Program static analysis scheme guiding system based on rule multi-dimensional indexes

Abstract

The invention relates to the technical field of program static analysis, and discloses a program static analysis scheme guiding system based on rule multi-dimensional indexes, which is characterized by comprising a selection module used for providing use scene options for a user; the acquisition module is used for acquiring a scene selection result of the user and dividing the measurement of the rule into a plurality of dimension indexes according to the scene selected by the user; the generation module is used for setting default values for different dimension indexes and generating default priority relations for dimension indexes related to rule configuration according to investigation and survey of a scene selected by a user; and the optimization module is used for adjusting the dimensionality default value and the priority relationship according to the actual demand of the user, mapping the dimensionality index to the underlying rule index, and electing the required rule and configuration. According to the system, default values and default priority relationships are set for all dimension indexes of different user scenes, and users can perform fine adjustment according to needs on the basis, so that required analysis schemes can be generated, and convenience and rapidness are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of program static analysis, and in particular to a program static analysis solution guidance system based on rule-based multi-dimensional indicators. Background Art

[0002] As the iteration speed of software development increases, ensuring the quality of software code and development efficiency becomes a key challenge. Therefore, analysis tools have become an indispensable part of the mainstream software development process. Automatic code checking through analysis tools can effectively improve code quality, detect potential defects, and optimize the development process. Before using analysis tools to perform static analysis on the code, you need to define an analysis plan that covers all the rules that need to be analyzed. Some rules also have corresponding configuration strategies.

[0003] For each rule, in addition to the rule category and rule impact, there are also differences in the required resource overhead, false positive and false negative rates, etc. In addition, development teams in different industries may have different focuses and concerns on rules, and different user scenarios may have different requirements for the performance parameters of rules. Analysis tools often provide thousands of rules for users to filter. Therefore, it takes too much time and energy for users to filter the required rules by understanding the specific text description of each rule, the rule set standard to which the rule belongs, the severity of the rule, etc., and if it is just by choosing which rule set standard to run, it is often too rough and cannot meet the user's expectations. If artificial intelligence (AI) is used, on the one hand, how to train AI so that AI can understand the rules also requires a lot of cost investment, especially in some details, AI cannot combine the implementation characteristics and limitations of the rules to achieve the desired screening.

[0004] Most existing analysis tools provide some default analysis solutions for users to choose from. Or the tools simply classify the rules by rule set standards, rule attributes, etc. Users need to select one by one from a large number of rules based on the rule description and these classifications to generate a set of analysis solutions. However, the existing technology has the following problems with static analysis: it is difficult to select the desired rules. The existing technology provides users with a screening function, allowing users to manually select the required rules to obtain a set of analysis solutions. The operation is cumbersome. If you want a satisfactory solution, users need to have a detailed understanding of the rules, which has a high threshold and fails to comprehensively evaluate the rules in various dimensions. In addition, the built-in analysis solution cannot take into account the needs of different user scenarios, and even in the same user scenario, the actual user's focus and needs will be different. The level of rules in certain categories is fixed, and the same rule is not considered. Due to factors such as technical difficulty and different detection strategies, the impact on indicators of different dimensions when configured differently. Summary of the invention

[0005] The purpose of the present invention is to provide a method for quickly guiding users to generate their desired analysis solutions for different user scenarios by measuring the multi-dimensional indicators of rules, so as to solve the difficulty of rule selection and configuration for different user scenarios in the prior art, that is, the problem that the analysis solution is difficult to meet user expectations efficiently and quickly.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A program static analysis solution guidance system based on rule-based multi-dimensional indicators, characterized in that the system includes:

[0008] Selection module, used to provide users with usage scenario options;

[0009] The collection module is used to collect the scene selection results of the user and divide the measurement of the rule into several dimensional indicators according to the scene selected by the user;

[0010] The generation module is used to set default values ​​for different dimensional indicators based on the survey of user selection scenarios, and to generate default priority relationships for dimensional indicators related to rule configuration;

[0011] The optimization module is used to adjust dimension default values ​​and priority relationships according to actual user needs, map dimension indicators to underlying rule indicators, and select required rules and configurations.

[0012] As a further technical solution, the usage scenario options include system default options and user-defined options.

[0013] As a further technical solution, the dimension indicators include:

[0014] Dimensional indicators that are not related to rule configuration: quality category, impact, and repair difficulty;

[0015] Dimensional metrics related to rule configuration: precision and resource overhead.

[0016] As a further technical solution, the mapping relationship between the dimension indicators that are not related to the rule configuration and the underlying indicators of the rule is:

[0017] Based on the quality issues that users are concerned about, quality categories are classified and corresponding quality category labels are attached to the rules: defects, safety, and maintainability; the underlying indicators corresponding to defects, safety, and maintainability are severity, risk level, and maintainability level respectively;

[0018] By weighting the quality categories, different impact levels of the rules are obtained;

[0019] Taking into account the cost of rule repair and the difficulty of understanding, the difficulty of rule repair is divided into: simple, medium and difficult.

[0020] As a further technical solution, the process of obtaining different impact levels of rules through weighted calculation of quality categories is as follows:

[0021] According to the quality category set C that the user is concerned about, n}, calculate the impact level value for each rule:

[0022]

[0023] Among them, w(C i ) is quality category C i The preset weight in the selected user scenario; f(Ci) is the rule in quality category C i The value below corresponds to the level of the underlying indicator; value is the evaluation value

[0024] Compare the evaluation value with the preset threshold range to obtain the impact level of the rule.

[0025] As a further technical solution, the mapping relationship between the dimension indicators related to the rule configuration and the underlying indicators of the rule includes:

[0026] Taking into account the false positive rate and false negative rate of the rules, the accuracy of the rules is divided into: medium and high

[0027] The resource cost level D is calculated by the formula D=max(A,B), where A is the corresponding level value of the CPU cost under a certain configuration of the rule; B is the corresponding level value of the storage cost under a certain configuration of the rule.

[0028] As a further technical solution, the process of selecting the required rules and appropriate configuration is:

[0029] Step 1: Sort the dimensions by priority, traverse the dimensions with high priority in turn, and use them to map with the underlying indicators of rules under different configurations to obtain the desired rules and rule configuration combinations;

[0030] Step 2: Dimensions with low priority are filtered based on the results of the dimensions with high priority. Repeat step 1 until all relevant dimensions are traversed.

[0031] Beneficial effects of the present invention:

[0032] (1) The present invention is applicable to different user scenarios, and users can flexibly adjust it. The dimensional indicators are obtained by comprehensively considering user needs, and they comprehensively measure the rules from different angles. On this basis, the system of the present invention sets default values ​​and default priority relationships for each dimensional indicator of different user scenarios. Users can make fine adjustments as needed on this basis to generate the required analysis plan, which is convenient and fast;

[0033] (2) The present invention uses the method of mapping dimensional indicators to the underlying indicators of rules to obtain the analysis solution. Users do not need to pay attention to the complicated underlying rule indicators or the effectiveness of headache rules. They only need to control the dimensional indicators to obtain the desired analysis solution;

[0034] (3) The present invention takes into account the impact of different rule configurations, and the resulting analysis solution is more in line with user expectations. The indicators are divided into two categories: those related to the configuration and those not related to the configuration. For the irrelevant indicators, they are directly applied to the screening of the rules. For the relevant indicators, the appropriate configuration is selected according to their priority, and then the rules are screened. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The present invention will be further described below in conjunction with the accompanying drawings.

[0036] Figure 1 It is a schematic diagram of a program static analysis solution guidance system based on rule-based multi-dimensional indicators in the present invention;

[0037] Figure 2 It is a schematic diagram of the association relationship between the dimension indicators and the underlying indicators of the rules in the present invention;

[0038] Figure 3 It is a schematic diagram of the priority screening rules and their configuration according to different dimensions in the present invention; DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] See also Figure 1 As shown, a program static analysis solution guidance system based on rule-based multi-dimensional indicators is characterized in that the system includes:

[0041] The selection module is used to provide users with usage scenario options. These usage scenarios may be certain specific fields or certain specific usage occasions, such as aviation, aerospace, finance, communications, daily life, emergency, etc. It includes both the default content provided by the system and supports user customization to guide users to make choices.

[0042] The collection module is used to collect the scene selection results of users, and divide the measurement of rules into several dimensional indicators according to the scene selection results of users; according to the scene selection results of users, the default values ​​and default priority relationships of different dimensional indicators in different user scenes can be obtained. According to the different aspects that users are concerned about, the measurement of rules is divided into several dimensions, such as: quality category, impact, repair difficulty, accuracy, resource consumption

[0043] The generation module is used to set default values ​​for different dimensional indicators based on the survey of user selection scenarios, and to generate default priority relationships for dimensional indicators related to rule configuration;

[0044] The optimization module is used to adjust the dimension default values ​​and priority relationships according to the actual needs of users, mainly to facilitate users to adjust the values ​​and priority relationships of the above indicators as needed according to different actual situations, and increase the flexibility of the system. Map the dimension indicators to the underlying rule indicators, and select the required rules and configurations. The usage scenario options include system default options and user-defined options.

[0045] Through the above technical solution, this embodiment provides a program static analysis solution guidance system based on rule-based multi-dimensional indicators. The system is suitable for different user scenarios and can be flexibly adjusted by users. Dimension indicators are obtained by comprehensively considering user needs, and they comprehensively measure the rules from different angles. On this basis, the system sets default values ​​and default priority relationships for each dimensional indicator of different user scenarios. Users can make fine adjustments as needed on this basis to generate the required analysis plan, which is convenient and fast. The analysis plan is obtained by mapping dimensional indicators to the underlying indicators of the rules. Users do not need to pay attention to the complicated underlying rule indicators or the effectiveness of headache rules. They only need to control the dimensional indicators to obtain the desired analysis plan.

[0046] like Figure 2 , 3 As shown, the dimensional indicators include: dimensional indicators that are not related to the rule configuration: quality category, impact and repair difficulty; dimensional indicators that are related to the rule configuration: accuracy and resource overhead. Through the above technical scheme, this embodiment provides the specific content of the dimensional indicators. Taking into account the impact of different rule configurations, the resulting analysis scheme is more in line with user expectations. The indicators are divided into two categories: those related to the configuration and those not related to it. For irrelevant indicators, they are directly applied to the screening of rules. For relevant indicators, the appropriate configuration is selected according to its priority, and then the rules are screened.

[0047] The mapping relationship between dimension indicators that are not related to rule configuration and the underlying indicators of rules is:

[0048] Based on the quality issues that users are concerned about, quality categories are classified and corresponding quality category labels are attached to the rules: defects, safety, and maintainability; the underlying indicators corresponding to defects, safety, and maintainability are: severity, risk level, and maintainability level. It should be noted that each rule can belong to one or more quality categories.

[0049] By weighting the quality categories, different impact levels of the rules are obtained;

[0050] Taking into account the cost of repairing rules and the difficulty of understanding them, the difficulty of repairing rules is divided into: simple, medium and difficult. The specific division scheme is:

[0051]

[0052] Through the above technical solution, this embodiment provides a mapping relationship between dimensional indicators that are independent of rule configuration and underlying indicators of rules.

[0053] The impact is divided into three levels: high, medium and low.

[0054] The impact of a rule is calculated as follows:

[0055] Considering that the same rule has different impacts from different perspectives, if the user is concerned about both defects and safety, the impact of a rule that only affects defects and a rule that affects both defects and safety should be different.

[0056] The impact level of a rule is calculated as follows:

[0057] According to the quality category set C that the user is concerned about, n}, calculate the impact level value for each rule:

[0058]

[0059] Among them, w(C i ) is quality category C i The preset weights under the selected user scenario can be set according to different user scenarios, such as one of the following settings:

[0060] Quality Category <![CDATA[Weight (w(C i ))]]> defect 2 Safety 1 Maintainability 0.5

[0061] f(Ci) is the rule in quality category C i Below, the value of the level corresponding to the underlying indicator is:

[0062] Quality Category Corresponding underlying indicators defect Severity Safety Risk Level Maintainability Maintainability level

[0063]

[0064]

[0065] Value is the evaluation value, which is compared with the preset threshold range to obtain the impact level G(rule) of the rule:

[0066]

[0067] Through the above technical solution, this embodiment provides a mapping relationship between dimensional indicators that are independent of rule configuration and underlying indicators of rules.

[0068] The mapping relationship between the dimension indicators related to rule configuration and the underlying indicators of the rules includes:

[0069] Taking into account the false alarm rate and false negative rate of the rules, the accuracy of the rules is divided into medium and high. The specific measurement scheme of the division is as follows:

[0070]

[0071] Resource overhead is used to measure the time and space cost of a rule when performing analysis. The resource overhead level D is calculated by the formula D = max(A, B), where A is the corresponding level value of CPU overhead under a certain configuration of the rule; B is the corresponding level value of storage overhead under a certain configuration of the rule. Secondly, select the desired rules and their configuration methods according to the priority of different dimensions, such as Figure 3 Through the above technical solution, this embodiment provides an indicator mapping relationship related to rule configuration.

[0072] The process of selecting the required rules and appropriate configurations is as follows: Step 1, sort the dimensions according to priority, traverse the dimensions with high priority in turn, use them to map with the underlying indicators of the rules under different configurations, and obtain the desired combination of rules and rule configurations; Step 2, the dimensions with low priority are carried out based on the screening results with high priority, and step 1 is repeated until the relevant dimensions are traversed. Through the above technical solution, this embodiment can obtain the rules and rule configurations corresponding to the usage scenario selected by the user and generate an analysis plan.

[0073] The execution method steps of the program static analysis solution guidance system based on rule-based multi-dimensional indicators provided by the present invention are as follows:

[0074] S10. Provide some user scenarios to guide users to make choices;

[0075] S20, obtaining default values ​​and default priority relationships of different dimension indicators in different user scenarios;

[0076] S30, guiding the user to make adjustments as needed, mainly to facilitate the user to adjust the values ​​and priority relationships of the above indicators as needed according to different actual situations, thereby increasing the flexibility of the system;

[0077] S40, mapping the dimension indicators to the underlying rule indicators, selecting the required rules and appropriate configurations; according to whether they are related to the rule configuration, they are divided into S100, indicators unrelated to the rule configuration, and S200, indicators related to the rule configuration;

[0078] S50: Obtain corresponding rules and rule configurations, and generate an analysis plan.

[0079] The present invention may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0080] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0081] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0082] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A program static analysis solution guidance system based on rule-based multi-dimensional indicators, characterized in that: The system comprises: Selection module, used to provide users with usage scenario options; The collection module is used to collect the scene selection results of the user and divide the measurement of the rule into several dimensional indicators according to the scene selected by the user; The generation module is used to set default values ​​for different dimensional indicators based on the survey of user selection scenarios, and to generate default priority relationships for dimensional indicators related to rule configuration; The optimization module is used to adjust dimension default values ​​and priority relationships according to actual user needs, map dimension indicators to underlying rule indicators, and select required rules and configurations.

2. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 1, characterized in that: The usage scenario options include system default options and user-defined options.

3. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 2, characterized in that: The dimension indicators include: Dimensional indicators that are not related to rule configuration: quality category, impact, and repair difficulty; Dimensional metrics related to rule configuration: precision and resource overhead.

4. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 3, characterized in that: The mapping relationship between dimension indicators that are not related to rule configuration and the underlying indicators of rules is: Based on the quality issues that users are concerned about, quality categories are classified and corresponding quality category labels are attached to the rules: defects, safety, and maintainability; the underlying indicators corresponding to defects, safety, and maintainability are severity, risk level, and maintainability level respectively; By weighting the quality categories, different impact levels of the rules are obtained; Taking into account the cost of rule repair and the difficulty of understanding, the difficulty of rule repair is divided into: simple, medium and difficult.

5. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 4, characterized in that: The process of obtaining different impact levels of rules by weighted calculation of quality categories is as follows: According to the quality category set C that the user is concerned about, n }, calculate the impact level value for each rule: Among them, w(C i ) is quality category C i The preset weight in the selected user scenario; f(Ci) is the rule in quality category C i The value is the evaluation value. The evaluation value is compared with the preset threshold range to obtain the impact level of the rule.

6. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 5, characterized in that: The mapping relationship between the dimension indicators related to rule configuration and the underlying indicators of the rules includes: Taking into account the false positive rate and false negative rate of the rules, the accuracy of the rules is divided into: medium and high The resource cost level D is calculated by the formula D=max(A,B), where A is the corresponding level value of the CPU cost under a certain configuration of the rule; B is the corresponding level value of the storage cost under a certain configuration of the rule.

7. A program static analysis solution guidance system based on rule-based multi-dimensional indicators according to claim 6, characterized in that: The process of selecting the required rules and appropriate configuration is: Step 1: Sort the dimensions by priority, traverse the dimensions with high priority in turn, and use them to map with the underlying indicators of rules under different configurations to obtain the desired rules and rule configuration combinations; Step 2: Dimensions with low priority are filtered based on the results of the dimensions with high priority. Repeat step 1 until all relevant dimensions are traversed.

Images