Rule generation method and apparatus, and computing device cluster

Abstract

A rule generation method, comprising: receiving rule description information and detection language information; on the basis of the rule description information and the detection language information, splitting a lexical file of a DSL to obtain at least one lexical fragment, and splitting a syntax file of the DSL to obtain at least one syntax fragment; and on the basis of the at least one lexical fragment and the at least one syntax fragment, obtaining a DSL rule. In the present application, by means of the method, a lexical file and a syntax file can be split on the basis of a DSL rule description and a detection language; and a DSL rule can then be generated on the basis of the split lexical fragment and syntax fragment by using a large model such as an LLM, thereby quickly customizing a DSL detection rule and reducing rule development costs for users. Compared with the related techniques, the method does not require a user to participate in operations, and can enable the automatic generation of a DSL rule, and it is unnecessary to spend a lot of time on QL, thereby improving the rule development efficiency.

Description

Rule generation method, device and computing device cluster

[0001] The present application claims priority to the Chinese patent application No. 202411355040.8, filed on September 26, 2024, and entitled "Rule generation method, device and computing device cluster", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of cloud computing, and in particular to a rule generation method, device and computing device cluster. BACKGROUND

[0003] With the continuous development of Internet-related technologies, the scale and complexity of software are continuously expanding, and the pressure faced by software security is gradually increasing. In related technologies, domain specific language (DSL) analysis technology is used to analyze code to identify potential security risks in the code. However, DSL is a domain specific language and is not a mainstream programming language. If the user is not proficient in DSL, the DSL rule written by the user may not be executed correctly or the execution result may not meet the expectation. As can be seen, the proficiency of the user in DSL makes the development cost and execution result of the DSL rule fluctuate in a large range, which becomes a key factor restricting the efficiency of rule development. SUMMARY

[0004] To solve the above problems, the embodiments of the present application provide a rule generation method which can quickly customize DSL check rules and reduce the cost of user rule development. In addition, the present application also provides a rule generation device and a computing device cluster corresponding to the rule generation method.

[0005] To this end, the embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, the embodiments of the present application provide a rule generation method, comprising: receiving rule description information and detection language information; the rule description information refers to information of various constraint conditions for limiting domain specific language (DSL) rules, and the detection language information refers to the language name of the target code to be detected; splitting a lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical fragment, and splitting a syntax file of the DSL to obtain at least one syntax fragment; and obtaining the DSL rule according to the at least one lexical fragment and the at least one syntax fragment.

[0007] In this embodiment, the method can split the lexical file and the syntax file based on the rule description and the detection language of the DSL, and then generate the DSL rule based on the split lexical fragments and the split syntax fragments by using a large model such as LLM, so as to quickly customize the DSL checking rule and reduce the user development cost. Compared with the related art, the method does not require user participation, can automatically generate the DSL rule, and does not need to spend a lot of time learning QL, thereby improving the development efficiency of the rule.

[0008] In an embodiment, before the splitting the lexical file of the DSL to obtain at least one lexical fragment and splitting the syntax file of the DSL to obtain at least one syntax fragment according to the rule description information and the detection language information, the method further includes: extracting keywords from the rule description information to obtain a keyword set; and analyzing the keyword set to obtain a node keyword, a rule attribute, and a logical relationship.

[0009] In this embodiment, the method can extract keywords from the rule description to obtain a plurality of keyword sets, and then analyze the keyword sets to obtain a node keyword, a rule attribute, and a logical relationship, so as to fully understand the content of the rule description, thereby improving the accuracy of generating the DSL rule.

[0010] In an embodiment, the splitting the lexical file of the DSL to obtain at least one lexical fragment and splitting the syntax file of the DSL to obtain at least one syntax fragment according to the rule description information and the detection language information specifically includes: splitting the lexical file of the DSL to obtain the at least one lexical fragment and a lexical identifier corresponding to the at least one lexical fragment according to the detection language information, the node keyword, and the question and answer pair.

[0011] In this embodiment, the method can split the lexical file of the DSL by using the detection language, the node keyword, and the question and answer pair, so as to improve the accuracy of splitting the lexical file, and further improve the accuracy of generating the DSL rule.

[0012] In an embodiment, the splitting the lexical file of the DSL to obtain at least one lexical fragment and splitting the syntax file of the DSL to obtain at least one syntax fragment according to the rule description information and the detection language information specifically includes: splitting the syntax file of the DSL to obtain the at least one syntax fragment according to the rule attribute, the logical relationship, and the lexical identifier corresponding to the at least one lexical fragment.

[0013] In the embodiment, the method can split the syntax file of the DSL by using the rule attribute, the logical relationship, and the lexical identifier corresponding to the at least one lexical segment, thereby improving the accuracy of splitting the syntax file, and further improving the accuracy of generating the DSL rule.

[0014] In an embodiment, the obtaining the DSL rule according to the at least one lexical segment and the at least one syntax segment specifically comprises: writing the at least one lexical segment and the at least one syntax segment into a prompt template to obtain an input prompt; inputting the input prompt into a large language model (LLM) to obtain the DSL rule.

[0015] In the embodiment, the method can split the lexical file and the syntax file of the DSL, and generate different prompts matched with different rules for calling the large model, thereby improving the accuracy of the generation result of the large model.

[0016] In a second aspect, an embodiment of the present application provides a rule generation apparatus, comprising: a first processing unit configured to receive rule description information, the rule description information being information of various constraint conditions of a domain-specific language (DSL) rule; a second processing unit configured to receive detection language information, the detection language information being a language name of a detected target code; the second processing unit is configured to split a lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment; a third processing unit configured to split a syntax file of the DSL according to the rule description information and the detection language information to obtain at least one syntax segment; and a fourth processing unit configured to obtain the DSL rule according to the at least one lexical segment and the at least one syntax segment.

[0017] In an embodiment, the first processing unit, before splitting the lexical file of the DSL to obtain the at least one lexical segment and splitting the syntax file of the DSL to obtain the at least one syntax segment according to the rule description information and the detection language information, is further configured to perform keyword extraction on the rule description information to obtain a keyword set; and perform analysis on the keyword set to obtain a node keyword, a rule attribute, and a logical relationship.

[0018] In an embodiment, the second processing unit is specifically configured to split the lexical file of the DSL according to the detection language information, the node keyword, and a question and answer pair to obtain the at least one lexical segment and a lexical identifier corresponding to the at least one lexical segment.

[0019] In an implementation, the third processing unit is specifically configured to split the grammar file of the DSL according to the rule attribute, the logical relationship, and the lexical identifier corresponding to the at least one lexical segment, to obtain the at least one grammar segment.

[0020] In an implementation, the fourth processing unit is specifically configured to write the at least one lexical segment and the at least one grammar segment into a prompt template to obtain an input prompt; and input the input prompt into a large language model (LLM) to obtain the DSL rule.

[0021] In a third aspect, an embodiment of the present application provides a computing device, including: at least one memory; at least one processor configured to execute instructions stored in the memory to cause the computing device to perform the embodiments of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium including computer program instructions, when the computer program instructions are executed by a computing device, the computing device performs the embodiments of the first aspect.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product including instructions, characterized in that the computer program product stores instructions, when the instructions are executed by a computing device, the computing device implements the embodiments of the first aspect.

[0024] In a sixth aspect, an embodiment of the present application provides a computing device cluster, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the embodiments of the first aspect.

[0025] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium including computer program instructions, when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the embodiments of the first aspect.

[0026] In an eighth aspect, an embodiment of the present application provides a computer program product including instructions, characterized in that the computer program product stores instructions, when the instructions are executed by a computing device cluster, the computing device cluster implements the embodiments of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0027] The drawings needed to be used in the following embodiments or prior art description are briefly introduced.

[0028] Fig. 1 is a schematic diagram of an architecture of a rule generation system according to an embodiment of the present application;

[0029] Fig. 2(a) is a schematic diagram of a part of a lexical file content according to an embodiment of the present application;

[0030] Fig. 2(b) is a schematic diagram of three lexical segments and three lexical identifiers corresponding to the lexical segments according to an embodiment of the present application;

[0031] Fig. 3(a) is a schematic diagram of a part of a syntax file content according to an embodiment of the present application;

[0032] Fig. 3(b) is a schematic diagram of syntax segments extracted based on lexical identifiers according to an embodiment of the present application;

[0033] Fig. 4(a) is a schematic diagram of another part of a syntax file content according to an embodiment of the present application;

[0034] Fig. 4(b) is a schematic diagram of syntax segments extracted based on rule attributes according to an embodiment of the present application;

[0035] Fig. 5(a) is a schematic diagram of another part of a syntax file content according to an embodiment of the present application;

[0036] Fig. 5(b) is a schematic diagram of syntax segments extracted based on logical relationships according to an embodiment of the present application;

[0037] Fig. 6(a) is a schematic diagram of a code segment input to an LLM according to an embodiment of the present application;

[0038] Fig. 6(b) is a schematic diagram of DSL rules output by an LLM according to an embodiment of the present application;

[0039] Fig. 7 is a schematic diagram of a scenario in which a user uses a rule generation system according to an embodiment of the present application;

[0040] Fig. 8 is a flowchart of a rule generation method according to an embodiment of the present application;

[0041] Fig. 9 is a schematic diagram of a structure of a computing device according to an embodiment of the present application;

[0042] Fig. 10 is a schematic diagram of an architecture of a computing device cluster according to an embodiment of the present application;

[0043] Fig. 11 is a schematic diagram of an architecture of another computing device cluster according to an embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0045] The term "and / or", used herein, is a description of an association relationship of associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist simultaneously, and B exists alone. The symbol " / " in this paper represents an or relationship of associated objects, for example, A / B represents A or B.

[0046] The terms "first" and "second" and the like in the description and claims herein are used to distinguish different objects, rather than to describe a specific order of the objects. For example, the first response message and the second response message are used to distinguish different response messages, rather than to describe a specific order of the response messages.

[0047] In the embodiments of the present application, the words such as "exemplary" or "for example" are used to mean serving as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words such as "exemplary" or "for example" are intended to present the relevant concept in a specific manner.

[0048] In the description of the embodiments of the present application, unless otherwise specified, the meaning of "a plurality of" is two or more, for example, a plurality of processing units means two or more processing units, and the like; a plurality of elements means two or more elements, and the like.

[0049] Before introducing the technical solutions protected by the present application, several professional terms related to the technical solutions protected by the present application are explained in advance, which are as follows:

[0050] DSL is a programming language designed for a specific field or application field. Compared with general programming languages (such as Python, Java, C++), DSL is more focused on solving a certain specific problem or processing a specific type of task. The design purpose of DSL is to improve development efficiency, reduce errors and simplify the development process. For example, hypertext markup language (HTML) for displaying web pages, Maven (Apache Maven) for compiling configuration.

[0051] DSL rule refers to a DSL query statement for querying a certain code scenario. For example, to query a method call named test, the DSL rule is (functionCall fc where fc.name==“test”;).

[0052] The lexical file of a DSL is a file that defines the lexical rules in the DSL language. For example, it defines how a string is represented in the DSL, which can be ([a-zA-Z0-9]|'\\'|'\”|'\\"'|”)*.

[0053] The syntax file of a DSL is a file that defines how different DSL lexemes form executable rules of the DSL. For example, it defines that a numeric expression in a DSL rule is composed of a sign, a number, and a decimal point, which can be (Plus|Minus)?INT(Point INT)?. Here, Plus, Minus, Point, and INT are lexemes defined in the lexical file.

[0054] A prompt template refers to a predefined format or structure used to provide input information or instructions when interacting with a language model, such as a large language model (LLM). The prompt template is used to guide the model to generate accurate and relevant output through clear instructions and formatted information. The prompt template generally includes task descriptions, examples, and detailed requirements. The task description refers to the specific task that the model needs to complete. The examples refer to providing examples or formatted input information to help the model understand how to process the data. The detailed requirements refer to specific requirements for the generated content, such as format, length, style, etc.

[0055] Next, the technical solutions provided by the present application are introduced.

[0056] Generally, in the process of code analysis based on DSL-based static code analysis technology, it can be divided into two parts: the first part, the low-level framework parses the input code, uses specific forms of data structures such as abstract syntax trees and control flow graphs to save the code and generate a database; the second part, the upper-level checker queries the database through DSL to finally locate the code location suspected to have risks.

[0057] Taking the program analysis engine of CodeQl as an example. The program analysis engine of CodeQl uses a language called query language (QL) (which is essentially a DSL) to write query statements to query code information to achieve code checking tasks. However, the QL in CodeQL is completely written by security personnel, and the development and execution efficiency of QL completely depends on the ability of the security personnel. Security personnel who are not familiar with QL need to spend a lot of time learning QL when there is a need to develop QL rules, which restricts the efficiency of rule development.

[0058] Therefore, the embodiment of the present application provides a rule generation method, which can split a lexical file and a syntax file based on a rule description and a detection language of a DSL, to generate a DSL rule, so as to realize rapid customization of a DSL checking rule and reduce the rule development cost of a user. The method can split the lexical file and the syntax file of the DSL, generate different prompts matched with different rules for calling a large model, so as to improve the accuracy of the generation result of the large model.

[0059] FIG. 1 is a schematic diagram of an architecture of a rule generation system provided in the embodiment of the present application. As shown in FIG. 1, the rule generation system 100 includes a first processing module 110, a second processing module 120, a third processing module 130, and a fourth processing module 140.

[0060] The first processing module 110 is configured to extract a rule description by using a large model after receiving the rule description, to obtain node keywords, rule attributes, and logical relationships.

[0061] The rule description refers to information of various constraint conditions of a DSL rule. The rule description can be presented in the form of text, image, etc. For example, it is assumed that the rule description is “generate a rule to query sensitive data leakage in java. For all variables, literals, attributes, if the value or naming contains the keyword ‘password’, it is considered as a dangerous value, and it is tracked as a stain. For any info, error, warn method call in the log class, if the parameter contains stain data, it is considered that there is a risk of sensitive data leakage here”.

[0062] The first processing module 110 can input the rule description into a model such as LLM, and let the model such as LLM perform keyword extraction on the rule description, to output a keyword set. For example, the keyword set obtained by the first processing module 110 includes: sensitive data leakage, {[all, (variable, literal, attribute)], [(value, or, naming), contains, password]}, stain, for {[log class, any, (info, error, warn), method call], [parameter, stain data], here is a risk}.

[0063] The first processing module 110 can analyze the bottom layer of the keyword set to obtain node keywords. For example, the node keywords obtained by the first processing module 110 include: variable, literal, attribute, value, naming, string, method, parameter, stain, rule description, and, or.

[0064] The first processing module 110 can analyze the highest layer of the keyword set to obtain a rule attribute. Exemplarily, the rule attribute obtained by the first processing module 110 includes: "data flow rule" and "sensitive data leakage". The rule attribute refers to the information about the rule nature and the rule content. The rule nature can be that the rule belongs to a data flow rule, or a structured rule, or a configuration rule, or other rules. The rule content can be sensitive data leakage. The sensitive data leakage belongs to the problem scenario checked by the rule, and is used to generate rule description information.

[0065] The first processing module 110 can analyze the middle layer of the keyword set to obtain a logical relationship. Exemplarily, the logical relationship obtained by the first processing module 110 includes: an and relationship (variable and literal and attribute), or a relationship (info, error, warn method, value, naming), a pollution source (value or naming of variable and literal and attribute), and a pollution outbreak point (info, error, warn method).

[0066] The second processing module 120 is configured to, after receiving the detection language, split the lexical file according to the detection language, the node keyword of the first processing module 110, and the Q&A of the Q&A database to obtain at least one lexical segment and a lexical identifier corresponding to each lexical segment.

[0067] The detection language refers to the language name of the target code to be detected, such as Python, Java, and C++. The detection language can be presented in the form of text, image, etc.

[0068] The Q&A stored in the Q&A database is generated from various documents related to DSL, and can provide effective guidance for the mapping of nodes. Exemplarily, the second processing module 120 can collect information about the development node document of DSL, the code repository information, the user experience document, and the developer Q&A document, and then process the collected information by using a manual generation (such as expert writing) or automatic generation (such as national language processing (NLP) and templating method) to generate a large number of DSL-related Q&As. The second processing module 120 can store the large number of DSL-related Q&As in a database to form the Q&A database.

[0069] The DSL-related Q&A pairs can be: what is the node corresponding to the class definition? It is recordDeclaration. What are the nodes in the java language? There are functionCall, recordDeclaration, and functionCall. What are the attributes of the nodes? There are function, name, and so on. And other Q&A pairs.

[0070] Exemplarily, assuming that the detected language is "java". The second processing module 120 can select the relevant lexes used by the java language from the lex file according to the detected language, that is, the lex file of the java language. The second processing module 120 can find the lex identifiers corresponding to the node keywords and Q&As from the lex file of the java language based on the patterns of the lexes of the java language. The second processing module 120 can remove other lexes other than the lexes related to the node keywords and Q&As corresponding to the lex identifiers under the lex identifiers to obtain the lex fragments of the node keywords and Q&As corresponding to the lex identifiers.

[0071] In one embodiment, the node keywords or Q&As obtained by the second processing module 120 can be "functionCall", "function", and "name". The part of the lex file obtained by the second processing module 120 is shown in FIG. 2(a). The second processing module 120 can find the lex identifiers corresponding to "functionCall", "function", and "name" from the lex file based on the three keywords or Q&As, which are "Node", "NodeAttr", and "StrAttr" respectively. The second processing module 120 can remove other lexes other than the lexes related to "functionCall" under the lex identifier "Node" in the lex file to obtain the lex fragments of "functionCall". The second processing module 120 can remove other lexes other than the lexes related to "function" under the lex identifier "NodeAttr" in the lex file to obtain the lex fragments of "function". The second processing module 120 can remove other lexes other than the lexes related to "name" under the lex identifier "StrAttr" in the lex file to obtain the lex fragments of "name".

[0072] The third processing module 130 is configured to split the syntax file according to the rule attributes and logical relationships of the first processing module 110 and the lex identifiers of the second processing module 120 to obtain at least one syntax fragment.

[0073] Exemplarily, after obtaining the lexical identifier, the third processing module 130 can detect, from bottom to top, which grammars in the grammar file involve the lexical identifier according to the lexical identifier, and retain the grammars involving the lexical identifier, and eliminate the grammars not involving the lexical identifier.

[0074] In an embodiment, the lexical identifier obtained by the third processing module 130 can be "STRING", "StrAttr", and "Eq". The part of the grammar file obtained by the third processing module 130 is shown in FIG. 3(a). The third processing module 130 can identify, from bottom to top, the grammars involving "STRING", "StrAttr", and "Eq" from the grammar file based on "STRING", "StrAttr", and "Eq". The third processing module 130 can obtain the grammars involving "STRING", "StrAttr", and "Eq" from the grammar file, and take each grammar as a grammar fragment, as shown in FIG. 3(b).

[0075] After obtaining the rule attribute, the third processing module 130 can detect, from top to bottom, the attributes of the grammars in the grammar file according to the rule attribute, retain the grammars meeting the rule attribute, and eliminate the grammars not meeting the rule attribute.

[0076] In an embodiment, the rule attribute obtained by the third processing module 130 can be "data flow rule" and "sensitive data leakage". The part of the grammar file obtained by the third processing module 130 is shown in FIG. 4(a). The third processing module 130 can detect, from top to bottom, the attributes of the grammars in the grammar file, then obtain the grammars with the attribute of "ruleSetMessage" from the grammar file, and take each grammar as a grammar fragment, as shown in FIG. 4(b).

[0077] After obtaining the logical relationship, the third processing module 130 can detect, from top to bottom, which grammars in the grammar file involve the logical relationship according to the logical relationship, retain the grammars involving the logical relationship, and eliminate the grammars not involving the logical relationship.

[0078] In one embodiment, the logical relationship obtained by the third processing module 130 can be "in the syntax rule fragment obtained by other methods, the selection of and condition and or condition is retained, through rule information analysis, we get that in the logical relationship, there is only or condition, and no and condition, so the use of AND condition can be removed". The part of the syntax file obtained by the third processing module 130 is shown in Figure 5(a). The third processing module 130 can identify the syntax involving "AND and OR" from the syntax file based on "AND and OR". The third processing module 130 can obtain the syntax involving "AND and OR" from the syntax file, modify "AND and OR" in the syntax to "OR", and then take each syntax as a syntax fragment, as shown in Figure 5(b).

[0079] The fourth processing module 140 is configured to extract at least one lexical fragment of the second processing module 120 and at least one syntax fragment of the third processing module 130 using a large model to obtain a DSL rule.

[0080] Exemplarily, the fourth processing module 140 can obtain a prompt template, and then write the at least one lexical fragment and the at least one syntax fragment into the prompt template to obtain an input prompt comprising the lexical fragment and the prompt template. The fourth processing module 140 converts the presentation mode of the lexical fragment and the prompt template into a prompt suitable for the LLM, so that the lexical fragment and the prompt template are input into the LLM, and the result output by the LLM is more accurate. The fourth processing module 140 can input the input prompt comprising the lexical fragment and the prompt template into the LLM to make the LLM generate a DSL rule. After obtaining the DSL rule, the fourth processing module 140 can convert the DSL rule in the form of text into a corresponding code, so that the DSL rule can be used as a plug-in to analyze the code to identify potential security risks in the code.

[0081] In one embodiment, as shown in Figure 6(a), the DSL rule is:

[0082] A function call node is found, which satisfies one of the following conditions:

[0083] 1. The class is an implementation class of an interface, and satisfies all the following conditions:

[0084] a. The type of the annotation contained in the ST conforms to the following regular: ^javax.ws.rs.Path$|^org\.springframework\.web\.[a-z

[0085] b. The full path name of the class where the method called by fc conforms to the regular:.*domain.*|.*infrastructure.*

[0086] c. The class full name of the method invoked by fc does not match the regular expression:. *domain. * (entity | vo | query | command).

[0087] 1. The function call node and its class satisfy all the following conditions:

[0088] a. The type of the annotation contained in ST matches the regular expression: ^javax.ws.rs.Path$ | ^org\.springframework\.web\.[a-z

[0089] b. The class full name of the method invoked by fc matches the regular expression:. *domain. * |. *infrastructure. *

[0090] c. The class full name of the method invoked by fc does not match the regular expression:. *domain. * (entity | vo | query | command).

[0091] The fourth processing module 140 can automatically generate the code segment corresponding to the DSL rule shown in FIG. 6(a) by using DSL programming, and the code segment is shown in FIG. 6(b).

[0092] In the embodiment of the application, the rule generation system 100 can split the lexical file and the syntax file based on the rule description and the detection language of the DSL, and then generate the DSL rule according to the split lexical segment and the syntax segment by using the LLM and the like, so as to realize the rapid customization of the DSL checking rule and reduce the rule development cost of the user. Compared with the related art, the rule generation system 100 does not need the user to participate in the operation, can automatically generate the DSL rule, does not need to spend a lot of time to learn QL, and thus improves the rule development efficiency.

[0093] It should be understood that the functional modules, functional devices and the like involved in the above rule generation system 100 can also be realized by software or hardware, and the specific implementation can be determined according to the actual situation, which is not limited here. In addition, the functional modules, functional devices and the like involved in the above rule generation system 100 can be arranged separately or integrated, which is not limited here.

[0094] The above is the introduction of the rule generation system 100 provided by the embodiment of the present application. It can be understood that the rule generation system 100 described above can be configured on a cloud computing platform, for example, deployed on at least one virtual machine or container instance, so that the cloud computing platform can provide rule generation services. Of course, the rule generation system 100 can also be configured on nodes other than the cloud computing platform, for example, can be deployed in at least one data center, or deployed on at least one server, which can be determined according to actual conditions, and is not limited here. Among them, the cloud computing platform can provide a page related to the public cloud service for users to remotely access the public cloud service. In the embodiment, the user can purchase the rule generation service that the rule generation system 100 can provide in advance on the cloud computing platform. For ease of understanding, the interaction mode between the user and the cloud computing platform is described below.

[0095] As shown in FIG. 7, the interaction between the user and the cloud computing platform mainly includes: the user logs in the cloud computing platform 700 through the client (car) webpage, selects and purchases the cloud service (i.e. rule generation service) related to the rule generation system 100 in the cloud computing platform 700, and after the purchase, the user can generate the rule generation system 100 on the cloud computing platform 700 based on the functions provided by the rule generation service. Among them, the cloud computing platform 700 is mainly used to manage the infrastructure running the rule generation service. For example, the infrastructure of the rule generation service can include multiple data centers set in different regions, and each data center includes multiple servers. The data center can provide basic resources such as computing resources and storage resources for the rule generation service. Therefore, when the user purchases and uses the rule generation service, the user mainly pays for the resources used. When the user uses the rule generation service, the user can input the demand for the rule generation service through the configuration interface, the application program interface (API) or the interface for user interaction provided by the cloud computing platform 700, and the cloud computing platform 700 can generate the rule generation service matched with the user's demand according to the demand input by the user (or other software / hardware, etc.).

[0096] In addition, the modules in the rule generation system 100 can also be partially configured on the cloud side and partially configured on the terminal side, so as to realize the rule generation service through the end-to-cloud collaboration. In addition, the rule generation system 100 can also be configured on the terminal side, which can be determined according to actual conditions, and is not limited here.

[0097] The above is the introduction of the rule generation system provided by the embodiment of the present application. Next, based on the above content, the rule generation method provided by the embodiment of the present application is introduced.

[0098] Exemplarily, FIG. 8 shows a flowchart of a rule generation method provided by an embodiment of the present application. It can be understood that the rule generation method can be executed by the rule generation system 100 described above, and the specific implementation process is as follows:

[0099] In step S801, rule description information and detection language information are received.

[0100] The rule description refers to information of various constraint conditions for limiting the DSL rule. The rule description can be presented in the form of text, image, etc. The rule generation system 100 can input the rule description into the LLM or the like model, and let the LLM or the like model perform keyword extraction on the rule description to output a keyword set. The rule generation system 100 can analyze the bottom layer of the keyword set to obtain node keywords. The rule generation system 100 can analyze the highest layer of the keyword set to obtain rule attributes. The rule generation system 100 can analyze the middle layer of the keyword set to obtain logical relationships.

[0101] The detection language refers to the language name of the target code to be detected, such as Python, Java, and C++. The detection language can be presented in the form of text, image, etc. The Q&A stored in the Q&A database is generated from various documents related to the DSL, and can provide effective guidance for the mapping of the node.

[0102] In step S802, the lexical file of the DSL is split according to the rule description information and the detection language information to obtain at least one lexical segment, and the syntax file of the DSL is split to obtain at least one syntax segment.

[0103] Suppose the detection language is “java”. The rule generation system 100 can select the relevant lexicon used by the java language from the lexical file according to the detection language, that is, the lexical file of java. The rule generation system 100 can find the lexical identifier corresponding to the node keyword and the Q&A in the Q&A database from the lexical file of java based on the mode of the lexical of java. The rule generation system 100 can remove other lexicons except the lexicons related to the node keyword and the Q&A corresponding to the lexical identifier under the lexical identifier to obtain the lexical segment of the node keyword and the Q&A corresponding to the lexical identifier.

[0104] After obtaining the lexical identifier, the rule generation system 100 can detect, from bottom to top, which grammars in the grammar file involve the lexical identifier according to the lexical identifier, and retain the grammars involving the lexical identifier and eliminate the grammars not involving the lexical identifier. After obtaining the rule attribute, the rule generation system 100 can detect, from top to bottom, the attributes of each grammar in the grammar file according to the rule attribute, and retain the grammars meeting the rule attribute and eliminate the grammars not meeting the rule attribute. After obtaining the logical relationship, the rule generation system 100 can detect, according to the logical relationship, which grammars in the grammar file involve the logical relationship, and retain the grammars involving the logical relationship and eliminate the grammars not involving the logical relationship.

[0105] In step S803, the DSL rule is obtained according to the at least one lexical segment and the at least one grammar segment.

[0106] The rule generation system 100 can obtain a prompt template, and then write the at least one lexical segment and the at least one grammar segment into the prompt template to obtain input prompts including the lexical segment and the prompt template. The rule generation system 100 converts the presentation mode of the lexical segment and the prompt template into prompts suitable for the LLM, so that the lexical segment and the prompt template are input into the LLM, and the result output by the LLM is more accurate. The rule generation system 100 can input the input prompts including the lexical segment and the prompt template into the LLM to make the LLM generate the DSL rule. After obtaining the DSL rule, the rule generation system 100 can convert the DSL rule in the form of text into corresponding code, so that the DSL rule can be used as a plug-in to analyze the code to identify potential security risks in the code.

[0107] In the embodiments of the present application, the method can split the lexical file and the grammar file based on the rule description and the detection language of the DSL, and then use a large model such as the LLM to generate the DSL rule according to the split lexical segment and the grammar segment, so as to quickly customize the DSL checking rule and reduce the cost of developing the rule by the user. Compared with the related art, the method does not require the user to participate in the operation, can automatically generate the DSL rule, and does not need to spend a lot of time to learn QL, thereby improving the development efficiency of the rule.

[0108] A structural diagram of a rule generation device provided in an embodiment of the present application is shown in FIG. 1. The rule generation device can be divided into various units of a rule generation system 100 according to the execution function, such as a first processing unit 110, a second processing unit 120, a third processing unit 130, and a fourth processing unit 140. The rule generation device can be an application program, software code, or the like, deployed on a computing device or a computing device cluster composed of multiple computing devices for execution. The computing device can be a server, a computer, a portable notebook computer, a tablet computer, a smart phone, or the like. The rule generation device can be deployed on a cloud server. If the rule generation device is deployed on a cloud service, a designer can use a local device to call the cloud server to complete a corresponding task using the rule generation device. The rule generation device is implemented in the following process:

[0109] The first processing unit 110 is configured to receive rule description information, which is information of various constraint conditions of a domain-specific language (DSL) rule; the second processing unit 120 is configured to receive detection language information, which is a language name of a detection target code; the second processing unit 120 is configured to split a lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment; the third processing unit 130 is configured to split a syntax file of the DSL according to the rule description information and the detection language information to obtain at least one syntax segment; and the fourth processing unit 140 is configured to obtain the DSL rule according to the at least one lexical segment and the at least one syntax segment.

[0110] In an embodiment, the first processing unit 110 is further configured to perform keyword extraction on the rule description information to obtain a keyword set before splitting the lexical file of the DSL according to the rule description information and the detection language information to obtain the at least one lexical segment and splitting the syntax file of the DSL to obtain the at least one syntax segment; and perform analysis on the keyword set to obtain a node keyword, a rule attribute, and a logical relationship.

[0111] In an embodiment, the second processing unit 120 is specifically configured to split the lexical file of the DSL according to the detection language information, the node keyword, and a question and answer pair to obtain the at least one lexical segment and a lexical identifier corresponding to the at least one lexical segment.

[0112] In an embodiment, the third processing unit 130 is specifically configured to split the syntax file of the DSL according to the rule attribute, the logical relationship, and the lexical identifier corresponding to the at least one lexical segment to obtain the at least one syntax segment.

[0113] In an implementation, the fourth processing unit 140 is specifically configured to write the at least one lexical segment and the at least one syntax segment into the prompt template to obtain an input prompt; and input the input prompt into the large language model (LLM) to obtain the DSL rule.

[0114] The first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140 can be implemented by software or by hardware. For example, the implementation of the first processing unit 110 is described below. The implementation of the second processing unit 120, the third processing unit 130, and the fourth processing unit 140 can be similar to the implementation of the first processing unit 110.

[0115] As an example of a software functional unit, the first processing unit 110 can include code running on a computing instance. The computing instance can include at least one of a physical host (computing device), a virtual machine, and a container. Further, the computing instance can be one or more. For example, the first processing unit 110 can include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers running the code can be distributed in the same region, or in different regions. Further, the multiple hosts / virtual machines / containers running the code can be distributed in the same availability zone (AZ), or in different AZs, each AZ including one data center or multiple data centers in close geographical proximity. Generally, one region can include multiple AZs.

[0116] Similarly, the multiple hosts / virtual machines / containers running the code can be distributed in the same virtual private cloud (VPC), or in multiple VPCs. Generally, one VPC is set in one region, and communication between two VPCs in the same region, or between VPCs in different regions, requires a communication gateway in each VPC to realize the interconnection between VPCs.

[0117] As an example of a hardware functional unit, the first processing unit 110 can include at least one computing device, such as a server or the like. Alternatively, the first processing unit 110 can also be a device implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the like. The PLD can be implemented by a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0118] The plurality of computing devices included in the first processing unit 110 can be distributed in the same region or in different regions. The plurality of computing devices included in the first processing unit 110 can be distributed in the same AZ or in different AZs. Similarly, the plurality of computing devices included in the first processing unit 110 can be distributed in the same VPC or in multiple VPCs. The plurality of computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0119] It should be noted that in other embodiments, the first processing unit 110 can be configured to perform any step of the rule generation method, the second processing unit 120 can be configured to perform any step of the rule generation method, the third processing unit 130 can be configured to perform any step of the rule generation method, and the fourth processing unit 140 can be configured to perform any step of the rule generation method. The steps implemented by the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140 can be specified as needed, and the entire function of the rule generation device can be implemented by the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140 implementing different steps of the rule generation method.

[0120] FIG. 9 is a structural schematic diagram of a computing device provided in an embodiment of the present application. As shown in FIG. 9, the computing device 900 includes a bus 910, a processor 920, a memory 930, and a communication interface 940. The processor 920, the memory 930, and the communication interface 940 communicate with each other through the bus 910. The computing device 900 can be a server, a computer, a portable notebook, a cabinet, or the like. It should be understood that the number of processors and memories in the computing device 900 is not limited in the present application.

[0121] The bus 910 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, only one line is represented in FIG. 9, but it does not mean that there is only one bus or only one type of bus. The bus 910 can include a path for transmitting information between the components (e.g., the processor 920, the memory 930, the communication interface 940) of the computing device 900.

[0122] The processor 920 can be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0123] The memory 930 can include a volatile memory (e.g., a random access memory (RAM)) and / or a non-volatile memory (e.g., a read-only memory (ROM), a floppy disk, a hard disk, or a solid state drive (SSD)).

[0124] The memory 930 stores executable program codes, and the processor 920 executes the executable program codes to implement the functions of the aforementioned modules, such as the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140, respectively, thereby implementing the rule generation method. That is, the memory 930 stores instructions for executing the rule generation method.

[0125] Alternatively, the memory 930 stores executable program codes, and the processor 920 executes the executable program codes to implement the functions of the aforementioned modules, thereby implementing the rule generation method. That is, the memory 930 stores instructions for executing the rule generation method.

[0126] The communication interface 940 enables communication between the computing device 900 and other devices or communication networks using, for example, but not limited to, a transceiver module such as a network interface card, a transceiver, and the like.

[0127] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a notebook computer, or a smart phone.

[0128] As shown in FIG. 10, the computing device cluster includes at least one computing device 900. The memory 930 in one or more computing devices 900 in the computing device cluster can store the same instructions for performing the rule generation method.

[0129] In some possible implementations, the memory 930 in one or more computing devices 900 in the computing device cluster can also respectively store partial instructions for performing the rule generation method. In other words, the combination of one or more computing devices 900 can collectively execute the instructions for performing the rule generation method.

[0130] It should be noted that the memory 930 in different computing devices 900 in the computing device cluster can store different instructions for respectively performing part of the functions of the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140. That is, the instructions stored in the memory 930 in different computing devices 900 can implement the functions of one or more modules in the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140.

[0131] In some possible implementations, one or more computing devices in the computing device cluster can be connected through a network. The network can be a wide area network, a local area network, or the like. FIG. 11 shows one possible implementation. As shown in FIG. 11, two computing devices are connected through a network, which are computing device 900A and computing device 900B. Specifically, the computing devices are connected to the network through the communication interface in each computing device. In this type of possible implementation, the memory 930 in the computing device 900A stores instructions for performing the functions of part of the modules in the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140. Meanwhile, the memory 930 in the computing device 900B stores instructions for performing the functions of another part of the modules in the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140.

[0132] The connection between the computing device cluster shown in FIG. 11 can be that the rule generation method provided in the present application needs to store a large amount of data, and therefore it is considered to assign the functions implemented by another part of the modules in the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140 to the computing device 900B.

[0133] It should be understood that the functions of the computing device 900A shown in FIG. 11 can also be completed by multiple computing devices 900. Similarly, the functions of the computing device 900B can also be completed by multiple computing devices 900.

[0134] The present application also provides another computing device cluster. The connection between the computing devices in the computing device cluster can be similar to the connection of the computing device cluster described with reference to FIG. 9 and FIG. 10. The difference is that the memory 930 in one or more computing devices 900 in the computing device cluster can store the same instructions for executing the rule generation method.

[0135] In some possible implementations, the memory 930 in one or more computing devices 900 in the computing device cluster can also respectively store part of the instructions for executing the rule generation method. In other words, the combination of one or more computing devices 900 can collectively execute the instructions for executing the rule generation method.

[0136] It should be noted that the memory 930 in different computing devices 900 in the computing device cluster can store different instructions for executing part of the functions of the computing device 900. That is, the instructions stored in the memory 930 in different computing devices 900 can implement the functions of one or more modules of the first processing unit 110, the second processing unit 120, the third processing unit 130, and the fourth processing unit 140.

[0137] The present application also provides a computer program product containing instructions. The computer program product can be a software or program product containing instructions, which can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute the rule generation method.

[0138] The embodiments of the present application further provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can be used to store instructions that can be executed by a computing device, or a data center containing one or more available media or data storage devices. The available medium can be a magnetic medium, (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state hard disk), etc. The computer readable storage medium includes instructions that instruct the computing device to execute the rule generation method.

[0139] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A rule generation method characterized by, The method comprises the following steps: receiving rule description information and detection language information; the rule description information refers to information of various constraint conditions of a domain-specific language (DSL) rule; the detection language information refers to a language name of a target code to be detected; splitting a lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment, and splitting a syntax file of the DSL to obtain at least one syntax segment; obtaining the DSL rule according to the at least one lexical segment and the at least one syntax segment.

2. The method of claim 1, wherein, Before the step of splitting the lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment, and splitting the syntax file of the DSL to obtain at least one syntax segment, the method further comprises the following steps: extracting keywords from the rule description information to obtain a keyword set; analyzing the keyword set to obtain node keywords, rule attributes, and logical relationships.

3. The method of claim 2, wherein, The step of splitting the lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment, and splitting the syntax file of the DSL to obtain at least one syntax segment, specifically comprises the following steps: splitting the lexical file of the DSL according to the detection language information, the node keywords, and question and answer pairs to obtain the at least one lexical segment and a lexical identifier corresponding to the at least one lexical segment.

4. The method of claim 3, wherein, The step of splitting the lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment, and splitting the syntax file of the DSL to obtain at least one syntax segment, specifically comprises the following steps: splitting the syntax file of the DSL according to the rule attributes, the logical relationships, and the lexical identifier corresponding to the at least one lexical segment to obtain the at least one syntax segment.

5. The method according to any one of claims 1 to 4, characterized in that, The step of obtaining the DSL rule according to the at least one lexical segment and the at least one syntax segment, specifically comprises the following steps: writing the at least one lexical segment and the at least one syntax segment into a prompt template to obtain an input prompt; inputting the input prompt into a large language model (LLM) to obtain the DSL rule.

6. A rule generating apparatus characterized by comprising: The method comprises the following steps: a first processing unit is configured to receive rule description information, the rule description information referring to information of various constraint conditions of a domain-specific language (DSL) rule; a second processing unit is configured to receive detection language information, the detection language information referring to a language name of a target code to be detected; the second processing unit is configured to split a lexical file of the DSL according to the rule description information and the detection language information to obtain at least one lexical segment; a third processing unit is configured to split a syntax file of the DSL according to the rule description information and the detection language information to obtain at least one syntax segment; a fourth processing unit is configured to obtain the DSL rule according to the at least one lexical segment and the at least one syntax segment.

7. The apparatus of claim 6, wherein, before the first processing unit splits the lexical file of the DSL to obtain at least one lexical segment and splits the syntax file of the DSL to obtain at least one syntax segment according to the rule description information and the detected language information, the first processing unit is further configured to perform keyword extraction on the rule description information to obtain a keyword set; analyze the keyword set to obtain a node keyword, a rule attribute, and a logical relationship.

8. The apparatus of claim 7, wherein, the second processing unit is specifically configured to split the lexical file of the DSL to obtain the at least one lexical segment and a lexical identifier corresponding to the at least one lexical segment according to the detected language information, the node keyword, and a question and answer pair.

9. The apparatus of claim 8, wherein, the third processing unit is specifically configured to split the syntax file of the DSL to obtain the at least one syntax segment according to the rule attribute, the logical relationship, and the lexical identifier corresponding to the at least one lexical segment.

10. The apparatus of any one of claims 6-9, wherein, the fourth processing unit is specifically configured to write the at least one lexical segment and the at least one syntax segment into a prompt template to obtain an input prompt; and input the input prompt into a large language model (LLM) to obtain the DSL rule. comprise:

11. A cluster of computing devices, characterized in that, at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the method of any one of claims 1-5. ​

Images