Active Code Static Testing via Runtime Monitoring
Solution Overview
Problem
Existing software testing methods, particularly static testing, often require access to source code and do not effectively analyze dynamically generated code or identify active code during application execution, leading to inefficiencies in detecting errors and performance issues in complex distributed applications.
Innovation Solution
Monitoring deployed code during execution to identify active code, including dynamically generated code, and using breakpoints or instrumentation to collect test code for static analysis, allowing for targeted error detection and performance profiling across multiple application tiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static testing is performed on all deployed code, then testing coverage is improved, but testing efficiency deteriorates due to analyzing inactive code
Solution Approach 1:
The deployed code is segmented into active and inactive portions based on runtime monitoring. The system divides the codebase into segments that are actually executed versus those that are not, allowing testing resources to be focused only on the relevant active segments rather than analyzing the entire codebase.
Solution Approach 2:
Instead of performing static testing on all deployed code (excessive action), the system performs testing only on the portion of code that is actively executed (partial action). This is achieved by monitoring runtime execution to identify active code segments, then applying static testing selectively to those segments alone.
2Reliability
If static testing includes dynamically generated code, then testing completeness is improved, but testing complexity worsens
Solution Approach 1:
The system performs preliminary runtime monitoring to identify and capture dynamically generated code before static testing begins. By monitoring the application during execution, the system collects all dynamically generated code segments in advance, making them available for subsequent static analysis without adding complexity to the testing process itself.
Solution Approach 2:
Runtime monitoring acts as an intermediary between the application execution and static testing. This intermediary component captures dynamically generated code during runtime and passes it to the static testing system, bridging the gap between dynamic code generation and static analysis without requiring direct integration between these disparate processes.
3Measurement precision
If code monitoring is performed during execution, then code identification accuracy is improved, but system performance worsens
Solution Approach 1:
Instead of monitoring the actual executing code directly (which would impact performance), the system creates a copy of the deployed code with monitoring instrumentation embedded. This instrumented copy runs alongside the original code, allowing accurate identification of active code segments without interfering with the performance of the actual application execution.
Data Source
AI summary
A code deployment system deploys code to a set of application systems that execute the application, which may be across several tiers of systems that service requests related to the application. At each system, the application executes and is analyzed during execution to determine active code that is loaded by the application during execution, which may include dynamically-generated code. The active code is then analyzed using static analysis to determine security vulnerabilities and errors in the code that was loaded and operated at each application tier. The active code may also be associated with a specific use case or set of inputs that were applied to the application during the monitoring.