Static analysis acceleration method based on tripartite library selection

Abstract

The invention discloses a static analysis acceleration method based on tripartite library selection. The static analysis acceleration method comprises the following steps: (1) inputting a program to be tested and a corresponding analysis task; wherein the test program comprises an application program and a third-party library used by the application program; (2) according to the static analysis task, obtaining points of interest in the application program range; (3) carrying out library pointing analysis by taking the application program as an analysis range, and obtaining a library pointer associated with the interest point; (4) generating internal and external pointing information abstracts for all methods; (5) analyzing pointer information related to the interest points to obtain a pointer priority list; (6) selecting a part of third-party libraries based on the priority list; according to the method, the obtained partial tripartite library list is used for an existing static analysis tool, and the analysis speed is increased.

Description

Technical Field

[0001] The present invention relates to the technical field of software engineering, and in particular to a static analysis acceleration method based on tripartite library selection. Background Art

[0002] Static program analysis is an effective defect detection technology. It helps identify defects in programs by analyzing the code without actually running the program. It is widely used in modern software development. The extensive use of third-party libraries in programs poses a huge challenge to static analysis. When dealing with programs that reference a large number of third-party libraries, static analysis tools often have problems with low analysis efficiency due to the large size of the third-party libraries and complex dependencies, or even fail to complete the analysis effectively. If third-party libraries are not used and only the source code of the program itself is analyzed, the analysis accuracy will be low and many defects related to third-party libraries will be missed.

[0003] Some existing methods, including generating concise summaries for third-party libraries for analysis and performing analysis according to analysis requirements, can improve the analysis efficiency of the entire program, but they often face problems such as reduced accuracy or insignificant speed improvement. On the one hand, although summary analysis can improve analysis efficiency, it often causes a decrease in analysis accuracy; on the other hand, summary analysis or on-demand analysis may bring additional performance overhead, resulting in limited improvement in analysis speed.

[0004] Using some third-party libraries for static analysis is an effective way to improve the speed of static analysis. The key lies in selecting more important third-party libraries for analysis, thereby improving the analysis speed without sacrificing analysis accuracy. However, accurately capturing important third-party libraries is a difficult task, and obtaining accurate information requires a lot of time. Existing methods often use inaccurate methods to select some third-party libraries, resulting in poor performance. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a static analysis acceleration method based on third-party library selection, so as to solve the problem that a large number of third-party libraries in traditional static analysis tasks cause a significant decrease in analysis efficiency, and improve the efficiency of static analysis tools.

[0006] Technical solution: The static analysis acceleration method based on tripartite library selection described in the present invention comprises the following steps: (1) Input the program to be tested and the corresponding analysis task; the test program includes the application and the third-party libraries it uses; (2) Obtaining points of interest within the application based on static analysis tasks; (3) Perform library pointing analysis with the application as the analysis scope to obtain the library pointer associated with the point of interest; (4) Generate a summary of internal and external pointing information for all methods; (5) Analyze the pointer information related to the points of interest and obtain a pointer priority list; (6) Select some third-party libraries based on the priority list; (7) Use the obtained partial third-party library list for existing static analysis tools to improve the analysis speed.

[0007] Furthermore, in step (2), obtaining the points of interest within the scope of the application is specifically as follows: according to the code attributes that the analysis task focuses on, obtaining a pointer set corresponding to the analysis task within the scope of the application; wherein, for type conversion errors, it is necessary to obtain all type conversion instructions within the scope of the application, and take out the right value of the type conversion instruction and put it into a set, wherein the set will contain all points of interest within the scope of the application.

[0008] Furthermore, the pointing relationship is to expand the pointer structure into variable pointer, field pointer, new abstraction, constant abstraction, parameter input abstraction, method call abstraction, method call parameter array side effect abstraction, method return value abstraction, method parameter array side effect abstraction, and use abstract pointer representation to replace specific cross-process pointer operations.

[0009] Furthermore, in step (3), an abstract pointer is created for the library pointer within the application scope, and the abstract pointer is propagated within the application scope using inter-procedural pointer analysis, thereby obtaining a library pointer that may affect the location information of the point of interest. The library pointer associated with the point of interest includes: the return value of calling a third-party library method within the application scope, the field in the third-party library class used within the application scope, and the third-party library calling the application method and passing parameters to the application.

[0010] Furthermore, step (4) is as follows: perform intra-procedural pointer analysis within each method scope, construct and solve constraint relationships between pointers, and for pointers involving external calls, use extended abstract pointers to replace the information generated during the specific call process, and obtain a summary of internal and external pointing information for each method.

[0011] Furthermore, step (5) is specifically as follows: according to the nature of the pointers themselves, the relationship between the pointers, and the relationship between the pointers and the points of interest, the value ranking of the pointers for a specific analysis is determined, including the following steps: (51) Generate an initial set of library pointers and calculate the number of points of interest affected by each library pointer; (52) Initialize the priority queue, place the initial library pointer set into the priority queue, and sort them according to the relationship between the current pointer and the parent pointer, the number of affected interest points, and the level of the pointer; (53) Each time a pointer is taken out from the priority queue, if the pointer is of field type, check the methods that can affect the current field, query all the associated pointers in these methods, and add them to the priority queue; if the pointer is of other types, put the current pointer into the pointer priority result list, and then check whether the method to which the pointer belongs affects the current pointer. If it does, add the associated pointer of the current pointer to the priority queue; the class relationship of the pointer added to the priority queue will be calculated according to whether the class of the current pointer is the same as that of the parent pointer, and the number of interest points affected will be calculated according to the number of interest points affected by the parent pointer divided by the number of pointers at the current level, and the level will be calculated according to the parent pointer level plus 1; (54) Repeat step (53) until the priority queue is empty, and obtain a result list containing the order of pointer values.

[0012] Furthermore, in step (53), querying the associated pointer includes the following steps: (531) Initialize the associated information according to the pointer type, extract the associated pointer from the internal and external summaries, determine whether the pointer is affected in the current scope, add the affected element to the result set, and place the variable pointer and the call abstraction in the waiting queue; (532) Process the pointer in the waiting queue. If it is a variable pointer, continue to iterate and process its corresponding internal and external summaries to determine whether the pointer is affected. If it is a call abstraction, find the actual method corresponding to the method call, recursively check whether the corresponding method actually has an impact. If it does, add the corresponding method abstraction to the result set and add the corresponding parameter to the waiting queue. (533) Repeat step (532) until the waiting queue is empty, and obtain whether the current pointer is affected by the specified method and the associated pointer set.

[0013] Furthermore, step (6) is specifically as follows: generate a third-party library selection based on the pointer priority list, traverse the pointer priority list in order, obtain the method or class where each pointer is located and add it to the result set until the result set reaches the required number, that is, reaches the specified number of third-party library functions or the specified number of third-party library classes.

[0014] An electronic device described in the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, any one of the static analysis acceleration methods based on tripartite library selection is implemented.

[0015] A storage medium described in the present invention stores a computer program, characterized in that when the computer program is executed by a processor, any one of the static analysis acceleration methods based on tripartite library selection is implemented.

[0016] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: Based on efficient multi-stage pointer analysis, by identifying analysis requirements and points of interest, as well as third-party library methods with a higher degree of correlation with analysis points of interest, some third-party libraries can be selected for static analysis, so that existing static analysis tools can obtain similar results at a faster speed, thereby improving the efficiency of full program analysis. At the same time, this method does not require too much customization of existing static analysis tools and has strong versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 is a detailed flow chart of the present invention; Figure 3 It is a schematic diagram of the selection sequence of the present invention; Figure 4 This is a tree diagram of the generation part of the tripartite library of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0019] like Figure 1 As shown, an embodiment of the present invention provides a static analysis acceleration method based on three-party library selection. Through multi-stage pointing analysis, it gradually expands from the application scope to each method scope, captures the association relationship between pointers in a specific scope, that is, a pointer set associated with a certain pointer, and determines the priority of each pointer through the association relationship between the pointers. The multi-stage pointing analysis improves the efficiency of the three-party library selection and improves the accuracy of the three-party library selection, including the following steps: S1. Input the program to be tested and the corresponding analysis task into the system, wherein the program to be tested includes an application program and a third-party library, which can be provided in the form of source code or jar package, and the system converts it into an intermediate code representation inside the analysis tool; the analysis task is a defect detection task that can be executed by an existing static analysis tool, such as type conversion error, null pointer error, etc. This embodiment takes type conversion error as an example; S2. According to the static analysis task, the points of interest within the application are obtained. For type conversion errors, all type conversion instructions within the application need to be obtained, and the right value of the type conversion instruction is taken out and placed into a set. The set will contain all points of interest within the application. S3. Perform library pointing analysis with the application as the analysis scope to obtain the library pointer associated with the point of interest. The library pointing analysis includes the following steps: (31) Construct an abstract pointer for the interaction between the application and the library within the scope of the application, including the return value of calling the third-party library method within the scope of the application, using the field in the third-party library class within the scope of the application, and the third-party library calling the application method and passing parameters to the application; (32) Construct a pointer flow graph PFG within the scope of the application, and insert the abstract pointer formed in the previous step into the corresponding PFG; (33) Perform pointer propagation on PFG to obtain the abstract pointer set corresponding to each pointer on PFG; (34) Obtain a set of abstract pointers corresponding to all points of interest, and calculate the number of points of interest corresponding to each abstract pointer.

[0020] S4. Generate internal and external pointing information summaries for all methods. This step hopes to extract the cross-method pointing information within each method and generate a summary. This step can also be performed offline in actual operation to improve analysis efficiency. The specific steps are as follows: (41) Constructing cross-method interaction abstract pointers within the current method scope, including external operations: field usage, parameter input abstraction, function call return value abstraction, function call effect on array parameter abstraction, internal operations: new abstraction, constant abstraction, forming corresponding abstractions by processing instructions of corresponding types; (42) Construct a pointer flow graph PFG within the scope of the current method, and insert the abstract pointer formed in the previous step into the corresponding PFG; (43) Perform pointer propagation on PFG to obtain the abstract pointer set corresponding to each pointer on PFG; (44) Read the PFG after propagation and generate the internal and external pointing summary information of each method.

[0021] S5, gradually expand the relevant pointers to obtain the pointer priority list. In this step, we hope to start from the set of points of interest, gradually expand the pointers within the program range, and obtain relevant pointers. Figure 3 The following is a schematic diagram of the selection sequence of the method embodiment. The method will first identify the third-party library pointers directly associated with the application program, and then the program will gradually expand these pointers. By integrating the internal and external pointing information and the internal and external pointing information across methods, all relevant pointers in the entire program range are gradually obtained, and the priority order of these pointers is formed. The specific steps are as follows: (51) Generate an initial set of library pointers and calculate the number of points of interest affected by each library pointer; (52) Initialize the priority queue, place the initial library pointer set into the priority queue, and sort them according to the relationship between the current pointer and the parent pointer, the number of affected interest points, and the level of the pointer; (53) Each time (53-a) a pointer is taken out from the priority queue, (53-b) if the pointer is of field type, then (53-c) the methods that can affect the current field are checked, and all associated pointers in these methods are queried and added to the priority queue (53-d); if the pointer is of other types, (53-e) the current pointer is placed in the pointer priority result list, (53-f) then it is checked whether the method to which the pointer belongs affects the current pointer, (53-g) if it does, the associated pointer of the current pointer is added to the priority queue; for the pointer added to the priority queue, its class relationship will be calculated according to whether the class of the current pointer is the same as that of the parent pointer, and the number of interest points affected will be calculated according to the number of interest points affected by the parent pointer divided by the number of pointers at the current level, and its level will be calculated according to the parent pointer level plus 1; the process of querying associated pointers is as follows: (531) Initialize the associated information according to the pointer type, extract the associated pointer from the internal and external summaries, determine whether the pointer is affected in the current scope, add the affected element to the result set, and place the variable pointer and the call abstraction in the waiting queue; (532) Process the pointer in the waiting queue. If it is a variable pointer, continue to iterate and process its corresponding internal and external summaries to determine whether the pointer is affected. If it is a call abstraction, find the actual method corresponding to the method call, recursively check whether the corresponding method actually has an impact. If it does, add the corresponding method abstraction to the result set and add the corresponding parameter to the waiting queue. (533) Repeat step (532) until the waiting queue is empty, and obtain whether the current pointer is affected by the specified method and the associated pointer set; (54) Repeat step (53) until the priority queue is empty, and obtain a pointer priority list containing the order of pointer values.

[0022] S6. Generate tripartite library selection based on the pointer priority list. This step will traverse the pointer priority list in order, (6-a) obtain the method or class where each pointer is located and add it to the result set, until (6-b) the result set reaches the required number. Figure 4The process of expanding related pointers and generating selection results in the embodiment is shown. The embodiment test program will call the method Util:copy(o1) from the third-party library. The return value pointer of the call will flow into the point of interest. The pointer will be identified through step S3. Then the method checks the associated pointers of the pointer and finds the return value pointer of Util:copy and the return value pointer of LibStack:pop. After that, this process is continuously iterated to find all associated pointers and obtain the order of these pointers. Finally, the pointer order result is traversed to obtain the result of selecting the third-party library. If the selection ratio of the third-party library is set to select 4 third-party library functions, Util:copy, LibStack:pop, LibStack:push, and LibStack:init will be obtained. This result just contains all the third-party library methods required to detect the defect.

[0023] S7. The obtained partial third-party library list is used for an existing static analysis tool. The analysis tool does not use all the third-party libraries, but performs analysis based on the screened partial third-party libraries, thereby improving the analysis speed.

[0024] An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is loaded into the processor, any one of the static analysis acceleration methods based on tripartite library selection is implemented.

[0025] An embodiment of the present invention further provides a storage medium storing a computer program, wherein the computer program, when executed by a processor, implements any one of the static analysis acceleration methods based on tripartite library selection.

Claims

1. A static analysis acceleration method based on tripartite library selection, characterized in that: The following steps are involved: (1) Input the program to be tested and the corresponding analysis task; The test program includes the application and the third-party libraries it uses; (2) Obtaining points of interest within the application based on static analysis tasks; (3) Perform library pointing analysis with the application as the analysis scope to obtain the library pointer associated with the point of interest; (4) Generate a summary of internal and external pointing information for all methods; (5) Analyze the pointer information related to the points of interest and obtain a pointer priority list; (6) Select some third-party libraries based on the priority list.

2. According to the static analysis acceleration method based on tripartite library selection according to claim 1, it is characterized in that: In step (2), the points of interest within the application scope are obtained as follows: according to the code attributes that the analysis task focuses on, a pointer set corresponding to the analysis task within the application scope is obtained.

3. According to claim 2, a static analysis acceleration method based on tripartite library selection is characterized in that: The pointing relationship is to expand the pointer structure into variable pointer, field pointer, new abstraction, constant abstraction, parameter input abstraction, method call abstraction, method call parameter array side effect abstraction, method return value abstraction, method parameter array side effect abstraction, and use abstract pointer representation to replace specific cross-process pointer operations.

4. According to claim 1, a static analysis acceleration method based on tripartite library selection is characterized in that: In step (3), an abstract pointer is created for the library pointer within the application scope, and the abstract pointer is propagated within the application scope using inter-procedural pointer analysis, thereby obtaining a library pointer that may affect the location information of the point of interest. The library pointer associated with the point of interest includes: the return value of calling the third-party library method within the application scope, the field in the third-party library class used within the application scope, and the third-party library calling the application method and passing parameters to the application.

5. According to the static analysis acceleration method based on tripartite library selection according to claim 1, it is characterized in that: Step (4) is as follows: perform intra-procedural pointer analysis within each method scope, construct and solve the constraint relationship between pointers, and for pointers involving external calls, use extended abstract pointers to replace the information generated during the specific calling process to obtain a summary of internal and external pointing information for each method.

6. According to the static analysis acceleration method based on tripartite library selection according to claim 1, it is characterized in that: Step (5) is as follows: According to the nature of the pointers themselves, the relationship between the pointers, and the relationship between the pointers and the points of interest, the value ranking of the pointers for a specific analysis is determined, including the following steps: (51) Generate an initial set of library pointers and calculate the number of points of interest affected by each library pointer; (52) Initialize the priority queue, place the initial library pointer set into the priority queue, and sort them according to the relationship between the current pointer and the parent pointer, the number of affected interest points, and the level of the pointer; (53) Each time a pointer is taken out from the priority queue, if the pointer is of field type, check the methods that can affect the current field, query all the associated pointers in these methods, and add them to the priority queue; if the pointer is of other types, put the current pointer into the pointer priority result list, and then check whether the method to which the pointer belongs affects the current pointer. If it does, add the associated pointer of the current pointer to the priority queue; the class relationship of the pointer added to the priority queue will be calculated according to whether the class of the current pointer is the same as that of the parent pointer, and the number of interest points affected will be calculated according to the number of interest points affected by the parent pointer divided by the number of pointers at the current level, and the level will be calculated according to the parent pointer level plus 1; (54) Repeat step (53) until the priority queue is empty, and obtain a result list containing the order of pointer values.

7. A static analysis acceleration method based on tripartite library selection according to claim 6, characterized in that: In step (53), querying the associated pointer includes the following steps: (531) Initialize the associated information according to the pointer type, extract the associated pointer from the internal and external summaries, determine whether the pointer is affected in the current scope, add the affected element to the result set, and place the variable pointer and the call abstraction in the waiting queue; (532) Process the pointer in the waiting queue. If it is a variable pointer, continue to iterate and process its corresponding internal and external summaries to determine whether the pointer is affected. If it is a call abstraction, find the actual method corresponding to the method call, recursively check whether the corresponding method actually has an impact. If it does, add the corresponding method abstraction to the result set and add the corresponding parameter to the waiting queue. (533) Repeat step (532) until the waiting queue is empty, and obtain whether the current pointer is affected by the specified method and the associated pointer set.

8. According to the static analysis acceleration method based on tripartite library selection according to claim 1, it is characterized in that: Step (6) is as follows: Generate a third-party library selection based on the pointer priority list, traverse the pointer priority list in order, obtain the method or class where each pointer is located and add it to the result set until the result set reaches the required number, that is, reaches the specified number of third-party library functions or the specified number of third-party library classes.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is loaded into the processor, the static analysis acceleration method based on tripartite library selection according to any one of claims 1 to 8 is implemented.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a static analysis acceleration method based on tripartite library selection according to any one of claims 1 to 8 is implemented.

Images