Each program region consists of a set of basic blocks in the control flow graph, which represent code segments in the target code that have relatively independent analytical significance during execution; For each program region in the program region set, a structural index relationship is established to associate the program region with the program structure elements. For each program region, the corresponding abstract syntax structure range, control flow structure range, and function call association range are determined. Specifically, a structure index record is established for each program region. The structure index record is used to indicate the abstract syntax substructures contained in the program region, the corresponding region-level control flow relationship, and the function call relationship associated with the program region, thereby forming a structure index relationship table for unified management of the correspondence between program regions and abstract syntax trees, control flow graphs, and call relationship graphs.

[0022] In this embodiment, the construction of the code twin model, the aggregation processing of runtime evidence data to generate twin evidence vectors and evidence confidence weight sets, the writing of runtime evidence data into the code twin model, and the generation of a twin behavior trajectory library specifically include: Based on program structure representation and program region set, a code twin model corresponding one-to-one with the target code is constructed, and an independent twin representation space is established for the target code in the code twin model; Based on the program region division results in the program region set, a corresponding region twin node is created for each program region in the code twin model, so that each program region is associated with a unique region twin node, thus forming a one-to-one mapping structure between program regions and region twin nodes. The region twin node is used as the basic unit in the code twin model that carries state information, behavior information and counterexample information. In the code twin model, a twin structure mapping module is constructed. Based on the program structure representation, functions, basic blocks and variables in the target code are uniformly identified and processed. The control transfer relationship in the control flow graph and the function call relationship in the call relationship graph are identified and aligned. In this process, each function identifier in the function set, each basic block identifier in the basic block set, each variable identifier in the variable set, and the identifiers of control transfer relationships and function call relationships are mapped to the corresponding regional twin nodes in the regional twin node set, thereby generating a twin structure mapping table. The twin structure mapping table is used to record the correspondence between the structural elements of the target code and the regional twin nodes in the code twin model. In the code twin model, a twin state management module is built. For each regional twin node in the set of regional twin nodes, a corresponding twin state dictionary is established, thereby forming a set of twin state dictionaries. Each twin state dictionary is used to record the running state information related to the corresponding program region. The running state information includes at least variable state items, resource state items, and exception state items. The variable state items are used to record the current value of each variable in the program region and the range of change of the variable value. The resource state items are used to record the memory usage, number of threads, or number of handles involved in the program region during operation. The exception state items are used to record the exception type identifier that occurs in the program region during execution and the status flag of whether the exception has been triggered, thereby realizing the independent storage and management of the running state of each program region. The system collects runtime evidence data related to the target code's execution process from online logs. This runtime evidence data includes at least the recording time, execution thread identifier, currently executing function identifier, basic block identifier, corresponding control transfer relationship or function call relationship identifier, record information of variable value changes, and records of abnormal events. During the collection process, based on the twin structure mapping table, each piece of runtime evidence data undergoes structural alignment processing, associating it with a specific program region in the target code, and further mapping it to the corresponding region twin node in the code twin model. This achieves unified collection and structured storage of runtime evidence from online logs in the code twin model. The execution evidence data mapped to each program region is aggregated according to the program region set. The execution evidence data corresponding to each program region in the program region set is summarized separately. Based on the summary results, a twin evidence vector corresponding to the program region is generated. The twin evidence vector is used to comprehensively characterize the behavioral features of the program region during actual operation. The behavioral features include at least the hit statistics of each conditional branch being executed within the program region, the actual iteration count statistics of the loop structure, the value range statistics of variables during operation, the resource count change statistics generated during resource usage, and the trigger count statistics of abnormal events. For each type of statistical information in the twin evidence vector, a set of evidence confidence weights corresponding to it is generated. The set of evidence confidence weights is used to characterize the credibility of the corresponding operational evidence in terms of source reliability, time validity, data integrity and regional consistency. The set of evidence confidence weights is bound and stored with the corresponding twin evidence vector. In the code twin model, a twin behavior trajectory management module is built. Based on the runtime evidence data, the actual execution process of the target code is reconstructed in time sequence. According to the time order recorded in the runtime evidence, function call events, control transfer events between basic blocks, and exception triggering events are sorted and associated to generate a twin behavior trajectory library that reflects the real runtime behavior of the target code. The twin behavior trajectory library includes at least a function call sequence, a control transfer sequence, and an abnormal event sequence arranged in chronological order. According to the twin structure mapping table and the program region set, each behavior trajectory in the twin behavior trajectory library is stored in the region twin node associated with the corresponding program region, so that each program region can save the behavior trajectory information formed during its actual operation. A twin counterexample index module is constructed in the code twin model to establish a counterexample index structure for the written abstract counterexample trajectory. Counterexample index record items are pre-set for each program region in the code twin model to support the indexing and associated storage of abstract counterexample trajectories based on the program region set.

[0023] In this embodiment, the steps of obtaining the verification rule set, converting the verification rule set into a rule constraint set, and establishing the association between the rule constraint set and the program region set based on the program structure representation specifically include: Obtain a set of verification rules for verifying the target code. The set of verification rules includes multiple types of verification rules for program semantic correctness, execution path constraints, variable value constraints, resource usage constraints, and exception triggering constraints. A unique rule identifier is assigned to each verification rule in the set of verification rules. The verification rules in the verification rule set are processed by structured parsing. Each verification rule is broken down into the rule scope, rule judgment conditions and rule constraint results to form an intermediate rule representation. The rule judgment conditions are represented in a computable constraint form to describe the judgment conditions of whether the program state satisfies or violates the verification rules. Each verification rule in the intermediate representation of the rules is constrained to form a set of rule constraints. The constraint process includes: extracting the corresponding rule judgment condition from each verification rule, converting the rule judgment condition into a constraint expression form to describe whether the program running state satisfies or violates the verification rule, and standardizing the constraint expression form so that it can directly affect the variable values, state transition relationships or abnormal triggering states in the program state. Through constraint processing, a set of rule constraints is generated, consisting of multiple rule constraints. Each rule constraint in the set of rule constraints corresponds to a verification rule, which is used to determine the constraint conditions that the relevant program areas of the target code need to meet during execution. Based on the program structure representation, structural location analysis is performed on each rule constraint in the rule constraint set. The structural location analysis includes: determining the function scope, basic block scope, or control transfer scope corresponding to each rule constraint. Based on the statement hierarchy in the abstract syntax tree of the program structure representation, rule constraints are located at their corresponding syntax structure positions; based on the control transfer relationships between basic blocks in the control flow graph, rule constraints are located at their corresponding basic block nodes or control transfer edges; based on the function call relationships in the call relationship graph, rule constraints are located at their corresponding caller functions, callee functions, or cross-function call paths; through the above structural location analysis, a correspondence between rule constraints and program structure elements is generated to indicate the applicable position and scope of each rule constraint in the target code; Based on the correspondence between rule constraints and program structure elements, the rule constraint set and the program region set are associated. Specifically, for each rule constraint in the rule constraint set, the program region in which the rule constraint acts is determined by combining its corresponding function range, basic block range or control transfer range in the program structure representation, and the rule constraint is associated with the corresponding program region. By performing the above association processing on all rule constraints, a rule-region association table is generated to describe the correspondence between rule constraints and program regions. Each association record indicates that a certain rule constraint is associated with a certain program region.

[0024] In this embodiment, the step of generating abstract analysis parameters based on twin evidence vectors and evidence confidence weight sets, constructing abstract semantic mapping relationships based on abstract analysis parameters, and generating twin constraint sets specifically includes: For each program region in the program region set, read the twin evidence vector corresponding to the program region and the set of evidence confidence weights corresponding to the twin evidence vector; Based on the twin evidence vectors corresponding to the program region and the set of evidence confidence weights corresponding to the twin evidence vectors, the comprehensive evidence index of the program region is calculated. The comprehensive evidence index is obtained by weighted summation of each evidence component in the twin evidence vector and its corresponding evidence confidence weight. Specifically, the value of each evidence component in the twin evidence vector is multiplied by the evidence confidence weight corresponding to the evidence component, and the product of all evidence components is accumulated. The accumulated result is used as the comprehensive evidence index of the program area. The evidence component is used to represent the program region's operational statistics in terms of branch hits, loop iterations, variable value ranges, resource count changes, and anomaly triggers. The evidence confidence weight is used to represent the credibility of the corresponding evidence component in terms of log source reliability, time validity, data integrity, and regional consistency. The number of evidence components is the total number of evidence components contained in the twin evidence vector. Based on the comprehensive evidence index corresponding to the program area, corresponding abstract analysis parameters are generated for the program area, thereby forming a set of abstract analysis parameters; For each program region, the abstract analysis parameters include at least the abstract domain type, the iteration propagation termination threshold, and the iteration propagation round limit. The abstract domain type is used to limit the abstract state representation method adopted by the program region during the abstract analysis process. The iteration propagation termination threshold is used to limit the judgment condition for the abstract state to reach a stable state during the iteration propagation process. The iteration propagation round limit is used to limit the maximum number of iterations for the abstract state propagation process. In this way, different procedural regions can configure corresponding abstract analysis parameters based on their respective evidence synthesis indicators; Based on the abstract analysis parameters corresponding to the program region, an abstract semantic mapping relationship is constructed for the program region, thereby forming a set of abstract semantic mapping relationships. For each program region, the state representation structure and state update rules adopted by the program region in the abstract analysis process are determined according to the abstract domain type, iteration propagation termination threshold and iteration propagation round limit of the program region, and then an abstract semantic mapping relationship is constructed to describe the impact of program statement execution on the abstract state within the program region. The abstract semantic mapping relationship is used to convert the abstract state input of the program region into the corresponding abstract state output, and both the abstract state input and the abstract state output adopt the abstract state representation form consistent with the abstract domain type; Based on the twin evidence vectors corresponding to the program region and the set of evidence confidence weights corresponding to the twin evidence vectors, a corresponding set of twin constraints is generated for the program region, thereby forming the total set of twin constraints. For each program region, the twin constraint set is used to constrain and describe the behavioral characteristics formed by the program region during actual operation. The twin constraint set includes at least variable value range constraints, branch execution hit constraints, loop structure iteration number constraints, resource usage count constraints, and abnormal event triggering constraints. When generating the twin constraint set, the operational statistics reflected by each evidence component in the twin evidence vector are combined with the corresponding evidence confidence weights to form constraint items that correspond one-to-one with the program region. The constraint items are then bound and stored with the evidence confidence weights, so that each constraint item is associated with its corresponding credibility information.

[0025] In this embodiment, the step of using abstract semantic mapping relationships as state propagation rules, performing iterative propagation processing of abstract states, and introducing a set of twin constraints to generate a stable set of abstract states specifically includes: For each program region in the program region set, read the abstract analysis parameters, abstract semantic mapping relationships, and twin constraint set corresponding to the program region; The abstract analysis parameters include at least the abstract domain type for limiting the representation of the abstract state of the program region, the iteration propagation termination threshold for determining the termination condition of the abstract state iteration propagation, and the upper limit of the iteration propagation rounds for limiting the maximum number of iteration propagations of the abstract state. The abstract semantic mapping relationship serves as the abstract state propagation rule of the program region. The twin constraint set is used to limit the running behavior constraints that the program region needs to satisfy during the abstract state propagation process. The abstract analysis parameters, the abstract semantic mapping relationship, and the twin constraint set serve as the input data for the program region to perform the abstract state iteration propagation process. For each program region in the program region set, the abstract state of the program region is initialized according to the abstract analysis parameters corresponding to the program region, generating an initial abstract state that corresponds one-to-one with each program region, thus forming an initial abstract state set; wherein, each initial abstract state is used to represent the state value of the corresponding program region at the beginning of the abstract analysis, and the initial abstract states are all constructed according to the abstract state representation form defined by the abstract domain type corresponding to the program region. Based on the abstract semantic mapping relationship corresponding to the program region, the initial abstract state set is subjected to abstract state propagation processing. Specifically, in the current iteration round, the abstract state of each program region in the previous round is taken as input, the abstract semantic mapping relationship corresponding to the program region is introduced, and the state update operation is performed on the input abstract state to generate the propagation result abstract state of the program region in the next iteration round. By performing the above state update processing on each program region in the program region set, the propagation intermediate state set corresponding to the current iteration round is formed. Each propagation result abstract state in the set of intermediate propagation states is used to represent the state result of the corresponding program region after completing an abstract state propagation based on the abstract semantic mapping relationship; During the current round of abstract state propagation, a set of twin constraints corresponding to the program region is introduced. Constraint fusion processing is performed on the set of intermediate propagation states obtained from the previous round of abstract state propagation. Specifically, for each program region, the intermediate abstract state corresponding to the program region is fused with the set of twin constraints corresponding to the program region, so that the intermediate abstract state simultaneously satisfies the state update result generated by the abstract semantic mapping relationship and the running behavior constraints limited in the set of twin constraints, thereby generating the constraint fusion abstract state of the program region in the current round. By performing the above constraint fusion processing on each program region in the set of program regions, a set of constraint fusion states corresponding to the current round is formed. Each constraint fusion abstract state is used to represent the abstract state result of the corresponding program region under the combined action of the abstract semantic propagation rules and the twin running constraints. For each program region in the program region set, the constraint fusion abstract state obtained by the program region in the current round is compared and analyzed with the abstract state in the previous round to determine whether the termination condition of the abstract state iteration propagation is met. The termination conditions include at least whether the number of iteration propagation rounds has reached the upper limit of the number of iteration propagation rounds corresponding to the program region, and whether the degree of change between two adjacent abstract states is less than or equal to the iteration propagation termination threshold corresponding to the program region. When any termination condition is met, the iteration propagation process of the abstract state is stopped for the corresponding program region. When none of the termination conditions are met, the abstract state of the program region is updated and the next round of abstract state propagation process is entered. When the termination determination of the abstract state iterative propagation meets the preset termination condition, the abstract state corresponding to each program region in the program region set at the termination time is obtained, and the termination abstract states of each program region are uniformly collected and processed to form a stable abstract state set. The stable abstract state set is used to centrally represent the final abstract state result of each program region after completing the abstract state iterative propagation. Each terminating abstract state corresponds to a program region and is used to reflect the state value of the program region after the abstract analysis converges.

[0026] In this embodiment, the step of verifying and judging the rule constraint set based on the stable abstract state set, constructing the code-side abstract state transition relationship based on the twin behavior trajectory library, performing differential consistency verification, and generating a consistency violation candidate set specifically includes: Read the set of stable abstract states formed by each program region after completing the iterative propagation of the abstract state, and obtain the program region identifier corresponding to each stable abstract state; Read the set of rule constraints used to verify the target code and the rule-region association table, and determine the target program region associated with each rule constraint from the rule-region association table; Based on the rule-region association table, determine the target program region associated with each rule constraint, and obtain the stable abstract state corresponding to the target program region; Using a stable abstract state as the verification input, constraint satisfaction is determined for each rule constraint associated with the target program region. When the stable abstract state does not meet the conditions defined by the corresponding rule constraint, a rule violation candidate record is generated. By performing the above judgment process on all rule constraints, a rule violation candidate set is formed. Each rule violation candidate record includes at least the corresponding rule constraint identifier, the program region identifier being judged, and the variable identifier associated with the rule constraint, which are used to characterize the program region and its associated elements in the target code that may violate the verification rules. Read the twin behavior trajectory library stored in the code twin model, traverse and analyze the actual execution process of the target code recorded in the twin behavior trajectory library, and extract the control transfer record sequence and function call record sequence arranged in chronological order from the twin behavior trajectory library respectively; Based on the sequential execution relationship between two adjacent execution records in the control transfer record sequence and function call record sequence, the state transition relationship formed between the completion of one execution and the start of the next execution is identified, and the state transition relationships are summarized to generate a set of twin transfer edges. Each twin transfer edge is used to represent the execution transfer relationship of the target code from a source basic block, source function or source program region to a target basic block, target function or target program region during the actual execution process, and a unique edge identifier is assigned to each twin transfer edge in the set of twin transfer edges. For each twin transition edge in the twin transition edge set, a twin transition constraint set corresponding to each twin transition edge is generated based on the operational evidence data corresponding to the twin transition edge and the evidence confidence weight set corresponding to the operational evidence data. The twin transition constraint set is used to limit the constraints in the state change process generated by the target code through the transition edge during the operation. The twin transition constraint set includes at least the transition trigger condition constraint, variable increment constraint, resource count change constraint, and anomaly trigger condition constraint. Specifically, the transition trigger condition constraint is used to limit the triggering conditions for state transition, the variable increment constraint is used to limit the range of variable values ​​during state transition, the resource count change constraint is used to limit the changes in resource usage during transition, and the anomaly trigger condition constraint is used to limit whether an anomaly will be triggered during transition. By generating a corresponding twin transition constraint set for each twin transition edge, the twin transition constraint set is bound and stored with the runtime evidence data and evidence confidence weight set of the target code; Based on program structure representation, the static control structure and function call structure of the target code are analyzed. According to the control transfer relationship and function call relationship defined in the control flow graph and call relationship graph, a code-side abstract state transfer relationship is constructed to represent the abstract state change path of the target code. The abstract state transition relationship on the code side is used to describe the relationship in which the abstract state of the program region changes from a source abstract state to the corresponding target abstract state when the control flow or call relationship changes during program execution. The program region is used as the basic unit of state transition, and the control transition edge and call edge defined in the program structure representation are mapped to the abstract state transition relationship between program regions. Based on the set of twin transition edges and the corresponding set of twin transition constraints, a twin-side abstract state transition relationship is constructed to characterize the actual running behavior of the target code. Specifically, the program region is used as the basic unit of abstract state transition. According to the execution transition relationships recorded in the set of twin transition edges, the correspondence between the source program region and the target program region formed during actual operation is determined. On this basis, twin transition constraints corresponding to each execution transition relationship are introduced to limit the variable change conditions, resource count change conditions, and exception triggering conditions that the abstract state of the program region needs to satisfy during the transition process. By combining the execution transition relationship with the twin transition constraints, a twin-side abstract state transition relationship is generated, which can be used to describe the transition process of the abstract state of the program region from the source abstract state to the target abstract state under the action of real running constraints. Differential consistency verification is performed on the abstract state transition relationships on the code side and the abstract state transition relationships on the twin side. Specifically, for the state transition relationships between the same source program region and the same target program region, the range of the corresponding abstract state transition results in the abstract state transition relationship on the code side and the range of abstract state transition results formed under the twin transition constraints in the abstract state transition relationship on the twin side are obtained respectively. The above two types of abstract state transition result ranges are compared and analyzed. When there is an inconsistency between the range of abstract state transition results on the code side and the range of abstract state transition results on the twin side, a consistency violation candidate record is generated. By performing the above differential consistency verification processing on the state transition relationships of all relevant program regions, a consistency violation candidate set is formed. Each consistency violation candidate record includes at least the source program region identifier, the target program region identifier, the corresponding twin transition edge identifier, and the twin transition constraint identifier associated with the twin transition edge, which is used to characterize the possible inconsistencies between the static abstract state transitions of the target code and the actual running behavior.

[0027] In this embodiment, the step of generating an abstract negative example trajectory set based on the rule violation candidate set and the consistency violation candidate set, performing consistency determination, updating the abstract analysis parameters and re-iteratio propagation when the conditions are met, and outputting the code verification result specifically includes: Based on the candidate sets of rule violations and consistency violations, the starting point for generating counterexamples corresponding to each candidate violation is determined. Starting from the starting point of counterexample generation, the abstract state transition path of the program region in the target code is backtracked or expanded along the abstract state transition relationship on the code side to generate at least one program region-level abstract state transition path corresponding to the candidate violation. The program region identifiers and their corresponding abstract states arranged in the execution order in the program region-level abstract state transition path are combined to form an abstract counterexample trajectory. All generated abstract counterexample trajectories are collected to form an abstract counterexample trajectory set, which is used to characterize the abstract execution paths in the target code that may lead to rule violations or consistency violations. For each abstract counterexample trajectory in the set of abstract counterexample trajectories, the consistency degree is calculated to obtain the set of counterexample consistency degrees. Based on the set of counterexample consistency, a preset condition is applied to the counterexample consistency corresponding to each abstract counterexample trajectory. The preset condition includes at least whether the counterexample consistency is lower than or higher than a preset consistency threshold. When the counterexample consistency corresponding to any abstract counterexample trajectory meets the preset condition, the program region covered by the abstract counterexample trajectory is determined, and the abstract analysis parameters corresponding to the program region are updated. After the abstract analysis parameters are updated, the iterative propagation process of the abstract state is re-executed based on the updated abstract analysis parameters to generate an updated set of stable abstract states. Write the set of abstract counterexample trajectories and the set of counterexample consistency into the code twin model, establish the correspondence between the abstract counterexample trajectories and the counterexample consistency in the code twin model, and generate a twin counterexample index table; based on the twin counterexample index table and the updated set of stable abstract states, re-execute the judgment processing on the set of rule constraints and the differential consistency verification process; when the preset termination condition is met, end the iteration and output the final code verification result. The preset termination conditions include: the set of abstract counterexample trajectories no longer changes within a consecutive preset number of rounds; the change in the set of counterexample consistency within a consecutive preset number of rounds is less than a preset threshold; the updated abstract analysis parameters remain unchanged within a consecutive preset number of rounds; no new rule violation candidate records or consistency violation candidate records are generated; and the execution rounds of the abstract state iterative propagation reach the preset maximum number of iterations.

[0028] The consistency calculation includes, for each abstract counterexample trajectory, identifying all program regions covered by the abstract counterexample trajectory, and reading the twin evidence vectors and evidence confidence weight sets corresponding to each program region; for each covered program region, calculating the operational consistency of the program region in the abstract counterexample trajectory based on the values ​​of each evidence component in its twin evidence vector and in combination with the corresponding evidence confidence weights, to obtain the region consistency component corresponding to the program region; after obtaining the region consistency components of each program region covered by the abstract counterexample trajectory, summarizing the region consistency components to generate the counterexample consistency degree corresponding to the abstract counterexample trajectory; by performing the above consistency calculation and summarization process on all abstract counterexample trajectories, a counterexample consistency degree set is formed, which is used to characterize the degree of consistency between each abstract counterexample trajectory and the actual operational evidence.

[0029] refer to Figure 4 A code verification system based on twin modeling includes the following modules: The code structure parsing module is used to parse the target code and generate a program structure representation, perform region division, and obtain a set of program regions. The twin model construction module is used to build code twin models based on program structure representation and region set, and generate twin structure mapping table and twin state dictionary; The rule constraint generation module is used to convert the validation rule set into a rule constraint set and establish the association between the rule constraints and the program area; The abstract analysis module is used to generate abstract analysis parameters based on twin evidence vectors and evidence confidence weights, and to construct abstract semantic mapping relationships and twin constraint sets. The state propagation module is used to perform iterative propagation of abstract states in the program region based on abstract semantic mapping relationships, and introduces twin constraints to generate a stable set of abstract states; The verification and consistency module is used to perform rule verification based on a stable abstract state set, and generate a set of candidate rule violations and a set of twin transition edges; The counterexample generation module is used to generate an abstract set of counterexample trajectories based on rule violations and consistency violations, and to generate a set of counterexample consistency based on consistency determination, and output the code verification results.

[0030] Example 1: To verify the feasibility of this invention in practice, it was applied to the code quality inspection of a large software system. This software system involves complex user data processing and multi-module interaction, with a large program structure and frequent updates. Traditional code verification methods rely solely on static analysis or runtime logs, which are prone to false positives or false negatives, and cannot accurately verify complex control structures and cross-module execution paths. The code verification method based on twin modeling of this invention combines the static structure of the program with its actual runtime behavior, using a twin model to provide more accurate verification results.

[0031] In the testing environment of this software system, we first acquired the target code and performed structural analysis, generating a program structure representation and control flow graph. Then, we partitioned the target code into regions, obtaining a set of program regions. Next, by constructing a code twin model, we collected the system's runtime logs and aggregated this runtime evidence data to generate twin evidence vectors and a set of evidence confidence weights. Then, based on the program structure representation and the set of program regions, we generated a corresponding set of rule constraints and performed detailed verification of the program regions using this set of rule constraints.

[0032] Next, based on the twin evidence vectors and the set of evidence confidence weights, we generated abstract analysis parameters for each program region, thereby constructing an abstract semantic mapping relationship and generating a corresponding set of twin constraints. Building upon this, we used the abstract semantic mapping relationship as the state propagation rule to perform iterative propagation processing of the abstract states, and introduced the twin constraint set, ultimately generating a stable set of abstract states.

[0033] After validating the set of rule constraints, we constructed an abstract state transition relationship on the code side using a twin behavior trajectory library. We then compared this relationship with the twin's abstract state transition relationship, performed differential consistency checks, and generated a candidate set of consistency violations. Finally, based on the candidate set of rule violations and the candidate set of consistency violations, we generated an abstract counterexample trajectory set. After consistency determination, we updated the abstract analysis parameters and re-executed the iterative propagation of the abstract state, ultimately outputting accurate code validation results.

[0034] To further verify the effectiveness of this invention, we compared the performance of traditional code verification methods and verification methods based on Siamese modeling in practical applications. Experimental results show that this invention can effectively reduce false positive and false negative rates, especially in the verification of complex modules and execution paths, demonstrating significant advantages.

[0035] Table 1. Comparison of the effectiveness of code verification methods based on twin modeling in practical applications.

[0036] As can be seen from the table above, the code verification method based on twin modeling proposed in this invention shows significant improvements over traditional code verification methods in several key performance indicators. Firstly, regarding verification accuracy, the verification accuracy of traditional static analysis methods and traditional dynamic analysis methods is 75% and 78%, respectively, while the verification accuracy of this invention reaches 92%, an overall improvement of over 14 percentage points. This result indicates that by jointly modeling the code twin model constructed from program structure analysis results and runtime evidence, and introducing twin constraints and counterexample feedback mechanisms during the abstract state propagation process, the misjudgment problem caused by overly conservative assumptions in static analysis can be effectively reduced, making the verification results closer to the actual running state.

[0037] Secondly, this invention also demonstrates significant advantages in the two key indicators of false positive rate and false negative rate. Traditional static analysis methods have false positive and false negative rates of 15% and 20%, respectively, while traditional dynamic analysis methods have false positive rates of 10% and false negative rates of 25%. In contrast, this invention reduces the false positive rate to 5% and the false negative rate to 10%. This result shows that by generating abstract analysis parameters based on twin evidence vectors and evidence confidence weight sets, and by performing consistency judgment and iterative correction on the abstract counterexample trajectories during the verification process, verification bias caused by static structural uncertainties or insufficient dynamic test coverage can be effectively suppressed, thereby reducing false positives while maintaining the ability to detect potential problems.

[0038] In terms of verification efficiency, this invention also demonstrates superior performance. With a consistent test code size, the verification times for traditional static and dynamic analysis methods are 45 minutes and 50 minutes, respectively, while the verification time for this invention is reduced to 30 minutes, resulting in a significant overall efficiency improvement. This result indicates that this invention, through program-region-level abstract state propagation and rule constraint association mechanisms, avoids indiscriminate analysis across the entire code scope, allowing the verification process to focus more on program regions related to rule constraints and runtime evidence, thereby improving overall processing efficiency while maintaining analysis depth.

[0039] Furthermore, in terms of the number of program regions processed, this invention can cover 220 program regions, higher than the 200 regions covered by traditional static analysis methods and the 180 regions covered by traditional dynamic analysis methods. This indicates that by combining static structure and runtime behavior, this invention has stronger coverage capabilities for program logic across regions and paths, making it particularly suitable for software systems with complex structures and frequent module interactions. In summary, the code verification method based on twin modeling demonstrates stable and quantifiable improvements in accuracy, reliability, and efficiency, effectively enhancing the overall quality of code verification for complex software systems.

[0040] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A code verification method based on twin modeling, characterized in that, Includes the following steps: The target code is obtained, parsed, and processed to generate a program structure representation. The target code is then divided into regions to generate a set of program regions. Construct a code twin model, aggregate the runtime evidence data, generate twin evidence vectors and evidence confidence weight sets, write the runtime evidence data into the code twin model, and generate a twin behavior trajectory library; Obtain the validation rule set, convert the validation rule set into a rule constraint set, and establish the association between the rule constraint set and the program region set based on the program structure representation; Based on the twin evidence vector and the evidence confidence weight set, abstract analysis parameters are generated, and an abstract semantic mapping relationship is constructed based on the abstract analysis parameters to generate a twin constraint set; Using abstract semantic mapping relationships as state propagation rules, iterative propagation processing of abstract states is performed, and a set of twin constraints is introduced to generate a set of stable abstract states; The set of rules and constraints is verified and judged based on the set of stable abstract states. The code-side abstract state transition relationship is constructed based on the twin behavior trajectory library. Differential consistency verification is performed to generate a set of consistency violation candidates. An abstract set of counterexample trajectories is generated based on the candidate set of rule violations and the candidate set of consistency violations. Consistency is determined, and when the conditions are met, the abstract analysis parameters are updated and the propagation is iterated again. The code verification results are then output.

2. The code verification method based on twin modeling according to claim 1, characterized in that, The steps of obtaining the target code, parsing and processing the target code to generate a program structure representation, and dividing the target code into regions to generate a set of program regions specifically include: Obtain the target code, perform lexical and syntactic analysis on the target code, and construct an abstract syntax tree; Based on the abstract syntax tree, the syntax structure of the target code is traversed and parsed to form a set of functions, a set of basic blocks, and a set of variables; Based on the set of basic blocks, the execution order and jump relationship between the basic blocks in the target code are analyzed, and a control flow graph is constructed. Based on the function set, the call relationships between functions in the target code are analyzed, and a call relationship graph is constructed; The abstract syntax tree, control flow graph, and call relationship graph are integrated into a unified representation of the program structure; Based on the program structure representation, the static structure and execution relationship of the target code are analyzed to generate a set of program regions.

3. The code verification method based on twin modeling according to claim 1, characterized in that, The construction of the code twin model, which involves aggregating runtime evidence data to generate twin evidence vectors and evidence confidence weight sets, writing runtime evidence data into the code twin model, and generating a twin behavior trajectory library, specifically includes: Based on program structure representation and program region set, a code twin model is constructed, and an independent twin representation space is established for the target code in the code twin model; Based on the program region division results in the program region set, a corresponding region twin node is created for each program region in the code twin model; In the code twin model, a twin structure mapping module is constructed to generate a twin structure mapping table based on the program structure representation; In the code twin model, a twin state management module is built, and a corresponding twin state dictionary is established for each regional twin node in the regional twin node set, forming a set of twin state dictionaries; Runtime evidence data is collected from online logs. Based on the twin structure mapping table, each piece of runtime evidence data is structurally aligned and associated with a specific program region in the target code, and further mapped to the region twin node. The execution evidence data mapped to each program region is aggregated according to the program region set to generate evidence vectors. For various statistical information in the twin evidence vectors, a set of evidence confidence weights is generated. A twin behavior trajectory management module is built in the code twin model. Based on the runtime evidence data, the actual execution process of the target code is reconstructed in time sequence to generate a twin behavior trajectory library.

4. The code verification method based on twin modeling according to claim 1, characterized in that, The process of obtaining the verification rule set, converting the verification rule set into a rule constraint set, and establishing the association between the rule constraint set and the program region set based on the program structure representation specifically includes: Obtain the set of verification rules and assign a unique rule identifier to each verification rule in the set; The validation rules in the validation rule set are subjected to structured parsing to form an intermediate representation of the rules; Each validation rule in the intermediate rule representation is constrained to form a rule constraint set; Based on the program structure representation, structural positioning analysis is performed on each rule constraint in the rule constraint set to generate the correspondence between the rule constraints and program structure elements; Based on the correspondence between rule constraints and program structure elements, the rule constraint set and program region set are associated to generate a rule-region association table.

5. The code verification method based on twin modeling according to claim 1, characterized in that, The process of generating abstract analysis parameters based on twin evidence vectors and evidence confidence weight sets, constructing abstract semantic mapping relationships based on these parameters, and generating twin constraint sets specifically includes: Based on the twin evidence vectors corresponding to the program region and the set of evidence confidence weights corresponding to the twin evidence vectors, the comprehensive evidence index of the program region is calculated. Based on the comprehensive evidence index corresponding to the program area, corresponding abstract analysis parameters are generated for the program area, forming a set of abstract analysis parameters. Based on the abstract analysis parameters corresponding to the program regions, construct corresponding abstract semantic mapping relationships for the program regions, forming a set of abstract semantic mapping relationships; Based on the set of abstract semantic mapping relationships, twin evidence vectors, and the set of evidence confidence weights, a corresponding set of twin constraints is generated for the program region.

6. The code verification method based on twin modeling according to claim 1, characterized in that, The process of using abstract semantic mapping relationships as state propagation rules, performing iterative propagation of abstract states, and introducing a set of twin constraints to generate a stable set of abstract states specifically includes: For each program region in the program region set, the abstract state of the program region is initialized according to the abstract analysis parameters corresponding to the program region, generating an initial abstract state and forming an initial abstract state set. Based on the abstract semantic mapping relationship corresponding to the program region, perform abstract state propagation processing on the initial abstract state set to form a propagation intermediate state set; During the current round of abstract state propagation, a set of twin constraints corresponding to the program region is introduced. Constraint fusion processing is performed on the set of intermediate propagation states obtained from the previous round of abstract state propagation to generate the constraint fusion abstract state of the program region in the current round, forming a set of constraint fusion states. For each program region in the program region set, a termination determination is made by comparing the constraint fusion abstract state obtained by the program region in the current round with the abstract state in the previous round. When the termination condition of the abstract state iterative propagation is met, the abstract state corresponding to each program region in the program region set at the termination time is obtained to form a stable abstract state set.

7. The code verification method based on twin modeling according to claim 1, characterized in that, The process of verifying and judging the rule constraint set based on the stable abstract state set, constructing the code-side abstract state transition relationship based on the twin behavior trajectory library, performing differential consistency verification, and generating a consistency violation candidate set specifically includes: Read the set of stable abstract states for each program region and obtain the program region identifier corresponding to each stable abstract state; Read the rule constraint set and the rule-region association table. Based on the rule-region association table, determine the target program region associated with each rule constraint and obtain the stable abstract state. Using a stable abstract state as the verification input, constraint satisfaction is determined for each rule constraint associated with the target program region, forming a set of rule violation candidates. Read the twin behavior trajectory library stored in the code twin model, traverse and analyze the actual running process of the target code recorded in the twin behavior trajectory library, and generate a set of twin transition edges; For each twin transition edge in the twin transition edge set, a twin transition constraint set is generated based on the running evidence data and the evidence confidence weight set; Based on program structure representation, the static control structure and function call structure of the target code are analyzed to construct the abstract state transition relationship on the code side; Based on the set of twin transition edges and the set of twin transition constraints, an abstract state transition relationship is constructed on the twin side; Perform differential consistency checks on the abstract state transition relationships on the code side and the abstract state transition relationships on the twin side to form a candidate set of consistency violations.

8. The code verification method based on twin modeling according to claim 1, characterized in that, The process of generating an abstract negative example trajectory set based on the rule violation candidate set and the consistency violation candidate set, performing consistency determination, updating the abstract analysis parameters and re-iterating the propagation when the conditions are met, and outputting the code verification results specifically includes: Based on the candidate set of rule violations and the candidate set of consistency violations, backtracking or expansion processing is performed to generate a program region-level abstract state transition path. The program region identifiers and their corresponding abstract states arranged in execution order in the program region-level abstract state transition path are combined to form an abstract counterexample trajectory, which is then collected to form an abstract counterexample trajectory set. For each abstract counterexample trajectory in the set of abstract counterexample trajectories, the consistency degree is calculated to obtain the set of counterexample consistency degrees. Based on the set of counterexample consistency, the counterexample consistency corresponding to each abstract counterexample trajectory is judged according to preset conditions. When the preset conditions are met, the abstract analysis parameters corresponding to the program area are updated. Based on the updated abstract analysis parameters, the iterative propagation process of the abstract state is re-executed to generate an updated set of stable abstract states; Write the set of abstract counterexample trajectories and the set of counterexample consistency into the code twin model, establish the correspondence between the abstract counterexample trajectories and the counterexample consistency in the code twin model, and generate a twin counterexample index table; Based on the twin counterexample index table and the updated stable abstract state set, the decision processing of the rule constraint set and differential consistency verification process is re-executed. When the preset termination condition is met, the iteration ends and the code verification result is output.

9. A code verification system based on twin modeling according to claim 1, characterized in that, A code verification method based on twin modeling, as described in any one of claims 1 to 8, is characterized by comprising the following modules: The code structure parsing module is used to parse the target code and generate a program structure representation, perform region division, and obtain a set of program regions. The twin model construction module is used to build code twin models based on program structure representation and region set, and generate twin structure mapping table and twin state dictionary; The rule constraint generation module is used to convert the validation rule set into a rule constraint set and establish the association between the rule constraints and the program area; The abstract analysis module is used to generate abstract analysis parameters based on twin evidence vectors and evidence confidence weights, and to construct abstract semantic mapping relationships and twin constraint sets. The state propagation module is used to perform iterative propagation of abstract states in the program region based on abstract semantic mapping relationships, and introduces twin constraints to generate a stable set of abstract states; The verification and consistency module is used to perform rule verification based on a stable abstract state set, and generate a set of candidate rule violations and a set of twin transition edges; The counterexample generation module is used to generate an abstract set of counterexample trajectories based on rule violations and consistency violations, and to generate a set of counterexample consistency based on consistency determination, and output the code verification results.

Images