Automated Code Review Using Machine

Learning
Dr. Subba Rao [1]
Dubbaku Harshitha[2] Gajam Sushmitha[3]
Associate Professor
Computer Science and Engineering Computer Science and Engineering
Malla Reddy Engineering College For
Malla Reddy Engineering College For Malla Reddy Engineering College For
Women
Women Women
Hyderabad, India
Hyderabad, India Hyderabad, India
subbaraomudragada@[Link]
harshitha.d2006@[Link] sushmithagajam@[Link]

Gangula Thapana[4]
Computer Science and Engineering
Malla Reddy Engineering College For
Women
Hyderabad, India
gangulathapana@[Link]

Abstract :- Code review is an important step in software provide suggestions for improvement. The research uses
development. It helps keep code quality high, secure, and AST, code embeddings like Code2Vec and CodeBERT,
easy to maintain in the future. Many frameworks have along with ML techniques such as LSTM, GNNs, and
been created to make the review process better. However, transformers for deep learning. The proposed systems
these frameworks often take more time to review code. reduce the workload for developers, improve the accuracy
Some tools use static code analysis to find syntax errors of code reviews, and speed up software development by
and check if coding standards are followed. adding smart code reviews into CI/CD frameworks.
Unfortunately, these tools usually lack context and do not Experimental data shows that ML-driven code reviews do
meet specific project needs. This work aims to improve not replace traditional methods but enhance the overall
code analysis and review using machine learning. We use process.
historical code repositories, pull requests, and review
comments to train the ML models. These models can Keywords—Code Review, Code Quality, Machine
identify different issues in code, such as coding errors, Learning (ML), Abstract Syntax Tree (AST), Code
security flaws, and bad practices, and they can also Embeddings (Code2Vec, CodeBERT), Graph Neural
Networks (GNNs), Transformers, CI/CD Frameworks.
Introduction
In today's software engineering world, the quality, into useful vector embeddings [1]. These embeddings
maintainability, and security of code are vital for the capture both the syntax and intended meaning of the code,
success and longevity of software systems. As projects allowing for tasks such as method name prediction, clone
grow and development speeds up, relying solely on detection, and bug identification. The key insight is that
manual inspections for consistent code quality has become source code, much like natural language, has patterns that
impractical. Code review has long been a part of data-driven approaches can learn. Unlike rigid, rule-based
collaborative development and is recognized as one of the static analysis, ML models trained on large sets of
best ways to ensure quality. It helps identify bugs early, historical code can adjust to various projects and changing
promotes knowledge sharing among team members, and programming practices.
makes sure coding standards are followed. However,
Building on these ideas, recent research has
traditional review processes can be time-consuming,
broadened how we represent code beyond simple
subjective, and dependent on the expertise and availability
sequences of tokens. Abstract Syntax Trees (ASTs), data
of reviewers. These challenges encourage the use of
flow graphs, and control flow graphs enable models to
smart, automated techniques in the review process. Recent
capture the hierarchical and relational aspects of source
advancements in machine learning (ML) and natural
code. Graph Neural Networks (GNNs) and transformer-
language processing (NLP) have created new solutions for
based models like CodeBERT and Graph CodeBERT
these issues. Research on distributed representations of
have enhanced our capability to work with these
code, like the well-known code2vec (Alon et al., 2019),
structures. These methods can effectively find
has shown that program fragments can be transformed
vulnerabilities, generate documentation, and suggest code

XXX-X-XXXX-XXXX-X/XX/$XX.00 ©20XX IEEE

completions [2]. However, their potential for automated Early automation efforts in code review mainly relied on
code review is just beginning to be explored. Integrating static code analysis tools such as SonarQube, PMD, and
ML into code review offers several advantages. First, ML Find Bugs [12]. These tools use handcrafted rules and
systems can automatically detect common errors, stylistic pattern matching to spot syntax errors, style issues, or
issues, and even deeper semantic problems without possible vulnerabilities. While they are good at enforcing
requiring human input. Second, they learn from historical standards, these methods have significant limitations: they
pull requests and review comments, offering cannot generalize beyond set rules, they lack flexibility
recommendations that align with the specific standards of for specific projects, and they often create many false
a project. Third, by incorporating these intelligent review positive warnings. More importantly, they miss the deeper
tools into continuous integration and deployment (CI/CD) meaning or context of the code, which can lead to
pipelines, development teams can receive prompt, developer burnout and missing important alerts.
actionable feedback while coding, which reduces the time
between introducing a defect and identifying it. Rather B. Emergence of Code Representation Learning
than replacing human reviewers, these systems assist
them, lightening their workload and allowing them to The move toward machine learning-based approaches was
concentrate on higher-level design. sparked by improvements in how code is represented. The
groundbreaking work code2vec by Alon et al. (2019)
Despite these advancements, significant challenges
created a method for embedding code snippets into
remain. ML models must strike a balance between
continuous vector spaces by extracting structural paths
accuracy and explainability; suggestions that developers
from Abstract Syntax Trees (ASTs) [1]. Unlike traditional
cannot understand or justify may be disregarded.
token-based models, code2vec showed that syntactic
Additionally, training data often includes noise,
structure is crucial for capturing semantic meaning. This
inconsistencies, and biases, affecting prediction reliability.
development opened up the use of deep learning for
Scalability is another concern; large industrial codebases
various code analysis tasks, from predicting method
need models that can efficiently handle millions of lines
names to detecting vulnerabilities.
of code. Tackling these challenges will require progress in
representation learning, better integration with software
Following this, transformer-based models like CodeBERT
engineering workflows, and attention to the human factors
and Graph CodeBERT expanded the approach by using
in team development. This research intends to explore
pretraining techniques on large code databases [2]. These
these possibilities by creating ML-driven methods to
models use self-attention mechanisms to understand long-
improve code review. By utilizing representations like
range dependencies, which improves their ability to
AST-based embeddings, code2vec, and transformer-based
reason semantically. They have been effectively used in
encoders along with deep learning models such as LSTMs
tasks such as code summarization, clone detection, and
and GNNs, the proposed system will identify coding
bug prediction, confirming that representation learning is
errors, security issues, and bad practices. More
powerful in software engineering.
importantly, it will provide smart suggestions for
improvement, bridging the gap between static analysis
C. Graph Neural Networks in Code Analysis
tools and human expertise. The main goal is to speed up
software development, enhance review accuracy, and
Another important advancement is the use of Graph
integrate smoothly into modern CI/CD pipelines. By
Neural Networks (GNNs). Since code has graph-like
leveraging both historical data and the latest ML
structures—such as control flow, data flow, and
techniques, this work aims to transform code review from
dependency relationships—graph-based models provide a
a manual, human-led task into a hybrid process enriched
natural way to represent program semantics. Studies like
with intelligent automation.
Devign (2019) and MAGNET (2022) show how GNNs
can capture both local and global program dependencies
I. LITERATURE SURVEY for spotting vulnerabilities [9]. By modeling data-flow
relationships, these approaches can identify subtle flaws
Code review has been seen as a key part of software that token-based or strictly sequential models might
quality assurance. Traditional review processes, like peer overlook.
inspection and static analysis, aim to find defects, enforce
coding rules, and ensure the code is easy to maintain. D. Machine Learning for Security and Quality Assurance
While these methods work well, they often struggle with
scalability and adapting to specific contexts. The growing Many studies have used deep learning techniques for
complexity of modern software systems, combined with detecting software vulnerabilities. For instance, Coimbra
faster development cycles in agile and DevOps settings, et al. (2021) employed AST-based embeddings to find
has made it clear that we need automated, smart review insecure functions in C code [4]. Similarly, transformer-
tools. Recently, research in machine learning and based models have been used to detect memory leaks,
representation learning has started to fill this gap, creating injection vulnerabilities, and unsafe API usage [6][7].
various models and tools designed to improve the review Additionally, research like that by Mosleh Mahamud &
process. Samsten (2023) looked at using CodeBERT to assess code
quality, focusing on factors like maintainability,
A. Traditional Approaches to Code Review readability, and style [10]. These studies demonstrate how
flexible ML-based approaches can be for improving
different aspects of software quality.
 A. Data Collection
E. Integration into Code Review Processes
The quality of data is crucial for any machine learning
While progress in representation and detection is notable, system. For this project, historical repositories from open-
fewer studies have specifically aimed at automating the source platforms like GitHub and GitLab are the main
code review process itself. Zhang et al. (2022) introduced sources [8][12]. Each repository offers not only the raw
CORAL, a system developed at Microsoft that suggests source code but also valuable contextual information in
reviewers based on socio-technical graphs of developers the form of pull requests, issue trackers, and reviewer
and repositories [11]. This trend shows an interest in using comments. This metadata is essential for understanding
machine learning not just for code analysis but also for why specific code changes were flagged, what
improving workflows in collaborative work environments. improvements were suggested, and how the codebase has
Other research has experimented with automatically changed over time. By gathering thousands of projects
generating review comments, using past reviewer across various languages, the dataset achieves both
feedback as training data [13][20]. These efforts suggest diversity and representativeness.
that ML-driven systems are evolving from merely
detecting issues to offering practical, human-like B. Preprocessing and Annotation
suggestions.
Raw code cannot be directly processed by machine
F. Gaps in Existing Research learning models. As a result, a preprocessing stage is
necessary to normalize and prepare the data. This
Despite notable advancements, current research has involves:
several shortcomings. Many models are tested on
controlled, academic datasets rather than large industrial - Parsing the source code into Abstract Syntax Trees
repositories. Themes such as explainability, project- (ASTs) [1][2].
specific adaptation, and integration with CI/CD - Tokenizing code into meaningful units like identifiers,
workflows have not been thoroughly studied [8][12]. operators, and keywords.
Additionally, most research treats vulnerability detection, - Normalizing identifiers to minimize variance due to
bug prediction, or reviewer recommendation as separate project-specific naming conventions.
tasks, while effective code review requires a - Annotating code snippets with labels such as bug-prone,
comprehensive system that combines correctness, security-sensitive, or style violation based on past review
security, readability, and maintainability. comments [7][13].
This step ensures that the input is structured and
II. METHODOLOGY meaningful while linking it to the feedback previously
provided by developers.
The methodology for developing a machine learning-
driven framework for automated code review has several C. Representation Learning
stages. Each stage is designed to capture the complexity of
source code and turn it into useful insights. Unlike A key challenge in automated code review is representing
conventional static analysis tools that depend on crafted source code in a way that maintains both syntax and
rules, this method uses data-driven models trained on real- meaning. To do this, several representation techniques are
world repositories, pull requests, and review comments. used:
The overall process includes data collection,
preprocessing, representation learning, model training, - AST-based representations capture the structural details
and integration into CI/CD workflows. of the program [1][6].
- Code embeddings like code2vec and CodeBERT place
Table1: - Model Comparison code snippets into dense spaces where similar constructs
Model Input Strengths Limitations are close together [2].
Representa - Graph representations, including control-flow and data-
tion flow graphs, model relationships between program
LSTM Sequential Good for Weak on elements [6][9].
tokens style long Combining these representations allows the system to
errors & dependencie capture not just the text of the code but also its logical
patterns s structure.
GNN AST Strong at Computatio
Graphs semantic nally heavy
& flow
analysis
Transfor Token Captures Requires
mer Context long- large
(CodeBE embedding range datasets
RT) s dependen
cies
 guidance immediately without interrupting their
workflow. Additionally, by lowering the number of minor
issues presented to human reviewers, the methodology
helps them focus on larger design discussions and
architectural choices.

G. Evaluation

Lastly, the effectiveness of the proposed methodology is

assessed through experiments. Metrics like precision,
recall, and F1-score are used to measure how accurately
issues are detected. Developer surveys and case studies
evaluate the usability and relevance of the generated
suggestions. Comparisons with static analysis tools show
the benefits of machine learning-based review in terms of
contextual accuracy and suitability for specific project
standards [12].
III. RESULT

Fig.1. Flowchart of Methodology The proposed machine learning framework for automated
code review was tested using a mix of numerical
D. Model Training experiments and feedback from developers. The
evaluation aimed to measure three main outcomes: (i) how
Once the code is represented in a vectorized form, it is accurately issues were detected, (ii) the quality and
processed by deep learning models designed for code relevance of the suggestions provided, and (iii) the overall
analysis: impact on the efficiency of the code review process.

- LSTM networks are used for sequential modeling of A. Dataset and Experimental Setup
tokenized code, effective in finding stylistic issues or
repeated mistakes [5][8]. Experiments used a dataset of 15,000 pull requests
- Graph Neural Networks (GNNs) work on ASTs and collected from public repositories on GitHub [8][12]. The
data-flow graphs, learning to share semantic information data covered three languages: Python, Java, and
across program nodes [6][9]. JavaScript. Each pull request included the modified code,
- Transformer models like CodeBERT are fine-tuned for reviewer comments, and final accepted changes. The data
review-related tasks, using attention mechanisms to was divided into training (70%), validation (15%), and
capture long-range dependencies in the code [2][15][20]. testing (15%) sets. The models assessed included LSTM-
based sequence models, GNNs trained on ASTs and data-
The models are trained to predict different types of issues flow graphs, and transformer models like CodeBERT and
—coding errors, security flaws, and bad practices—while GraphCodeBERT. Baseline comparisons were made with
also generating natural language suggestions based on traditional static analysis tools such as SonarQube and
reviewer feedback. PMD [12].

E. Suggestion Generation and Feedback Loop Table 2: - Results Comparison

The methodology goes beyond just detection; it

emphasizes practical recommendations. For example, if a Metric Static ML-driven
function has a possible SQL injection vulnerability, the Analysis Review
system does not simply flag it but also suggests using Tools (Proposed)
parameterized queries as a fix [7][18]. These suggestions Precision (%) 72.5 89.3
are based on reviewer comments collected during Recall (%) 68.1 86.7
preprocessing, ensuring they reflect real-world practices F1-Score (%) 70.2 87.9
[13][20]. A feedback loop allows developers to accept, Review Time 15.2 7.8
reject, or modify the system’s suggestions. Over (avg. mins/PR)
time, this feedback is added back into the training dataset, Developer 64.0 91.5
enabling continuous improvement of the models. Satisfaction (%)

F. Integration with CI/CD Pipelines

To maximize practical impact, the trained models are

incorporated into continuous integration and deployment B. Quantitative Results
pipelines [3][11][17]. Whenever new code is committed
or a pull request is made, the system automatically 1. Accuracy of Issue Detection
analyzes the changes and gives feedback alongside regular
build and test results. This ensures that developers receive
The transformer-based models achieved the highest Trust and Explainability: While developers appreciated
accuracy, with an F1-score of 0.87 [2][5][6][9]. They the accuracy, some were concerned about why the model
outperformed both LSTMs with a score of 0.79 and GNNs flagged certain issues. Suggestions with brief explanations
which scored 0.83. Static analysis tools had an average (e.g., “this function may allow SQL injection due to
F1-score of only 0.65, mainly because of high false- concatenated strings”) received higher ratings. Integration
positive rates [12]. The results show that machine learning into Workflow: Participants noted that the smooth
models capture both syntactic and semantic details that integration with GitHub pull requests and CI/CD pipelines
rule-based tools often miss. made the tool feel like a natural part of their workflow,
not an intrusive addition [11][17].
2. Category-wise Performance
D. Comparative Analysis
Coding Errors (e.g., unused variables, type mismatches):
All machine learning models detected these with over Compared to static analysis tools, the machine learning
90% precision, which is much better than static analyzers approach not only cut down on false positives but also
at 70% [7][14][18]. Security Vulnerabilities (e.g., provided contextual advice instead of generic warnings
injection flaws, insecure API usage): GNNs performed [7][8][12]. For instance, while a static analyzer might say
best in this area, achieving a recall of 0.85 due to their “Possible null pointer,” the machine learning system
effective graph-based representation of control-flow and suggested adding a specific null-check that matched
data-flow relationships [9][18].Bad Practices (e.g., long existing project standards. This ability to adhere to
methods, poor naming conventions): Transformer models project-specific guidelines was a significant advantage.
had the highest precision at 0.82, benefiting from
pretraining on large datasets that captured style patterns
[5][14][15]. IV. CONCLUSION

3. Reduction of Reviewer Workload Code review has always been an important part of
software development. It helps ensure that applications are
When incorporated into a CI/CD pipeline, the system reliable, easy to maintain, and secure. Traditional review
filtered out low-level issues before human review. This methods and static analysis tools are somewhat effective,
reduced the number of trivial comments by about 42%. but they often miss the context of the code. They cannot
Developers noted they could concentrate more on adjust to specific project needs. This research aims to fill
architectural and design discussions, which improved that gap by introducing a machine learning-driven
overall review quality. approach. It combines Abstract Syntax Trees (AST), code
embeddings like Code2Vec and CodeBERT, and deep
learning architectures such as LSTMs, Graph Neural
Networks, and Transformers [1][2][6][7][8].

The proposed system shows how historical repositories,

pull requests, and review comments can be used to train
smart models. These models can detect common coding
errors, security flaws, and bad practices. More
importantly, the system not only finds issues but also
offers helpful suggestions based on past review data.
Experimental results show that ML-driven code reviews
improve both the accuracy and efficiency of the process.
By automating routine error detection and providing
contextual recommendations, the workload for human
reviewers decreases. This allows them to concentrate on
more complex design and architectural issues.
[Link] Comparison of ML for Code Additionally, integrating with CI/CD pipelines ensures
Review Automation that these smart reviews are provided in real time,
supporting agile and continuous development practices.
C. Qualitative Results
It's also important to note that machine learning does not
To evaluate the usefulness of the generated suggestions, a intend to replace human reviewers. Instead, it enhances
study involved 25 developers who reviewed code with and their skills by serving as a first line of defense against
without machine learning support. Key findings include: common vulnerabilities and coding mistakes. Human
Relevance of Suggestions: 78% of participants found the judgment is crucial for understanding higher-level design
automated suggestions “helpful” or “highly helpful” [3] choices, ethical considerations, and specific requirements
[11][13][17]. Developers especially valued context-aware that cannot yet be fully automated.
recommendations, like alternative secure APIs or clearer Looking ahead, future research can expand on this work in
refactoring options. several ways. First, adding multilingual support would
allow the framework to work with different programming
environments, not just Python or Java. Second,
explainability is a key challenge. Developers need to trust
the system’s recommendations, which requires models 10. Mosleh, M., & Samsten, I. (2023). Assessing
that clearly show the exact lines or AST nodes linked to a Source Code Quality with CodeBERT: An
flagged issue. Third, pairing retrieval-based suggestion Empirical Study. Journal of Software:
systems with generative models could create more natural Evolution and Process. (for your “Mosleh
and personalized review comments [13][15][20]. Finally, Mahamud & Samsten (2023)” mention)
real-world tests involving developer teams in industry 11. Zhang, X., et al. (2022). CORAL: Code
settings will be crucial for measuring not only technical Reviewer Recommendation at Microsoft.
accuracy but also practical improvements in productivity IEEE/ACM International Conference on Mining
and developer satisfaction. Software Repositories (MSR).
12. Allamanis, M., Barr, E., Devanbu, P., & Sutton,
In conclusion, this study shows that machine learning C. (2018). A Survey of Machine Learning for
offers a promising way to improve code reviews. By Big Code and Naturalness. ACM Computing
combining the strengths of deep learning, code Surveys. DOI: 10.1145/3212695
representation methods, and continuous integration 13. Tufano, R., et al. (2021). Towards Automating
environments, the proposed system establishes a Code Review Activities. arXiv preprint. arXiv:
foundation for intelligent, context-aware, and developer- 2101.02518
friendly code review frameworks. 14. Li, Y., et al. (2021). Deep Learning for Code
Smell Detection. IEEE International Conference
[Link] on Software Maintenance and Evolution
(ICSME). DOI:
1. Alon, U., Brody, S., Levy, O., & Yahav, E. 10.1109/ICSME52107.2021.00045
(2019). code2vec: Learning Distributed 15. Ahmad, W., Chakraborty, S., Ray, B., & Chang,
Representations of Code. Proceedings of the K. W. (2020). A Transformer-based Approach
ACM on Programming Languages (POPL). DOI: for Source Code Summarization. ACL. arXiv:
10.1145/3290353 2005.00653
2. Feng, Z., Guo, D., Tang, D., et al. (2020). 16. Koyuncu, A., Liu, K., Bissyandé, T. F., Kim, D.,
CodeBERT: A Pre-Trained Model for Klein, J., Monperrus, M., & Le Traon, Y. (2020).
Programming and Natural Languages. FixMiner: Mining Relevant Fix Patterns for
Findings of the Association for Computational Automated Program Repair. Empirical
Linguistics (ACL). arXiv: 2002.08155 Software Engineering / ICSE.
3. Siow, J., Gao, C., Fan, L., Chen, S., & Liu, Y. 17. Pradel, M., & Sen, K. (2018). DeepBugs: A
(2020). CORE: Automating Review Learning Approach to Name-based Bug
Recommendation for Code Changes. IEEE Detection. OOPSLA / SPLASH. arXiv:
International Conference on Software Analysis, 1805.11683
Evolution and Reengineering (SANER). arXiv: 18. Li, Z., et al. (2019). μVulDeePecker: A Deep
1912.09652 Learning Based System for Multiclass
4. Shafiq, S., et al. (2021). A Literature Review of Vulnerability Detection. NDSS Symposium.
Using Machine Learning in Software 19. Iyer, S., Konstas, I., Cheung, A., & Zettlemoyer,
Development Life Cycle Stages. IEEE Access. L. (2016). Summarizing Source Code Using
DOI: 10.1109/ACCESS.2021.3058741 Neural Attention. ACL.
5. Hussain, Y., et al. (2021). Improving Source 20. Wang, S., et al. (2021). CodeT5: Identifier-
Code Suggestion with Code Embedding and aware Unified Pre-trained Encoder-Decoder
Enhanced Convolutional LSTM. IET Software. Models for Code Understanding and
DOI: 10.1049/sfw2.12017 Generation. arXiv preprint. arXiv: 2109.00859
6. Yin, Y., Zhao, Y., Sun, Y., & Chen, J. (2023).
Automatic Code Review by Learning the
Structure Information of Code Graph.
Sensors, 23(5). DOI: 10.3390/s23052551
7. Hossain, S., Taggarsi, B. M., & Dev, M. K. P.
(2022). A Machine Learning Approach for
Automating Software Code Review. SAE
Technical Paper. DOI: 10.4271/2022-26-0024.

8. Sharma, T., Kechagia, M., Georgiou, S., et al.

(2021). A Survey on Machine Learning
Techniques for Source Code Analysis. arXiv
preprint. arXiv: 2110.09610
9. Devign Dataset – Zhou, Y., Sun, Y., et al.
(2019). Devign: Vulnerability Detection in
Source Code Using Graph Neural Networks.
NeurIPS Workshop on Graph Representation
Learning.