Differential static program analysis

Abstract

Methods for program analysis include performing a high-level analysis on a program using a processor to generate one or more high-level findings; performing one or more low-level analyses on the program using a processor to generate one or more low-level findings; mapping the one or more low-level findings to the high-level findings to generate a concise combination report that categorizes each finding according to the highest-level analysis that produces the finding.

Description

BACKGROUND[0001]1. Technical Field[0002]The present invention relates to static code analysis and, more particularly, to using multiple analyses with differing levels of precision to make static analysis reports more useful.[0003]2. Description of the Related Art[0004]Static code analysis is a powerful approach for software verification. Static analysis typically features one-sided error: a subject program is safe with regard to the tested property if no violations of the property are discovered by the analysis, which over-approximates the program's set of possible behaviors. However, if the analysis does report violations of the property, then that doesn't necessarily imply that the program is incorrect. These violations may be false reports due to the approximations the analysis applies to put bounds on the state space of the program, which could otherwise be infinite.[0005]Since the tested properties are mostly hard to verify statically (e.g., security vulnerabilities, concurrenc...

AI Technical Summary

Benefits of technology

The patent describes a method and system for analyzing programs using a combination of high-level and low-level analyses. The high-level analysis is performed using a processor to generate one or more high-level findings, while the low-level analysis is performed using a processor to generate one or more low-level findings. The low-level findings are then mapped to the high-level findings to create a concise combination report that categorizes each finding according to its associated level of analysis. The combination report can also link analyses to associate a suppressed finding in one analysis with a full report on the finding in another analysis. The technical effect of this patent is to provide a more comprehensive analysis of programs that can identify and categorize high-level and low-level findings, and to facilitate the linking of analyses to better understand the overall context and significance of the findings.

Problems solved by technology

These violations may be false reports due to the approximations the analysis applies to put bounds on the state space of the program, which could otherwise be infinite.

Since the tested properties are mostly hard to verify statically (e.g., security vulnerabilities, concurrency bugs, typestate violations, etc.), static analysis tools typically have a high proportion of false reports.

This limits the usability of commercial analysis tools: The size of the report, together with the poor quality of many of the findings, makes it difficult to translate the report into an actionable list of remediation tasks.

Images