A code defect detection method and system

Abstract

This invention discloses a code defect detection method and system, belonging to the field of static software code quality detection technology. The method includes: creating a code analysis task record including the path of the code under test based on a user-initiated code analysis task request; constructing a merged list of suspected code defects, a deduplicated list of suspected code defects, and a list of suspected code defects with enhanced confidence; finally, retrieving the context information of each suspected code defect in the list of suspected code defects with enhanced confidence through a pre-constructed code semantic index library; obtaining an enhanced code defect list based on the suspected code defects and their context information; and generating business impact analysis and remediation suggestions based on the enhanced code defect list. This invention can improve the accuracy of code defect detection.

Description

Technical Field

[0001] This invention relates to the field of static software code quality testing technology, and in particular to a method and system for detecting code defects. Background Technology

[0002] As software systems continue to expand in scale and become increasingly complex in architecture, code defect detection has become a crucial aspect of ensuring software quality and security. However, current mainstream static code defect detection technologies (such as Semgrep, a pattern-matching-based static code analysis tool; Cppcheck, a data flow analysis-based static code analysis tool; KLEE, a symbolic execution-based static code analysis tool; and commercial comprehensive detection platforms such as SonarQube, Coverity, and Fortify) still have many shortcomings and cannot meet the actual needs of high reliability and high security scenarios. These shortcomings are specifically reflected in the following aspects: Limited capabilities of a single engine: Existing code inspection tools typically rely on a single static analysis engine (such as using only Semgrep or Cppcheck). Their code defect detection capabilities are limited by the rule coverage and analysis depth of the engine, which can easily lead to missed code defects and make it difficult to fully identify various defects.

[0003] Lack of effective multi-engine fusion mechanism: Although some static code detection tools integrate multiple analysis engines, they only simply merge the code defect detection results without introducing intelligent deduplication, confidence assessment or cross-validation mechanisms, resulting in frequent duplicate alarms and redundant reports, which affects the efficiency of problem localization.

[0004] High false alarm rate: The false alarm rate of traditional static analysis tools is generally in the range of 30%-50%. A large number of invalid alarms need to be manually identified, which significantly increases the verification burden of development and testing teams and reduces the overall code defect detection efficiency.

[0005] Reliance on external network connections: Existing intelligent detection solutions mostly rely on cloud-based artificial intelligence services for defect analysis or repair suggestion generation, which cannot be deployed in environments where external connections are prohibited, such as enterprise intranets and classified information systems. This makes it difficult to meet the strict requirements of government, power, military and other fields for data localization and privacy protection.

[0006] Insufficient scanning performance: The lack of an efficient code pre-filtering mechanism means that irrelevant directories (such as dependency libraries, build artifacts, cache files, etc.) in large projects are still fully scanned, which significantly prolongs the analysis time and hinders its efficient application in continuous integration processes.

[0007] The caching mechanism is crude: A few static code analysis tools that support caching only reuse results based on literal rule matching or file hashing. This makes it difficult to handle defects that are semantically similar but different in form, which can easily lead to cache conflicts or incorrect reuse and reduce analysis consistency.

[0008] Weak context awareness: Existing static code analysis tools are mostly limited to isolated analysis of local code snippets, failing to combine contextual information such as function signatures, class structure, call chains, and data flow, resulting in low accuracy in judging the authenticity of defects. Summary of the Invention

[0009] The purpose of this invention is to provide a code defect detection method and system. In a completely offline environment, through multi-engine intelligent fusion, weighted similarity deduplication, cross-validation and confidence enhancement, and context-aware analysis using a localized artificial intelligence model, it achieves high-precision, low-false-report static code defect detection, effectively improving detection accuracy and analysis efficiency, and meeting the requirements of data localization and privacy protection in high-security scenarios such as government, power, and military industries. This invention is achieved through the following technical solutions.

[0010] In a first aspect, the present invention provides a code defect detection method, comprising: A code analysis task record is created based on a user-initiated code analysis task request; wherein, the code analysis task record includes the path of the code under test; Obtain valid source code files based on the path of the code under test, and build a code semantic index library based on the valid source code files; By using a thread pool to call multiple static analysis engines in parallel to scan valid source code files, several suspected code defects were identified. Calculate the multi-feature similarity between each pair of suspected code defects, and then deduplicate the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; Cross-validate the suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the suspected defects with enhanced confidence. The contextual information of suspected code defects with enhanced confidence is retrieved based on the code semantic index library, and the enhanced code defects are obtained based on the suspected code defects with enhanced confidence and their contextual information.

[0011] Optionally, obtaining valid source code files based on the path of the code under test includes: traversing the path of the code under test to obtain source files, and excluding source files corresponding to irrelevant directories from the source files according to predefined filtering rules to obtain valid source code files; wherein, irrelevant directories include virtual environment directories, dependency management directories, build output directories, cache directories, and version control directories.

[0012] Optionally, building a code semantic index library based on valid source code files includes: calling an Abstract Syntax Tree (AST) parser to parse valid source code files, generating corresponding ASTs, extracting function signatures, class definitions, and call relationship data from the ASTs, and building a code semantic index library.

[0013] Optionally, each suspected code defect includes the suspected defect type, location, severity, credibility of each static analysis engine, file path similarity, line number proximity, defect type identifier similarity, code snippet semantic similarity, and associated code snippets.

[0014] Optionally, the process of deduplicating suspected code defects based on multi-feature similarity to obtain deduplicated suspected code defects includes: identifying suspected code defects with multi-feature similarity greater than or equal to the multi-feature similarity threshold as duplicate suspected code defects and deleting one of the suspected code defects to obtain deduplicated suspected code defects.

[0015] Optionally, if a suspected defect in the deduplicated code is detected by two or more different static analysis engines, the confidence level of the suspected defect is set to high. If it is detected by only one engine, and the engine's historical confidence level in similar projects is higher than the preset confidence threshold, the confidence level is set to medium. If it is detected by only one engine, and the engine's historical confidence level in similar projects is lower than or equal to the preset confidence threshold, or if the type of the suspected defect belongs to a predefined high-false-report type, the confidence level is set to low.

[0016] Optionally, obtaining the enhanced code defect based on each confidence-enhanced suspected code defect and its context information includes: retrieving the context information of each suspected code defect in the confidence-enhanced suspected code defect based on the code semantic index library, inputting the suspected code defect and its context information into an existing artificial intelligence model for analysis, obtaining the threat score of the defect and the authenticity judgment result of the defect, and obtaining the enhanced defect based on the threat score of the defect and the authenticity judgment result of the defect. The context information includes function-level context information, class-level context information, call relationship context information, and file-level context information. The function-level context information includes the function signature, function parameter list, return type, and complete function body. The class-level context information includes the class name, inheritance relationship, and member variables. The call relationship context information includes a list of callers and callees. The file-level context information includes import statements and global variables.

[0017] Optionally, multi-feature similarity can be calculated using the following formula: Multi-feature similarity = file path similarity × W1 + line number proximity × W2 + defect type identifier similarity × W3 + code snippet semantic similarity × W4; In the formula, W1 is the weight of normalized file path similarity, with a value of 30% to 50%; W2 is the weight of line number proximity, with a value of 15% to 25%; W3 is the weight of defect type identifier similarity, with a value of 15% to 25%; W4 is the weight of code snippet semantic similarity, with a value of 15% to 25%; and W1+W2+W3+W4=1.

[0018] Optionally, the calculation of file path similarity includes: normalizing the path separator and case for each pair of suspected code defects to obtain two normalized file paths. When the two normalized file paths are exactly the same, the file path similarity is 1; otherwise, it is 0. The calculation of line number proximity includes: calculating the absolute difference between the line numbers of every two suspected code defects. When the absolute difference |ΔL| is less than or equal to 5, the line number proximity is 1. When the absolute difference |ΔL| is greater than 5, the line number proximity is max(0, 1-(ΔL-5) / 50), where 50 is the maximum tolerance number of lines. The calculation of defect type identifier similarity includes: comparing the defect type identifiers of every two suspected code defects. The defect type identifier is the rule ID or error type code defined by each static analysis engine. When two suspected defect type identifiers are exactly the same, the defect type identifier similarity is 1, otherwise it is 0. The calculation of semantic similarity of code snippets includes: standardizing each pair of code snippets containing suspected code defects, removing spaces and comments to obtain two standardized code snippets, calculating the edit distance between the two standardized code snippets, and calculating the semantic similarity of the code snippets based on the edit distance using the following formula: The semantic similarity of code snippets = 1 − (edit distance / maximum length). In the formula, the maximum length is the maximum length among the two code segments after standardization of suspected defects.

[0019] In this invention, the level of defect confidence indicates the degree of credibility of the defect's authenticity.

[0020] Secondly, the invention provides a code defect detection system, comprising: A code analysis task record building module is used to create code analysis task records based on user-initiated code analysis task requests; wherein, the code analysis task record includes the path of the code under test; The code semantic index building module is used to obtain valid source code files based on the path of the code under test, and to build a code semantic index library based on the valid source code files. The multi-engine parallel scanning module is used to scan valid source code files by calling multiple static analysis engines in parallel through a thread pool, and to obtain multiple suspected code defects. The intelligent deduplication module is used to calculate the multi-feature similarity between every two suspected code defects, and deduplicatize the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; The confidence enhancement module is used to cross-validate suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the confidence-enhanced suspected defects in the code. The results output module is used to retrieve contextual information of suspected code defects with enhanced confidence based on the code semantic index library, and to obtain the enhanced code defects based on the suspected code defects with enhanced confidence and their contextual information.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: The code defect detection method introduced in this invention improves the accuracy, efficiency and security of static code defect detection in all dimensions through multi-engine scanning operations and context-aware information analysis operations, avoiding omissions in single-dimensional verification. This invention introduces a multi-feature similarity calculation method that weights each pair of suspected code defects across four dimensions: file path similarity, line number proximity, defect type identifier similarity, and code snippet semantic similarity. This multi-feature similarity method removes duplicate suspected defects, improving deduplication accuracy and enhancing the accuracy of subsequent detection of actual code defects. The invention uses cross-validation to set the confidence level of defects, removes irrelevant directories using AST semantic indexing, and retrieves the contextual information of defects using a constructed code semantic index library. This generates a judgment result on the authenticity of suspected code defects and a threat score, enabling the filtering of false positives, assessment of the severity of defects, analysis of business impact, and provision of remediation suggestions. This invention supports fully offline deployment; all data (including source code, defect reports, and AI analysis results) is processed locally without relying on any external network services, meeting the requirements for data localization and leakage prevention. It is suitable for high-security scenarios such as government, power, and military industries. Attached Figure Description

[0022] Figure 1 The diagram shown is a schematic flowchart of a code defect detection method in one embodiment of the present invention. Figure 2 The diagram shown is a schematic of the AST index filtering pre-mechanism process in one embodiment of the present invention. Figure 3 The diagram shown is a schematic diagram of the code semantic index library retrieval context information in one embodiment of the present invention; Figure 4The image shown is a schematic diagram of code defect detection results in one embodiment of the present invention. Detailed Implementation

[0023] The following description, in conjunction with the accompanying drawings and specific embodiments, provides further details. In this description, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature.

[0024] Example 1 This embodiment introduces a code defect detection method, such as... Figure 1 As shown, the specific steps include: A code analysis task record is created based on a user-initiated code analysis task request; wherein, the code analysis task record includes the path of the code under test; Obtain valid source code files based on the path of the code under test, and build a code semantic index library based on the valid source code files; By using a thread pool to call multiple static analysis engines in parallel to scan valid source code files, several suspected code defects were identified. Calculate the multi-feature similarity between each pair of suspected code defects, and then deduplicate the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; Cross-validate the suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the suspected defects with enhanced confidence. The contextual information of suspected code defects with enhanced confidence is retrieved based on the code semantic index library, and the enhanced code defects are obtained based on the suspected code defects with enhanced confidence and their contextual information.

[0025] Example 2 Based on Example 1, this example describes the specific implementation process of a code defect detection method, including the following: I. Building a code semantic index library In one specific embodiment of the present invention, obtaining valid source code files based on the path of the code under test includes: traversing the path of the code under test to obtain a list of source files, and excluding source files corresponding to irrelevant directories from the list of source files according to predefined filtering rules to obtain valid source code files; wherein, irrelevant directories include virtual environment directories, dependency management directories, build output directories, cache directories, and version control directories; Building a code semantic index library based on valid source code files includes: calling an Abstract Syntax Tree (AST) parser to parse valid source code files, generating corresponding ASTs, and extracting key metadata such as function signatures, class definitions, and call relationships from the ASTs to build the code semantic index library.

[0026] The operation of excluding irrelevant directories is defined as the AST index filtering pre-mechanism, and the process is as follows: Figure 2 As shown.

[0027] In one specific embodiment of the present invention, the code semantic index library further includes function names, parameter lists and return types, class names, inheritance relationships, member variables and method lists, function call relationship graphs, file-level import statements and global variables.

[0028] In one specific embodiment of the present invention, the AST parser used includes at least one of Tree-sitter, Clang, or JavaParser.

[0029] II. Multi-engine parallel scanning In one specific embodiment of the present invention, at least two different types of static analysis engines are invoked in parallel through a thread pool to scan valid source code files, resulting in multiple suspected code defects. Each list of suspected code defects includes the type, location, severity, credibility of each static analysis engine, file path similarity, line number proximity, defect type identifier similarity, semantic similarity of code fragments, and associated code fragments.

[0030] The combination of static analysis engines for parallel calls includes a combination of a pattern-matching-based static analysis engine (such as the open-source static code scanning tool Semgrep based on pattern matching) and a data flow analysis-based static analysis engine (such as Cppcheck, a memory defect detection tool specifically for C / C++); or a combination of a pattern-matching-based static analysis engine, a data flow analysis-based static analysis engine, and a symbolic execution-based static analysis engine; or a combination of a pattern-matching-based static analysis engine, a data flow analysis-based static analysis engine, a symbolic execution-based static analysis engine, and a rule-based reasoning-based static analysis engine.

[0031] Multi-engine parallel scanning also includes: setting a timeout protection mechanism with a timeout period of 10 to 30 minutes; converting the output results of each engine into a standardized defect report format; and controlling concurrent execution through a thread pool with 2 to 8 worker threads.

[0032] III. Intelligent Deduplication In one specific embodiment of the present invention, the multi-feature similarity is calculated using the following formula: Multi-feature similarity = file path similarity × W1 + line number proximity × W2 + defect type identifier similarity × W3 + code snippet semantic similarity × W4; In the formula, W1 is the weight of normalized file path similarity, with a value of 30% to 50%; W2 is the weight of line number proximity, with a value of 15% to 25%; W3 is the weight of defect type identifier similarity, with a value of 15% to 25%; W4 is the weight of code snippet semantic similarity, with a value of 15% to 25%; and W1+W2+W3+W4=1.

[0033] In one specific embodiment of the present invention, the calculation of file path similarity includes: performing unified path separator and case normalization on every two suspected code defects to obtain two normalized file paths respectively. When the two normalized file paths are exactly the same, the file path similarity is 1, otherwise it is 0. The calculation of line number proximity includes: calculating the absolute difference between the line numbers of every two suspected code defects. When the absolute difference |ΔL| is less than or equal to 5, the line number proximity is 1. When the absolute difference |ΔL| is greater than 5, the line number proximity = max(0, 1-(ΔL-5) / 50), where 50 is the maximum tolerance number of lines. The calculation of defect type identifier similarity includes: comparing the defect type identifiers of every two suspected code defects. The defect type identifier is the rule ID or error type code defined by each static analysis engine. When two suspected defect type identifiers are exactly the same, the defect type identifier similarity is 1, otherwise it is 0. The calculation of semantic similarity of code snippets includes: standardizing each pair of code snippets containing suspected code defects, removing spaces and comments to obtain two standardized code snippets, calculating the edit distance between the two standardized code snippets, and calculating the semantic similarity of the code snippets based on the edit distance using the following formula: The semantic similarity of code snippets = 1 − (edit distance / maximum length). In the formula, the maximum length is the maximum length among the two code segments after standardization of suspected defects.

[0034] In one specific embodiment of the present invention, the multi-feature similarity between every two suspected code defects is calculated using the above formula. Code defects with a multi-feature similarity greater than or equal to a multi-feature similarity threshold are identified as duplicate code defects, and one of these defects is deleted, resulting in deduplicated code defects. The multi-feature similarity threshold ranges from 50% to 90%, preferably from 65% to 75%, and more preferably from 70%.

[0035] IV. Confidence Enhancement In one specific embodiment of the present invention, cross-validating suspected code defects after deduplication to obtain suspected code defects with enhanced confidence includes: counting the number of static analysis engines for each suspected code defect in the list of suspected code defects after deduplication, and setting the confidence level of each suspected code defect according to the number of static analysis engines, thereby obtaining suspected code defects with enhanced confidence.

[0036] If each suspected code defect after deduplication is detected by two or more different static analysis engines, the confidence level of the suspected code defect is set to high. If it is detected by only one engine, and the historical confidence level of that engine in similar projects is higher than the preset confidence threshold, the confidence level is set to medium. If it is detected by only one engine, and the historical confidence level of that engine in similar projects is lower than or equal to the preset confidence threshold, or the type of the suspected defect belongs to a predefined high-false-report type, the confidence level is set to low.

[0037] V. Results Output In one specific embodiment of the present invention, obtaining enhanced code defects based on suspected code defects and their context information includes: retrieving context information of suspected code defects with enhanced confidence based on a code semantic index library, inputting the suspected code defects and their context information into an existing artificial intelligence model for analysis, obtaining a threat score and a authenticity judgment result of the defect, and obtaining enhanced defects based on the threat score and the authenticity judgment result of the defect.

[0038] The suspected code defects and their contextual information are input into an existing artificial intelligence model for analysis, such as... Figure 3 As shown, it includes the following steps: First, a unique cache key is generated based on defect characteristics (including file path, line number, rule identifier, and code snippet), and the local cache database is queried. If a valid cache record exists, the historical analysis results are directly reused, avoiding repeated calls to the artificial intelligence model and significantly reducing computational overhead.

[0039] If no cache hit occurs, multi-level contextual information related to the defect will be dynamically retrieved from the code semantic index, including: Function-level context: function name, parameter list, return type, and complete function body; Class-level context: class name, inheritance relationship, and member variables; Call context: A list of callers and callees of this function; File-level context: related import statements and global variables.

[0040] Based on the aforementioned context and defect information, a structured analysis request (Prompt) is constructed, and a large language model (LLM) deployed locally or on a local area network is invoked for inference. After parsing, the model output generates augmentation analysis results containing the following dimensions: Authenticity determination: Determine whether the defect is a real problem; Technical explanation: Provides a 100–200 word natural language description; Threat quantification: Calculate the CVSS general vulnerability score (0.0–10.0) and vector string; Business impact assessment: Analyze the potential impact on system stability, data security, or compliance; Recommended fix: Provide actionable code fix examples; Root cause analysis: The underlying logic behind the location defects; Confidence score: reflects the reliability of the model's judgment (0.0–1.0).

[0041] The final defect records are batch inserted into the code semantic index library, and project-level statistical indicators (such as total number of defects, percentage of high-risk defects, average CVSS score, etc.) are updated.

[0042] In practice, the analysis dimensions, output format, and context scope can be dynamically adjusted according to security policies and performance requirements. All AI models run in a local or controlled LAN environment, without relying on external network services, meeting the requirement that data does not leave the domain in high-security scenarios.

[0043] The authenticity assessment of the defect is used to filter false alarms, while the threat score (threat quantification) is used to assess the severity of the defect.

[0044] In one specific embodiment of the present invention, the defects after enhancement analysis are sorted according to their severity, confidence level, and threat score, and the sorted defect list is output as the code defect detection result, such as... Figure 4 As shown. Figure 4 The document lists specific defect information in tabular form, including severity, confidence level, CVSS (threat score), defect type, file path, line number, and defect details, and provides corresponding remediation suggestions for each defect.

[0045] Example 3 This embodiment describes a code defect detection system, including: A code analysis task record building module is used to create code analysis task records based on user-initiated code analysis task requests; wherein, the code analysis task record includes the path of the code under test; The code semantic index building module is used to obtain valid source code files based on the path of the code under test, and to build a code semantic index library based on the valid source code files. The multi-engine parallel scanning module is used to scan valid source code files by calling multiple static analysis engines in parallel through a thread pool, and to obtain multiple suspected code defects. The intelligent deduplication module is used to calculate the multi-feature similarity between every two suspected code defects, and deduplicatize the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; The confidence enhancement module is used to cross-validate suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the confidence-enhanced suspected defects in the code. The results output module is used to retrieve contextual information of suspected code defects with enhanced confidence based on the code semantic index library, and to obtain the enhanced code defects based on the suspected code defects with enhanced confidence and their contextual information.

[0046] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method of code defect detection, characterized by, include: A code analysis task record is created based on a user-initiated code analysis task request; wherein, the code analysis task record includes the path of the code under test; Obtain valid source code files based on the path of the code under test, and build a code semantic index library based on the valid source code files; By using a thread pool to call multiple static analysis engines in parallel to scan valid source code files, several suspected code defects were identified. Calculate the multi-feature similarity between each pair of suspected code defects, and then deduplicate the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; Cross-validate the suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the suspected defects with enhanced confidence. The contextual information of suspected code defects with enhanced confidence is retrieved based on the code semantic index library, and the enhanced code defects are obtained based on the suspected code defects with enhanced confidence and their contextual information.

2. The code defect detection method according to claim 1, characterized in that, Obtaining valid source code files based on the path of the code under test includes: traversing the path of the code under test to obtain source files, and excluding source files corresponding to irrelevant directories according to predefined filtering rules to obtain valid source code files; among them, irrelevant directories include virtual environment directory, dependency management directory, build output directory, cache directory and version control directory.

3. The code defect detection method according to claim 1, characterized in that, Building a code semantic index library based on valid source code files includes: calling the Abstract Syntax Tree (AST) parser to parse valid source code files, generating corresponding ASTs, extracting function signatures, class definitions, and call relationship data from the ASTs, and building the code semantic index library.

4. The code defect detection method according to claim 1, characterized in that, Each suspected code defect includes the suspected defect type, location, severity, credibility of each static analysis engine, file path similarity, line number proximity, defect type identifier similarity, semantic similarity of code snippets, and related code snippets.

5. The code defect detection method according to claim 1, characterized in that, Deduplication of suspected code defects based on multi-feature similarity results in the following steps: suspected code defects with a multi-feature similarity greater than or equal to a multi-feature similarity threshold are identified as duplicate suspected code defects, and one of the suspected code defects is deleted to obtain the deduplicated suspected code defects.

6. The code defect detection method according to claim 1, characterized in that, If a suspected defect in the deduplicated code is detected by two or more different static analysis engines, the confidence level of the suspected defect is set to high. If it is detected by only one engine, and the engine's historical confidence level in similar projects is higher than the preset confidence threshold, the confidence level is set to medium. If it is detected by only one engine, and the engine's historical confidence level in similar projects is lower than or equal to the preset confidence threshold, or if the type of the suspected defect belongs to a predefined high-false-report type, the confidence level is set to low.

7. The code defect detection method according to claim 1, characterized in that, Based on the suspected code defects enhanced for each confidence level and their contextual information, the enhanced code defects include: The contextual information of suspected code defects with enhanced confidence is retrieved from the code semantic index library. The suspected code defects and their contextual information are input into the existing artificial intelligence model for analysis to obtain the threat score and the authenticity judgment result of the defect. Based on the threat score and the authenticity judgment result of the defect, the enhanced analysis defect is obtained. The context information includes function-level context information, class-level context information, call relationship context information, and file-level context information. The function-level context information includes the function signature, function parameter list, return type, and complete function body. The class-level context information includes the class name, inheritance relationship, and member variables. The call relationship context information includes a list of callers and callees. The file-level context information includes import statements and global variables.

8. The code defect detection method according to claim 4, characterized in that, Multi-feature similarity is calculated using the following formula: Multi-feature similarity = file path similarity × W1 + line number proximity × W2 + defect type identifier similarity × W3 + code snippet semantic similarity × W4; In the formula, W1 is the weight of normalized file path similarity, W2 is the weight of line number proximity, W3 is the weight of defect type identifier similarity, W4 is the weight of code snippet semantic similarity, and W1+W2+W3+W4=1.

9. The code defect detection method according to claim 8, characterized in that, The calculation of file path similarity includes: for every two suspected code defects, uniform path separator and case normalization are performed to obtain two normalized file paths. When the two normalized file paths are exactly the same, the file path similarity is 1; otherwise, it is 0. The calculation of line number proximity includes: calculating the absolute difference between the line numbers of every two suspected code defects. When the absolute difference |ΔL| is less than or equal to 5, the line number proximity is 1. When the absolute difference |ΔL| is greater than 5, the line number proximity = max(0, 1-(ΔL -5) / 50), where 50 is the maximum tolerance number of lines. The calculation of defect type identifier similarity includes: comparing the defect type identifiers of every two suspected code defects. The defect type identifier is the rule ID or error type code defined by each static analysis engine. When two suspected defect type identifiers are exactly the same, the defect type identifier similarity is 1, otherwise it is 0. The calculation of semantic similarity of code snippets includes: standardizing each pair of code snippets containing suspected code defects, removing spaces and comments to obtain two standardized code snippets, calculating the edit distance between the two standardized code snippets, and calculating the semantic similarity of the code snippets based on the edit distance using the following formula: The semantic similarity of code snippets = 1 − (edit distance / maximum length). In the formula, the maximum length is the maximum length among the two code segments after standardization of suspected defects.

10. A code defect detection system, characterized in that, include: A code analysis task record building module is used to create code analysis task records based on user-initiated code analysis task requests; wherein, the code analysis task record includes the path of the code under test; The code semantic index building module is used to obtain valid source code files based on the path of the code under test, and to build a code semantic index library based on the valid source code files. The multi-engine parallel scanning module is used to scan valid source code files by calling multiple static analysis engines in parallel through a thread pool, and to obtain multiple suspected code defects. The intelligent deduplication module is used to calculate the multi-feature similarity between every two suspected code defects, and deduplicatize the suspected code defects based on the multi-feature similarity to obtain the deduplicated suspected code defects; The confidence enhancement module is used to cross-validate suspected defects in the deduplicated code, count the number of static analysis engines that found each suspected defect, set the confidence level for each suspected defect based on the number, and obtain the confidence-enhanced suspected defects in the code. The results output module is used to retrieve contextual information of suspected code defects with enhanced confidence based on the code semantic index library, and to obtain the enhanced code defects based on the suspected code defects with enhanced confidence and their contextual information.

Images