Static Code Alert Ranking with Execution Behavior Graphs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Static code analysis tools generate a large number of false positives, leading to inefficiencies and manual inspection burdens, as current prioritization methods fail to consider contextual information like code criticality and execution likelihood.

Innovation Solution

A novel ranking and prioritization approach using Control Flow Graphs and Program Dependence Graphs to compute metrics for source code, combining execution likelihood, data flow analysis, and user-defined objectives to prioritize alerts effectively.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static code analysis tools use multiple analysis techniques to cover more vulnerability types, then the coverage of defect detection is improved, but the number of false positives increases

Engineering Contradiction:

Improvedefect detection coverageVSAvoidfalse positives

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The patent changes the parameter of alert prioritization from simple severity-based ranking to a comprehensive scoring system that incorporates execution likelihood, code criticality, and alert characteristics. This reparameterization allows the system to maintain high defect detection coverage while reducing the harmful impact of false positives by prioritizing truly significant issues.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent introduces an intermediary prioritization layer between static code analysis and manual review. This intermediary system computes execution likelihood using control flow graphs and program dependence graphs, then ranks alerts based on multiple factors including code criticality and alert characteristics. This intermediary filtering mechanism reduces false positive impact before they reach developers.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If static code analysis tools generate comprehensive alerts for all potential issues, then the completeness of code review is improved, but the time and resources required for manual inspection increase

Engineering Contradiction:

Improvecode review completenessVSAvoidmanual inspection time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by computing execution likelihood and code criticality metrics before alert generation and prioritization. Control flow graphs and program dependence graphs are constructed in advance, and execution paths are analyzed beforehand to determine which alerts are most likely to be true positives. This preliminary analysis enables developers to focus on high-priority alerts first, reducing manual inspection time while maintaining review completeness.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent changes the parameter of alert presentation from unranked or severity-only ordering to a multi-dimensional prioritization score that incorporates execution likelihood, code criticality, and alert characteristics. This parameter transformation allows developers to efficiently navigate through comprehensive alert sets by focusing on the most significant issues first, thereby reducing manual inspection time without sacrificing completeness.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If static code analysis tools use heuristics and approximations to improve analysis speed, then the analysis efficiency is improved, but the precision of issue identification decreases

Engineering Contradiction:

Improveanalysis speedVSAvoidissue identification accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent changes the parameter of alert evaluation from relying solely on static analysis precision to incorporating execution likelihood computed through control flow and dependence analysis. Even when static analysis uses heuristics and approximations, the subsequent prioritization system compensates by analyzing execution paths and code criticality, thereby recovering precision in issue identification without sacrificing analysis speed.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent introduces feedback mechanisms where execution likelihood and code criticality metrics are computed based on control flow graphs and program dependence graphs, then used to adjust alert prioritization. This feedback loop compensates for imprecision in static analysis heuristics by providing additional contextual information about which alerts are most likely to represent real issues, thereby improving issue identification accuracy while maintaining analysis efficiency.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12461844B2Method, apparatus, and system for determining relative importance of computer code analysis alerts

Publication Date: 2025.11.04 SAUDI ARABIAN OIL CO

AI summary

A computing apparatus and method adapted to obtain an identification of computer code for analysis; retrieve the computer code based on the identification; generate an abstract program representation of the retrieved computer code; conduct execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code; obtain a plurality of alerts generated from one or more static code analysis processes that are performed on the computer code; compute respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior; rank the plurality of alerts by the computed alert metrics; and output a ranked list of the plurality of alerts.