The invention relates to the technical field of security development, and provides a code defect
analysis method, which is used for improving the code defect analysis efficiency and reducing the
workload of manual review. The method comprises the following steps: acquiring a code defect report and appeal data; extracting a first
feature structure from the
code snippet, and generating a composite
fingerprint based on the first
feature structure; when it is determined that no
fingerprint matched with the composite
fingerprint exists in a pre-stored composite fingerprint
library, in a pre-stored
feature structure library, determining a similar feature structure of which the similarity with the first feature structure meets a preset condition, and determining a first
false alarm probability of the
code snippet; analyzing the code defect report and the appeal data by using a pre-trained large
language model, and determining a second
false alarm probability of the code snippets and a rationality
score of the appeal data; and determining a defect
misinformation evaluation value of the
code snippet, and determining that the code
snippet does not have defects under the condition that the defect
misinformation evaluation value is greater than or equal to a first preset threshold value.