Problem library-based multi-source static analysis tool chain collaborative coding detection method

Abstract

The invention provides a multi-source static analysis tool chain collaborative coding detection method based on a problem library, which adopts a modular design: the problem library, a problem source code library, a rule library and a strategy module are mutually independent and cooperatively work, and are convenient to maintain and expand; a dynamic updating mechanism: a problem library, a problem source code library and a rule library support dynamic inclusion and review, and adapt to a new technology and a new defect mode; the integration process is seamlessly integrated with the CI / CD process, and automatic detection is achieved. The problems that a multi-source static analysis tool is low in cooperation efficiency, multiple in detection blind area and large in resource consumption are solved, and early-stage, accurate and efficient detection and prevention of coding defects are achieved. The defect detection rate and the early-stage discovery capability are improved; repeated alarms are reduced, and the analysis efficiency is improved; specific defects are covered, and the fault occurrence rate is reduced; and a continuously improved quality closed loop is formed.

Description

Technical Field

[0001] This invention relates to the field of aerospace software testing, specifically to a collaborative coding detection method based on a multi-source static analysis toolchain with a problem database. It is applicable to the detection and prevention of coding defects in high-reliability software, and is particularly suitable for fields with extremely high code quality requirements, such as aerospace, military, and embedded systems. Background Technology

[0002] The tools are silos: the rule bases of various static analysis tools (such as LDRA Testbed, Coverity, etc.) overlap, resulting in duplicate alarms, redundant reports, and a large workload for engineers to identify.

[0003] There are blind spots in the detection: the general rule base cannot cover the unique defects of specific business scenarios and architectures.

[0004] Resource input and output mismatch: The full toolchain scanning mode is time-consuming and labor-intensive, with a low input-output ratio. Summary of the Invention

[0005] To address the problems of existing technologies, this invention provides a collaborative coding detection method based on a problem database and a multi-source static analysis toolchain. This method solves the problems of low collaborative efficiency, numerous detection blind spots, and high resource consumption associated with multi-source static analysis tools, enabling early, accurate, and efficient detection and prevention of coding defects. It improves defect detection rate and early discovery capabilities; reduces duplicate alarms and increases analysis efficiency; covers specific defects and reduces failure rates; and forms a continuous quality improvement loop.

[0006] The technical solution of this invention is: a multi-source static analysis toolchain collaborative coding detection method based on a problem database, the specific steps of which are as follows:

[0007] Step 1: Construct a database of typical software coding problems: Collect, classify, and standardize real code defect cases through a regular collection and dynamic inclusion mechanism;

[0008] Step 2: Based on the problem library described in Step 1, establish a typical problem source code library as the input database for subsequent tool capability comparison experiments.

[0009] Step 3: Tool Capability Comparison Experiment: Based on the problem source code library described in Step 2, the detection rate, false alarm rate, and efficiency of each static analysis tool are evaluated horizontally.

[0010] Step 4: Custom rule development: Develop dedicated detection rules to address the blind spots of static analysis tools, forming a proprietary rule library that is then loaded into the static analysis tools;

[0011] Step 5: Develop a collaborative detection strategy for the toolchain: Define the scanning scope, execution order, and result merging rules for each static analysis tool;

[0012] Step Six: Integration and Continuous Improvement: Integrate the custom rules described in Step Four into the CI / CD process and establish a dynamic update mechanism for the issue database.

[0013] Furthermore, the specific detection rules described in step four include state machine transition defects and protection against unsigned number subtraction.

[0014] The beneficial effects of this invention are: it provides a collaborative coding detection method based on a multi-source static analysis toolchain using a problem database.

[0015] Structural advantages:

[0016] 1. Modular design: The issue database, issue source code database, rule database, and strategy module are independent yet work together, facilitating maintenance and expansion;

[0017] 2. Dynamic update mechanism: The issue database, issue source code database, and rule database support dynamic inclusion and review to adapt to new technologies and new defect patterns;

[0018] 3. Integrated Process: Seamlessly integrates with CI / CD processes to achieve automated testing.

[0019] Functional advantages:

[0020] 1. Defect detection rate increased by more than 60%;

[0021] 2. Static analysis time is reduced by approximately 40%;

[0022] 3. Achieve a shift from "resetting to zero" to "prevention before the event". Attached Figure Description

[0023] Figure 1 This is a flowchart of a collaborative coding detection method based on a multi-source static analysis toolchain with a problem database. Detailed Implementation

[0024] The present invention will now be further described with reference to the accompanying drawings.

[0025] like Figure 1 As shown, the multi-source static analysis toolchain-based collaborative coding detection method based on a problem database has the following specific steps:

[0026] Step 1: Construct a database of typical software coding problems: Collect, classify, and standardize real code defect cases through a regular collection and dynamic inclusion mechanism;

[0027] Step 2: Based on the problem library described in Step 1, establish a typical problem source code library as the input database for subsequent tool capability comparison experiments.

[0028] Step 3: Tool Capability Comparison Experiment: Based on the problem source code library described in Step 2, the detection rate, false alarm rate, and efficiency of each static analysis tool are evaluated horizontally.

[0029] Step 4: Custom rule development: Develop dedicated detection rules (such as state machine transition defects, unsigned number subtraction protection, etc.) to address the blind spots of static analysis tools, and load them into a dedicated rule library.

[0030] Step 5: Develop a collaborative detection strategy for the toolchain: Define the scanning scope, execution order, and result merging rules for each static analysis tool;

[0031] Step Six: Integration and Continuous Improvement: Integrate the custom rules described in Step Four into the CI / CD process and establish a dynamic update mechanism for the issue database.

[0032] In this embodiment, the problem database is used as a benchmark to drive tool evaluation and rule development: The problem database provides real defect samples, based on which a problem source code library is written, and a link is established between the typical problem database and the detection tools, so that the tool comparison is objective and the blind spots of general tools are identified.

[0033] Custom rules based on defect pattern matching: By analyzing typical defects in the issue database, extracting their code features, and writing rules to implement pattern matching, unique defects that cannot be detected by general tools can be covered.

[0034] Collaborative strategies are based on tool capability data: Based on the results of comparative experiments, tool scanning tasks are allocated reasonably to avoid duplication and improve efficiency.

[0035] The continuous integration mechanism enables closed-loop feedback: new issues are continuously added to the issue database through processes, driving the dynamic updating of rules and strategies, and forming a self-evolving detection system.

[0036] Example 1

[0037] In the satellite control software project: A state machine transition defect in a certain model's bus communication protocol was addressed by successfully detecting and preventing potential faults through custom rules, resulting in a decrease of over 60% in the number of faults in the test field.

[0038] Example 2

[0039] In a continuous integration environment: Each code commit triggers a collaborative detection process, quickly outputting a merged analysis report, allowing engineers to immediately locate and fix defects, significantly shortening the debugging cycle.

[0040] Example 3

[0041] During the initial phase of a new project: Directly reference the issue and rule bases to prevent similar errors from recurring and improve the baseline of code quality.

[0042] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-source static analysis toolchain collaborative coding detection method based on a problem database, characterized in that, The specific steps are as follows: Step 1: Construct a database of typical software coding problems: Collect, classify, and standardize real code defect cases through a regular collection and dynamic inclusion mechanism; Step 2: Based on the problem library described in Step 1, establish a typical problem source code library as the input database for subsequent tool capability comparison experiments. Step 3: Tool Capability Comparison Experiment: Based on the problem source code library described in Step 2, the detection rate, false alarm rate, and efficiency of each static analysis tool are evaluated horizontally. Step 4: Custom rule development: Develop dedicated detection rules to address the blind spots of static analysis tools, forming a proprietary rule library that is then loaded into the static analysis tools; Step 5: Develop a collaborative detection strategy for the toolchain: Define the scanning scope, execution order, and result merging rules for each static analysis tool; Step Six: Integration and Continuous Improvement: Integrate the custom rules described in Step Four into the CI / CD process and establish a dynamic update mechanism for the issue database.

2. The multi-source static analysis toolchain cooperative coding detection method based on a problem database according to claim 1, characterized in that: The specific detection rules described in step four include state machine transition defects and protection against unsigned number subtraction.

Images