CN110737464A - A method and device for static analysis of code - Google Patents

Abstract

The invention discloses a code static analysis method, device, electronic device and computer-readable storage medium. The method includes: receiving code static analysis result data submitted by a user, and performing verification analysis; using blockchain technology, saving the verified code static analysis result data in a designated block of the blockchain; The chain technology distributes a certain amount of virtual currency corresponding to the code static analysis result data submitted to the account of the verified user. Through the technical solution, the user's interest in submitting code static analysis result data is improved. In addition, according to the code static analysis result data submitted by the user, the user's analysis feedback on the code static analysis tool is obtained, which is beneficial for the provider to grasp the operation of the code static analysis tool. The situation and the defects of the analysis rules are beneficial to the optimization of the code static analysis tool, through the user's experience of the code static analysis tool.

Description

A method and device for static analysis of code

technical field

The present invention relates to the field of computer technology, and in particular, to a code static analysis method, apparatus, electronic device and computer-readable storage medium.

Background technique

In the current computer technology, the realization of special computer software is inseparable from the program code. After the program code is completed, the method of static code analysis can be used to find structural errors, security loopholes and other problems in the code, so as to ensure the overall quality of the software. Under normal circumstances, users perform code static analysis through code static analysis tools. For code static analysis tool providers, after users use it, they generally do not provide feedback on the results of code static analysis and the situation of using the code static analysis. , so that the provider cannot grasp the operation of the code static analysis tool and the defects of the analysis rules, which is not conducive to the optimization of the code static analysis tool.

SUMMARY OF THE INVENTION

In view of the above problems, the present invention is proposed to provide a code static analysis method, apparatus, electronic device and computer readable storage medium that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for static analysis of code is provided, wherein the method includes:

Receive the code static analysis result data submitted by the user, and perform verification analysis;

Through the blockchain technology, the data of the static analysis result of the code that has passed the verification is saved in the designated block of the blockchain;

And, through the blockchain technology, a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user.

Optionally, the method further includes:

When receiving the user's permission exchange request, set the usage permission of the user's code static analysis according to the specified amount of virtual currency in the received permission exchange request;

Or, when receiving the user's designated currency exchange request, exchange the designated amount of virtual currency in the user's account into a certain amount of designated currency corresponding to the designated amount of virtual currency, and record the exchanged certain amount of designated currency. in the user's account.

Optionally, the code static analysis result data submitted by the user includes one or more of the following:

Analysis result data of code samples;

Analyzed code sample data;

Analysis rules code data for static analysis of code.

Optionally, the designated block of the blockchain includes a block for saving analysis rule codes for static analysis of codes, and a block for saving code samples;

The step of saving the verified code static analysis result data to the specified block of the blockchain includes:

When the verified code static analysis result data is the analyzed code sample data, write the analyzed code sample data as a new piece of data into the block where the code sample is stored in the blockchain; and/or,

When the verified code static analysis result data is the analysis rule code data used for code static analysis, the analysis rule code data used for code static analysis is written into the blockchain as a new piece of data and saved for code static analysis in the block of the analysis rule code.

Optionally, the designated block of the blockchain further includes saving the false positive rate and missed detection rate of the static analysis of the current code; the method further includes:

Obtain the false positive rate and missed detection rate of the new code static analysis after the code samples in the specified block of the blockchain are added, and/or obtain the newly written analysis rule code for code static analysis The false positive rate and missed detection rate of the new code static analysis after code static analysis;

The acquired false positive rate and missed detection rate of the new code static analysis are written as a new piece of data into the block of the blockchain that stores the false positive rate and missed detection rate of the static code analysis.

Optionally, receiving the code static analysis result data submitted by the user and performing the verification analysis includes:

Send the code static analysis result data submitted by the user to the verifier, so that the verifier can verify whether the code static analysis result data submitted by the user is valid;

receiving the verification result returned by the verification personnel;

When the received verification result is verified, the block chain technology is used to save the static analysis result data of the verified code to the designated block of the block chain.

Optionally, the verification result also includes the authority information of the verification personnel; the method further includes:

According to the authority information of the verifier, determine whether the verifier has the authority to write data into the designated block of the blockchain;

If it is judged to be yes, and when the received verification result is verified, the block chain technology is used to save the static analysis result data of the verified code to the designated block of the block chain.

Optionally, according to the authority information of the verifier, judging whether the verifier has the authority to write data to the specified block of the blockchain includes:

Use the authority management technology of the hosting platform github to set the authority of the verifier.

According to another aspect of the present invention, a code static analysis device is provided, wherein the device includes:

A receiving unit, adapted to receive the code static analysis result data submitted by the user, and perform verification analysis;

The storage unit is suitable for saving the data of the static analysis result of the code that has passed the verification to the designated block of the blockchain through the blockchain technology;

The distribution unit is suitable for distributing a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user's account through the blockchain technology.

Optionally, the device further includes:

The exchange unit is adapted to, when receiving the authorization exchange request from the user, set the usage authority of the static analysis of the code of the user according to the specified amount of virtual currency in the received authorization exchange request; or, when receiving the user's specification When a currency exchange request is made, the specified amount of virtual currency in the user's account is exchanged into a certain amount of specified currency corresponding to the specified amount of virtual currency, and the exchanged specified amount of specified currency is recorded in the user's account.

Optionally, the code static analysis result data submitted by the user includes one or more of the following:

Analysis result data of code samples;

Analyzed code sample data;

Analysis rules code data for static analysis of code.

Optionally, the designated block of the blockchain includes a block for saving analysis rule codes for static analysis of codes, and a block for saving code samples;

The storage unit is adapted to write the analyzed code sample data as a new piece of data into the area of the blockchain where the code samples are stored when the code static analysis result data that has passed the verification is the analyzed code sample data. and/or, when the code static analysis result data that has passed the verification is the analysis rule code data used for code static analysis, the analysis rule code data used for code static analysis is written into the blockchain as a new piece of data The block that holds the analysis rule code for static analysis of the code.

Optionally, the designated block of the blockchain also includes saving the false positive rate and missed detection rate of the static analysis of the current code;

The storage unit is further adapted to obtain the false positive rate and the missed detection rate of the new code static analysis after the code samples in the designated block of the blockchain are added, and/or obtain the newly written code. Based on the analysis rules of code static analysis, the false positive rate and missed detection rate of the new code static analysis after the code static analysis is performed; the obtained new code static analysis false positive rate and missed detection rate are written as a new piece of data into the block of the blockchain that saves the false positive rate and missed detection rate of the static analysis of the code.

Optionally,

The receiving unit is adapted to send the code static analysis result data submitted by the user to the verifier, so that the verifier can verify whether the code static analysis result data submitted by the user is valid; and receive the verification result returned by the verifier;

The storage unit is adapted to, when the received verification result is verified, and then execute the step of using the blockchain technology to save the verified code static analysis result data in the designated block of the blockchain.

Optionally, the verification result also includes authority information of the verification personnel;

The storage unit is adapted to judge whether the verifier has the authority to write data into the designated block of the blockchain according to the authority information of the verifier; The verification result is that when the verification is passed, the block chain technology is used to save the static analysis result data of the code that passed the verification to the designated block of the block chain.

Optionally,

The storage unit is suitable for setting the authority of the verification personnel by using the authority management technology of the hosting platform github.

According to yet another aspect of the present invention, an electronic device is provided, wherein the electronic device includes:

processor; and,

A memory arranged to store computer-executable instructions which, when executed, cause the processor to perform a method according to the foregoing.

According to yet another aspect of the present invention, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs that, when executed by a processor, implement the foregoing Methods.

According to the technical scheme of the present invention, the code static analysis result data submitted by the user is received, and the verification analysis is performed; through the blockchain technology, the verified code static analysis result data is saved in the designated block of the blockchain; and, Through blockchain technology, a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user. Through this technical solution, since a certain amount of virtual currency can be obtained, the interest of the user in submitting the code static analysis result data will be increased. In addition, according to the code static analysis result data submitted by the user, the user's analysis feedback on the code static analysis tool can be obtained. It is helpful for the provider to grasp the running status of the static code analysis tool and the defects of the analysis rules, which in turn is conducive to the optimization of the static code analysis tool, through the user's experience of using the static code analysis tool.

The above description is only an overview of the technical solutions of the present invention, in order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand , the following specific embodiments of the present invention are given.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

1 shows a schematic flowchart of a code static analysis method according to an embodiment of the present invention;

2 shows a schematic structural diagram of a code static analysis device according to an embodiment of the present invention;

FIG. 3 shows a schematic structural diagram of an electronic device according to an embodiment of the present invention;

FIG. 4 shows a schematic structural diagram of a computer-readable storage medium according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

FIG. 1 shows a schematic flowchart of a code static analysis method according to an embodiment of the present invention. As shown in Figure 1, the method includes:

Step S110: Receive the code static analysis result data submitted by the user, and perform verification analysis.

Based on the technical solution, in order to obtain virtual currency, the user will actively feed back the code static analysis result data. However, in order to exclude some invalid code static analysis result data submitted by the user, after receiving the code static analysis result data submitted by the user, it is also necessary to perform verification analysis on the code static analysis result data submitted by the user.

In step S120, the data of the static analysis result of the code that has passed the verification is stored in a designated block of the blockchain through the blockchain technology.

After the code static analysis result data submitted by the user passes the verification, the saving operation will be performed.

For blockchain technology, in a narrow sense, it is a chain data structure that combines data blocks in sequential order according to time sequence, and cryptographically guarantees an untamperable and unforgeable distribution. ledger. Broadly speaking, it uses a block chain data structure to verify and store data, uses distributed node consensus algorithms to generate and update data, uses cryptography to ensure the security of data transmission and access, and uses automated script codes. A new distributed infrastructure and computing method that uses smart contracts to program and manipulate data. Blockchain technology has the characteristics of immutability and traceability. Modifications to the database by a single or even multiple nodes cannot affect the databases of other nodes, unless more than 51% of the nodes in the entire network can be controlled to modify at the same time, which is almost impossible. Each transaction in the blockchain is linked to two adjacent blocks by cryptographic methods, so it can be traced back to the past and present of any transaction.

In this embodiment, the operation of saving is implemented through blockchain technology, in order to prevent the data of the static analysis result of the code submitted by the user from being arbitrarily tampered with, so as to avoid affecting the realization of the purpose of saving the data of the static analysis result of the code, and affecting the static analysis of the code. Optimization of analysis tools. Specifically, the code static analysis result data that has passed the verification is stored in the designated block of the blockchain.

In step S130, a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user through the blockchain technology.

In order to improve the user's enthusiasm for submitting code static analysis result data, after the verification is passed, a certain amount of virtual currency is distributed to the corresponding user's account, and the user can use the virtual currency to complete the corresponding operation or business.

In the prior art, the static code analysis tool will inevitably have false positives and missed tests. In order to optimize the code static analysis tool, it is necessary to check the static code analysis tool according to the results of the code static analysis tool. defects for optimization. However, in the prior art, after the user uses the code static analysis tool, considering the privacy of the program code or other considerations, no feedback of the code static analysis result data will be performed, and the provider cannot follow the actual operation of the code static analysis tool. Situational troubleshooting, which brings certain difficulties to the optimization of code static analysis tools.

Through the technical solution of this embodiment, since a certain amount of virtual currency can be obtained, the user's interest in submitting the code static analysis result data will be increased. In addition, according to the code static analysis result data submitted by the user, the user's analysis of the code static analysis tool can be obtained. Feedback is helpful for the provider to grasp the operation of the static code analysis tool and the defects of the analysis rules, which in turn is conducive to the optimization of the static code analysis tool through the user's experience of using the static code analysis tool.

In one embodiment of the present invention, step S130 of the method shown in FIG. 1 distributes a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user's account to the account of the user who has passed the verification, including: setting a preset distribution rule; A certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user according to the preset distribution rule.

The types of code static analysis result data submitted by users are different, and the degree of effectiveness is different. Therefore, this embodiment generally presets a distribution rule, and the preset distribution rule specifies that different types of code static analysis result data correspond to the application. The amount of virtual currency to be distributed; and/or the amount of virtual currency that should be distributed for different degrees of effectiveness.

In one embodiment of the present invention, the method shown in FIG. 1 further includes: when a user's permission exchange request is received, setting the user's code static according to the specified amount of virtual currency in the received permission exchange request Or, when receiving the user's specified currency exchange request, exchange the specified amount of virtual currency in the user's account into a certain amount of specified currency corresponding to the specified amount of virtual currency, and the exchange will be a certain amount of currency. The amount of the specified currency is recorded in the user's account.

In this embodiment, the user can use the obtained use rights of the virtual currency exchange code static analysis tool, and different amounts of virtual currency correspond to different use rights; or, exchange the obtained virtual currency into other designated currencies, for example, Q coins , Weibo, Chivalry Yuanbao, Wen Yin, etc., so that users can use the designated currency for exchange, which can further increase the user's interest in submitting code static analysis result data.

In one embodiment of the present invention, the method shown in FIG. 1 further includes: when a designated member exchange request from a user is received, exchanging a designated amount of virtual currency in the user's account into a virtual currency corresponding to the designated amount Member usage rights for a specified application for a certain period of time.

For example, exchange virtual currency for members of Tencent Video, members of iQiyi Video, etc.

In an embodiment of the present invention, before the above-mentioned exchange is performed, the method shown in FIG. 1 further includes: judging whether the amount of virtual currency in the user's account is greater than or equal to the specified amount of virtual currency in the exchange request; If it is yes, execute the exchange request; if it is judged to be no, send a notification that the amount of virtual currency is insufficient to the user.

In an embodiment of the present invention, the code static analysis result data submitted by the user in the method shown in FIG. 1 includes one or more of the following: analysis result data of code samples; analyzed code sample data; Analysis rules code data for code static analysis.

In the optimization of code static analysis tools, the required data can be the analysis results of code samples to judge the false positives or missed tests of code static analysis; it can also be the analyzed code sample data, due to the false positive rate or missed testing. The test rate requires the support of a large number of code samples. According to the code sample data submitted by the user, the false positive rate or missed test rate can be obtained; considering that the false positive or missed test may be caused by the defects of the analysis rule code, the user can master it according to his own. Complete a better version of the analysis rule code for code static analysis and submit the code data, that is, users can also provide their own modification solutions for the optimization of code static analysis tools.

Because the validity of the code static analysis result data submitted by the user is different, for example, in the above-mentioned types of code static analysis result data submitted by the user, the validity degree from small to large is: code sample analysis result data; Code sample data; analysis rule code data for code static analysis. Therefore, when distributing virtual currency, the amount of virtual currency corresponding to the analysis result data of the code sample that has passed the verification is smaller than the amount of virtual currency corresponding to the analyzed code sample data that has passed the verification; the virtual currency corresponding to the analyzed code sample data that has passed the verification The amount of currency should be smaller than the amount of virtual currency corresponding to the code data of the analysis rule code for static analysis of the code that has passed the verification.

In one embodiment of the present invention, the designated block of the blockchain in the method shown in FIG. 1 includes a block for saving analysis rule codes for code static analysis and a block for saving code samples. That is to say, the details of each analysis rule of the code static analysis tool are stored in the blockchain, that is, the analysis rule code for code static analysis corresponding to each analysis rule.

Then, it needs to be stored correspondingly when saving. In step S120 of the method shown in FIG. 1, saving the verified code static analysis result data to the designated block of the blockchain includes: when the verified code static analysis result When the data is the analyzed code sample data, write the analyzed code sample data as a new piece of data into the block where the code sample is stored in the blockchain; and/or, when the code static analysis result passes the verification The data is the analysis rule code data used for code static analysis, and the analysis rule code data used for code static analysis is written as a new piece of data into the block where the analysis rule code used for code static analysis is stored in the blockchain .

In this embodiment, different code static analysis result data will be stored in corresponding blocks. Considering that a code static analysis tool has different analysis rules, the code static analysis result data corresponding to different analysis rules will be Save it corresponding to the corresponding analysis rule.

Further, the designated block of the blockchain also includes saving the false positive rate and the missed detection rate of the static analysis of the current code, that is to say, the false positive rate and the missed detection rate corresponding to each analysis rule are stored in the blockchain.

The method shown in FIG. 1 further includes: acquiring the false positive rate and the missing detection rate of the static analysis of the new code after the code samples in the specified block of the blockchain are added, and/or, acquiring the newly written code for Analysis rules of code static analysis The false positive rate and missed detection rate of the new code static analysis after the code is statically analyzed; write the acquired new code static analysis false positive rate and missed detection rate as a new piece of data The blockchain saves the false positive rate and missed detection rate of the static analysis of the code in the block.

The false positive rate and missed detection rate stored in the blockchain need to be updated in real time, especially, when new analyzed code sample data is written, and/or, there is new analysis rule code for code static analysis After the data is written, it will affect the false alarm rate and missed detection rate. It is necessary to obtain a new false alarm rate and missed detection rate, and write the new false positive rate and missed detection rate as a new piece of data into the blockchain for storage. In the block of the false positive rate and the missed detection rate of the static analysis of the code.

It should be noted that because the blockchain technology has the characteristics of non-tampering and traceability, when writing data into a block, it is written as a new piece of data, so that according to the storage of data in the block It is also possible to obtain the historical changes or historical operations of a certain corresponding information, for example, what changes have been made to the analysis rule code used for code static analysis, or the false positive rate and missed detection rate of code static analysis tools trends, etc.

In an embodiment of the present invention, in step S110 shown in FIG. 1 , receiving the code static analysis result data submitted by the user, and performing the verification analysis includes: performing the code static analysis result data submitted by the user according to a preset verification rule. verify.

The validation rules here can be set according to requirements to determine whether the code static analysis result data submitted by the user is valid, or whether the expected effect is achieved.

In an embodiment of the present invention, receiving the code static analysis result data submitted by the user in step S110 shown in FIG. 1 and performing the verification analysis includes: sending the code static analysis result data submitted by the user to the verification personnel, so that The verifier verifies whether the code static analysis result data submitted by the user is valid; receives the verification result returned by the verifier; when the received verification result is verified, the block chain technology is executed again, and the verified code static analysis result data Steps in the specified block to save to the blockchain.

In this embodiment, the verification and analysis of the code static analysis result data submitted by the user is done manually, so that the code static analysis result data submitted by the user can be comprehensively verified from a manual perspective. After the verification is over, the verifier will return the corresponding verification result, such as the verification passed or the verification failed. Because the code static analysis result data saved in the blockchain needs to play a certain role, only the code static analysis result data that has passed the verification will be saved in the designated block of the blockchain.

Further, the verification result in the above also includes the authority information of the verifier; the method shown in FIG. 1 further includes: according to the authority information of the verifier, judging whether the verifier has written in the designated block of the blockchain Permission of data; if it is judged to be yes, and when the received verification result is verified, then execute the steps of using blockchain technology to save the static analysis result data of the verified code to the designated block of the blockchain .

Taking into account the security of the blockchain, the write operation to the blockchain can only be performed with the write permission, because the write operation in this technical solution is automatically completed, then the permission setting and verification It is placed on the verification of verifiers, that is, to set the corresponding operation permissions for the verifiers, such as the permission to read data, the permission to write data, the permission to write and read.

Because it is necessary to save the verified code static analysis result data in a designated block of the blockchain, in this embodiment, it is only verified whether the verification personnel have the authority to write data. Only when the verification is passed and the result of the verification is returned by a verifier with permission to write data, the blockchain technology will be executed, and the static analysis result data of the code that has passed the verification will be saved to the designated area of the blockchain. steps in a block.

Preferably, according to the authority information of the verifier, determining whether the verifier has the authority to write data into the designated block of the blockchain includes: using the authority management technology of the hosting platform github to set the authority of the verifier.

In this embodiment, the authority of the verifier is set and the authority of the verifier is managed through the authority management technology of the hosting platform github. github is a hosting platform for open source and private software projects, because it only supports git as the only repository format for hosting, hence the name github.

FIG. 2 shows a schematic structural diagram of a code static analysis apparatus according to an embodiment of the present invention. As shown in FIG. 2, the code static analysis device 200 includes:

The receiving unit 210 is adapted to receive the code static analysis result data submitted by the user, and perform verification analysis.

Based on the technical solution, in order to obtain virtual currency, the user will actively feed back the code static analysis result data. However, in order to exclude some invalid code static analysis result data submitted by the user, after receiving the code static analysis result data submitted by the user, it is also necessary to perform verification analysis on the code static analysis result data submitted by the user.

The saving unit 220 is adapted to save the verified code static analysis result data in a designated block of the blockchain through the blockchain technology.

After the code static analysis result data submitted by the user passes the verification, the saving operation will be performed.

For blockchain technology, in a narrow sense, it is a chain data structure that combines data blocks in sequential order according to time sequence, and cryptographically guarantees an untamperable and unforgeable distribution. ledger. Broadly speaking, it uses a block chain data structure to verify and store data, uses distributed node consensus algorithms to generate and update data, uses cryptography to ensure the security of data transmission and access, and uses automated script codes. A new distributed infrastructure and computing method that uses smart contracts to program and manipulate data. Blockchain technology has the characteristics of immutability and traceability. Modifications to the database by a single or even multiple nodes cannot affect the databases of other nodes, unless more than 51% of the nodes in the entire network can be controlled to modify at the same time, which is almost impossible. Each transaction in the blockchain is linked to two adjacent blocks by cryptographic methods, so it can be traced back to the past and present of any transaction.

In this embodiment, the operation of saving is implemented through blockchain technology, in order to prevent the data of the static analysis result of the code submitted by the user from being arbitrarily tampered with, so as to avoid affecting the realization of the purpose of saving the data of the static analysis result of the code, and affecting the static analysis of the code. Optimization of analysis tools. Specifically, the code static analysis result data that has passed the verification is stored in the designated block of the blockchain.

The distribution unit 230 is adapted to distribute a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user to the account of the verified user through the blockchain technology.

In order to improve the user's enthusiasm for submitting code static analysis result data, after the verification is passed, a certain amount of virtual currency is distributed to the corresponding user's account, and the user can use the virtual currency to complete the corresponding operation or business.

In the prior art, the static code analysis tool will inevitably have false positives and missed tests. In order to optimize the code static analysis tool, it is necessary to check the static code analysis tool according to the results of the code static analysis tool. defects for optimization. However, in the prior art, after the user uses the code static analysis tool, considering the privacy of the program code or other considerations, no feedback of the code static analysis result data will be performed, and the provider cannot follow the actual operation of the code static analysis tool. Situational troubleshooting, which brings certain difficulties to the optimization of code static analysis tools.

Through the technical solution of this embodiment, since a certain amount of virtual currency can be obtained, the user's interest in submitting the code static analysis result data will be increased. In addition, according to the code static analysis result data submitted by the user, the user's analysis of the code static analysis tool can be obtained. Feedback is helpful for the provider to grasp the operation of the static code analysis tool and the defects of the analysis rules, which in turn is conducive to the optimization of the static code analysis tool through the user's experience of using the static code analysis tool.

In an embodiment of the present invention, the distribution unit 230 of the apparatus shown in FIG. 2 is adapted to set a preset distribution rule; distribute the code static analysis result data submitted by the user to the account of the verified user according to the preset distribution rule Corresponding to a certain amount of virtual currency.

The types of code static analysis result data submitted by users are different, and the degree of effectiveness is different. Therefore, this embodiment generally presets a distribution rule, and the preset distribution rule specifies that different types of code static analysis result data correspond to the application. The amount of virtual currency to be distributed; and/or the amount of virtual currency that should be distributed for different degrees of effectiveness.

In one embodiment of the present invention, the apparatus shown in FIG. 2 further includes:

The exchange unit is adapted to, when receiving the authorization exchange request from the user, set the usage authority of the static analysis of the code of the user according to the specified amount of virtual currency in the received authorization exchange request; or, when receiving the user's specification When a currency exchange request is made, the specified amount of virtual currency in the user's account is exchanged into a certain amount of specified currency corresponding to the specified amount of virtual currency, and the exchanged specified amount of specified currency is recorded in the user's account.

In this embodiment, the user can use the obtained use rights of the virtual currency exchange code static analysis tool, and different amounts of virtual currency correspond to different use rights; or, exchange the obtained virtual currency into other designated currencies, for example, Q coins , Weibo, Chivalry Yuanbao, Wen Yin, etc., so that users can use the designated currency for exchange, which can further increase the user's interest in submitting code static analysis result data.

In an embodiment of the present invention, the above-mentioned exchange unit is further adapted to exchange a specified amount of virtual currency in the user's account into a specified amount corresponding to the specified amount of virtual currency when receiving a specified member exchange request from the user. Membership access to the app for a certain period of time.

For example, exchange virtual currency for members of Tencent Video, members of iQiyi Video, etc.

In an embodiment of the present invention, before the above-mentioned exchange is performed, the exchange unit is further adapted to determine whether the amount of virtual currency in the user's account is greater than or equal to the specified amount of virtual currency in the exchange request; if the determination is yes, Execute the exchange request; if the judgment is no, send a notification to the user that the amount of virtual currency is insufficient.

In an embodiment of the present invention, the above-mentioned code static analysis result data submitted by the user includes one or more of the following: analysis result data of code samples; analyzed code sample data; analysis rules for code static analysis code data.

In the optimization of code static analysis tools, the required data can be the analysis results of code samples to judge the false positives or missed tests of code static analysis; it can also be the analyzed code sample data, due to the false positive rate or missed testing. The test rate requires the support of a large number of code samples. According to the code sample data submitted by the user, the false positive rate or missed test rate can be obtained; considering that the false positive or missed test may be caused by the defects of the analysis rule code, the user can master it according to his own. Complete a better version of the analysis rule code for code static analysis and submit the code data, that is, users can also provide their own modification solutions for the optimization of code static analysis tools.

Because the validity of the code static analysis result data submitted by the user is different, for example, in the above-mentioned types of code static analysis result data submitted by the user, the validity degree from small to large is: code sample analysis result data; Code sample data; analysis rule code data for code static analysis. Therefore, when distributing virtual currency, the amount of virtual currency corresponding to the analysis result data of the code sample that has passed the verification is smaller than the amount of virtual currency corresponding to the analyzed code sample data that has passed the verification; the virtual currency corresponding to the analyzed code sample data that has passed the verification The amount of currency should be smaller than the amount of virtual currency corresponding to the code data of the analysis rule code for static analysis of the code that has passed the verification.

In an embodiment of the present invention, the designated block of the above-mentioned blockchain includes a block for storing analysis rule codes for static analysis of codes, and a block for storing code samples. That is to say, the details of each analysis rule of the code static analysis tool are stored in the blockchain, that is, the analysis rule code for code static analysis corresponding to each analysis rule.

The saving unit 220 shown in FIG. 2 is adapted to write the analyzed code sample data as a new piece of data into the saved data of the blockchain when the code static analysis result data that has passed the verification is the analyzed code sample data. In the block of the code sample; and/or, when the code static analysis result data that has passed the verification is the analysis rule code data used for the code static analysis, the analysis rule code data used for the code static analysis is written as a new piece of data into the block of the blockchain that holds the analysis rule code for static analysis of the code.

In this embodiment, different code static analysis result data will be stored in corresponding blocks. Considering that a code static analysis tool has different analysis rules, the code static analysis result data corresponding to different analysis rules will be It is saved corresponding to the corresponding analysis rule.

Further, the designated block of the blockchain also includes saving the false positive rate and the missed detection rate of the static analysis of the current code, that is to say, the false positive rate and the missed detection rate corresponding to each analysis rule are stored in the blockchain.

The storage unit 220 shown in FIG. 2 is further adapted to obtain the false positive rate and the missed detection rate of the new code static analysis after the code samples in the specified block of the blockchain are added, and/or obtain the newly written code The analysis rules used for code static analysis are the false positive rate and missed detection rate of the new code static analysis after the code is statically analyzed; The data is written into the block of the blockchain that saves the false positive rate and missed detection rate of static analysis of the code.

The false positive rate and missed detection rate stored in the blockchain need to be updated in real time, especially, when new analyzed code sample data is written, and/or, there is new analysis rule code for code static analysis After the data is written, it will affect the false alarm rate and missed detection rate. It is necessary to obtain a new false alarm rate and missed detection rate, and write the new false positive rate and missed detection rate as a new piece of data into the blockchain for storage. In the block of the false positive rate and the missed detection rate of the static analysis of the code.

It should be noted that because the blockchain technology has the characteristics of non-tampering and traceability, when writing data into a block, it is written as a new piece of data, so that according to the storage of data in the block It is also possible to obtain the historical changes or historical operations of a certain corresponding information, for example, what changes have been made to the analysis rule code used for code static analysis, or the false positive rate and missed detection rate of code static analysis tools trend, etc.

In an embodiment of the present invention, the receiving unit 210 shown in FIG. 2 is adapted to receive the code static analysis result data submitted by the user, and performing the verification analysis includes: performing the code static analysis result submitted by the user according to a preset verification rule. data is verified.

The validation rules here can be set according to requirements to determine whether the code static analysis result data submitted by the user is valid, or whether the expected effect is achieved.

In one embodiment of the present invention, the receiving unit 210 shown in FIG. 2 is adapted to send the code static analysis result data submitted by the user to the verification personnel, so that the verification personnel can verify whether the code static analysis result data submitted by the user is valid; Receive the verification result returned by the verifier;

The storage unit is adapted to perform the step of using the blockchain technology to save the data of the static analysis result of the code that has passed the verification to a designated block of the blockchain when the received verification result is verified.

In this embodiment, the verification and analysis of the code static analysis result data submitted by the user is done manually, so that the code static analysis result data submitted by the user can be comprehensively verified from a manual perspective. After the verification is over, the verifier will return the corresponding verification result, such as the verification passed or the verification failed. Because the code static analysis result data saved in the blockchain needs to play a certain role, only the code static analysis result data that has passed the verification will be saved in the designated block of the blockchain.

Further, the verification result in the above also includes the authority information of the verification personnel.

The storage unit 220 shown in FIG. 2 is suitable for judging whether the verifier has the authority to write data into the designated block of the blockchain according to the authority information of the verifier; if the judgment is yes, and when the received verification result When the verification is passed, the block chain technology is used to save the static analysis result data of the code that passed the verification to the designated block of the block chain.

Taking into account the security of the blockchain, the write operation to the blockchain can only be performed with the write permission, because the write operation in this technical solution is automatically completed, then the permission setting and verification It is placed on the verification of verifiers, that is, to set the corresponding operation permissions for the verifiers, such as the permission to read data, the permission to write data, the permission to write and read.

Because it is necessary to save the verified code static analysis result data in a designated block of the blockchain, in this embodiment, it is only verified whether the verification personnel have the authority to write data. Only when the verification is passed and the result of the verification is returned by a verifier with permission to write data, the blockchain technology will be executed, and the static analysis result data of the code that has passed the verification will be saved to the designated area of the blockchain. steps in a block.

Preferably, the above-mentioned saving unit 220 is suitable for setting the authority of the verification personnel by using the authority management technology of the hosting platform github.

In this embodiment, the authority of the verifier is set and the authority of the verifier is managed through the authority management technology of the hosting platform github. github is a hosting platform for open source and private software projects, because it only supports git as the only repository format for hosting, hence the name github.

Preferably, the code static analysis apparatus shown in FIG. 2 is used in a code static analysis tool.

In this way, the use, feedback, saving, improvement, and rewards of code static analysis tools are unified into code static analysis tools, which not only allows users to use high-precision code static analysis tools, but also realizes the continuous improvement of the running mechanism of code static analysis tools. Effect.

To sum up, according to the technical solution of the present invention, the code static analysis result data submitted by the user is received, and the verification analysis is performed; through the blockchain technology, the verified code static analysis result data is saved to the designated area of the blockchain and, through the blockchain technology, a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user. Through this technical solution, since a certain amount of virtual currency can be obtained, the interest of the user in submitting the code static analysis result data will be increased. In addition, according to the code static analysis result data submitted by the user, the user's analysis feedback on the code static analysis tool can be obtained. It is helpful for the provider to grasp the running status of the static code analysis tool and the defects of the analysis rules, which in turn is conducive to the optimization of the static code analysis tool, through the user's experience of using the static code analysis tool.

It should be noted:

The algorithms and displays provided herein are not inherently related to any particular computer, virtual appliance, or other device. Various general-purpose devices can also be used with the teachings based on this. The structure required to construct such a device is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be construed as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all of the code static analysis apparatus, electronic device, and computer-readable storage medium according to the embodiments of the present invention Some or all of the functionality of the component. The present invention can also be implemented as apparatus or apparatus programs (eg, computer programs and computer program products) for performing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such signals may be downloaded from Internet sites, or provided on carrier signals, or in any other form.

For example, FIG. 3 shows a schematic structural diagram of an electronic device according to an embodiment of the present invention. The electronic device 300 conventionally includes a processor 310 and a memory 320 arranged to store computer-executable instructions (program code). The memory 320 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. Memory 320 has storage space 330 for storing program code 340 for performing any of the method steps shown in FIG. 1 and in various embodiments. For example, storage space 330 for program code may include various program codes 340 for implementing various steps in the above methods, respectively. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically, for example, computer readable storage medium 400 as depicted in FIG. 4 . The computer-readable storage medium 400 may have storage segments, storage spaces, etc. arranged similarly to the memory 320 in the electronic device of FIG. 3 . The program code may, for example, be compressed in a suitable form. Typically, the memory unit stores program code 410 for carrying out the method steps according to the invention, ie program code readable by a processor such as 310, which, when run by an electronic device, causes the electronic device to execute the program code 410 the various steps in the method described above.

It should be noted that the above-described embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order. These words can be interpreted as names.

The present invention discloses A1, a code static analysis method, wherein the method includes:

Receive the code static analysis result data submitted by the user, and perform verification analysis;

Through the blockchain technology, the data of the static analysis result of the code that has passed the verification is saved in the designated block of the blockchain;

And, through the blockchain technology, a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user is distributed to the account of the verified user.

A2. The method of A1, wherein the method further comprises:

When receiving the user's permission exchange request, set the usage permission of the user's code static analysis according to the specified amount of virtual currency in the received permission exchange request;

Or, when receiving the user's designated currency exchange request, exchange the designated amount of virtual currency in the user's account into a certain amount of designated currency corresponding to the designated amount of virtual currency, and record the exchanged certain amount of designated currency. in the user's account.

A3. The method of A1, wherein the code static analysis result data submitted by the user includes one or more of the following:

Analysis result data of code samples;

Analyzed code sample data;

Analysis rules code data for static analysis of code.

A4. The method of A1, wherein the designated block of the blockchain includes a block for saving analysis rule codes for static analysis of codes, and a block for saving code samples;

The step of saving the verified code static analysis result data to the specified block of the blockchain includes:

When the verified code static analysis result data is the analyzed code sample data, write the analyzed code sample data as a new piece of data into the block where the code sample is stored in the blockchain; and/or,

When the verified code static analysis result data is the analysis rule code data used for code static analysis, the analysis rule code data used for code static analysis is written into the blockchain as a new piece of data and saved for code static analysis in the block of the analysis rule code.

A5. The method according to A4, wherein the designated block of the blockchain further includes saving the false positive rate and the missed detection rate of the static analysis of the current code; the method further includes:

Obtain the false positive rate and missed detection rate of the new code static analysis after the code samples in the specified block of the blockchain are added, and/or obtain the newly written analysis rule code for code static analysis The false positive rate and missed detection rate of the new code static analysis after code static analysis;

The acquired false positive rate and missed detection rate of the new code static analysis are written as a new piece of data into the block of the blockchain that stores the false positive rate and missed detection rate of the static code analysis.

A6. The method according to A1, wherein the receiving the code static analysis result data submitted by the user and performing the verification analysis include:

Send the code static analysis result data submitted by the user to the verifier, so that the verifier can verify whether the code static analysis result data submitted by the user is valid;

receiving the verification result returned by the verification personnel;

When the received verification result is verified, the block chain technology is used to save the static analysis result data of the verified code to the designated block of the block chain.

A7. The method according to A6, wherein the verification result further includes the authority information of the verification personnel; the method further includes:

According to the authority information of the verifier, determine whether the verifier has the authority to write data into the designated block of the blockchain;

If it is judged to be yes, and when the received verification result is verified, the block chain technology is used to save the static analysis result data of the verified code to the designated block of the block chain.

A8. The method according to A7, wherein, according to the authority information of the verifier, judging whether the verifier has the authority to write data into the designated block of the blockchain includes:

Use the authority management technology of the hosting platform github to set the authority of the verifier.

The invention also discloses B9, a code static analysis device, wherein the device includes:

A receiving unit, adapted to receive the code static analysis result data submitted by the user, and perform verification analysis;

The storage unit is suitable for saving the data of the static analysis result of the code that has passed the verification to the designated block of the blockchain through the blockchain technology;

The distribution unit is suitable for distributing a certain amount of virtual currency corresponding to the code static analysis result data submitted by the verified user's account through the blockchain technology.

B10. The device of B9, wherein the device further comprises:

The exchange unit is adapted to, when receiving the authorization exchange request from the user, set the usage authority of the static analysis of the code of the user according to the specified amount of virtual currency in the received authorization exchange request; or, when receiving the user's specification When a currency exchange request is made, the specified amount of virtual currency in the user's account is exchanged into a certain amount of specified currency corresponding to the specified amount of virtual currency, and the exchanged specified amount of specified currency is recorded in the user's account.

B11. The apparatus according to B9, wherein the code static analysis result data submitted by the user includes one or more of the following:

Analysis result data of code samples;

Analyzed code sample data;

Analysis rules code data for static analysis of code.

B12. The device according to B9, wherein the designated block of the blockchain includes a block for saving analysis rule codes for static analysis of codes, and a block for saving code samples;

The storage unit is adapted to write the analyzed code sample data as a new piece of data into the area of the blockchain where the code samples are stored when the code static analysis result data that has passed the verification is the analyzed code sample data. and/or, when the code static analysis result data that has passed the verification is the analysis rule code data used for code static analysis, the analysis rule code data used for code static analysis is written into the blockchain as a new piece of data The block that holds the analysis rule code for static analysis of the code.

B13. The device according to B12, wherein the specified block of the blockchain further includes storing the false positive rate and the missed detection rate of the static analysis of the current code;

The storage unit is further adapted to obtain the false positive rate and the missed detection rate of the new code static analysis after the code samples in the designated block of the blockchain are added, and/or obtain the newly written code. Based on the analysis rules of code static analysis, the false positive rate and missed detection rate of the new code static analysis after the code static analysis is performed; the obtained new code static analysis false positive rate and missed detection rate are written as a new piece of data into the block of the blockchain that saves the false positive rate and missed detection rate of the static analysis of the code.

B14. The device of B9, wherein,

The receiving unit is adapted to send the code static analysis result data submitted by the user to the verifier, so that the verifier can verify whether the code static analysis result data submitted by the user is valid; and receive the verification result returned by the verifier;

The storage unit is adapted to, when the received verification result is verified, and then execute the step of using the blockchain technology to save the verified code static analysis result data in the designated block of the blockchain.

B15. The device according to B14, wherein the verification result further includes authority information of the verification personnel;

The storage unit is adapted to judge whether the verifier has the authority to write data into the designated block of the blockchain according to the authority information of the verifier; The verification result is that when the verification is passed, the block chain technology is used to save the static analysis result data of the code that passed the verification to the designated block of the block chain.

B16. The device of B15, wherein,

The storage unit is suitable for setting the authority of the verification personnel by using the authority management technology of the hosting platform github.

The present invention also discloses C17, an electronic device, wherein the electronic device includes:

processor; and,

A memory arranged to store computer-executable instructions which, when executed, cause the processor to perform a method according to any of A1-A8.

The present invention also discloses D18, a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs, when executed by the processor, implement the steps in A1 to A8. The method of any one.

Claims (10)

1, code static analysis method, wherein the method comprises:

receiving code static analysis result data submitted by a user, and performing verification analysis;

through a block chain technology, storing the code static analysis result data passing the verification into a specified block of a block chain;

and distributing a certain amount of virtual currency corresponding to the submitted code static analysis result data to the account of the user passing the verification through the blockchain technology.

2. The method of claim 1, wherein the method further includes:

when an authority exchange request of a user is received, setting the use authority of the code static analysis of the user according to the specified amount of the virtual currency in the received authority exchange request;

alternatively, when a specified currency conversion request from the user is received, the specified amount of virtual currency in the account of the user is converted into specified amounts of currency corresponding to the specified amount of virtual currency, and the converted specified amounts of currency are recorded in the account of the user.

3. The method of claim 1, wherein the user-submitted code static analysis results data comprises or more of:

analysis result data of the code sample;

code sample data that has been analyzed;

analysis rules code data for static analysis of code.

4. The method of claim 1, wherein the designated blocks of the blockchain include a block holding analysis rule codes for static analysis of code, a block holding code samples;

the step of storing the verified code static analysis result data into the designated block of the block chain comprises:

when the verified code static analysis result data is analyzed code sample data, the analyzed code sample data is written as new data in the blocks of the block chain where the code samples are stored, and/or,

when the verified code static analysis result data is analysis rule code data for code static analysis, the analysis rule code data for code static analysis is written as new data in the blocks of the block chain where the analysis rule code for code static analysis is stored.

5. The method of claim 4, wherein the designated blocks of the blockchain further include a false positive rate and a false negative rate that preserve static analysis of the current code, the method further comprising :

acquiring the false alarm rate and the missing detection rate of new code static analysis after the code samples in the appointed blocks of the block chain are increased, and/or acquiring the false alarm rate and the missing detection rate of new code static analysis after the code static analysis is carried out by using the newly written analysis rule codes for code static analysis;

and writing the obtained false alarm rate and the obtained missing detection rate of the new code static analysis into blocks of the block chain, which store the false alarm rate and the missing detection rate of the code static analysis, as pieces of new data.

6. The method of claim 1, wherein the receiving user-submitted code static analysis result data and performing validation analysis comprises:

sending the code static analysis result data submitted by the user to a verifier so that the verifier verifies whether the code static analysis result data submitted by the user is valid;

receiving a verification result returned by the verification personnel;

and when the received verification result is that the verification is passed, executing the step of storing the code static analysis result data which is passed through the verification into the specified block of the block chain by using the block chain technology.

7. The method of claim 6, wherein the verification result further includes authority information of the verified person, and the method further comprises :

judging whether the verifier has the authority to write data into the specified block of the block chain according to the authority information of the verifier;

if the judgment result is yes, and when the received verification result is that the verification is passed, the step of storing the code static analysis result data passed through the block chain technology into the specified block of the block chain is executed.

8, code static analysis device, wherein the device comprises:

the receiving unit is suitable for receiving code static analysis result data submitted by a user and carrying out verification analysis;

the storage unit is suitable for storing the verified code static analysis result data into a specified block of the block chain through a block chain technology;

and the distribution unit is suitable for distributing certain amount of virtual currency corresponding to the submitted code static analysis result data to the account of the authenticated user through the blockchain technology.

An electronic device of the type , wherein the electronic device comprises:

a processor; and the number of the first and second groups,

a memory arranged to store computer executable instructions that when executed cause the processor to perform the method of any of claims 1-7.

10, computer readable storage media, wherein the computer readable storage media stores or more programs, the or more programs when executed by a processor implement the method of any of claims 1-7.

Images