Hybrid Program Analysis for Precision Code Constructs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Static program analysis faces undecidability issues, leading to imprecise results for problems like pointer analysis and reflective calls, with two-stage analysis providing a compromise but still suffering from loss of precision.

Innovation Solution

A hybrid program analysis method that initiates static analysis and dynamically generates queries for a dynamic program analyzer to resolve specific code constructs, allowing precise input arguments and concise answers by specializing dynamic analysis for the query at hand.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If static program analysis is used to analyze code constructs, then the analysis can be performed without executing the application, but the precision of the analysis results deteriorates due to undecidability issues

Engineering Contradiction:

Improveanalysis execution requirementVSAvoidanalysis result precision

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent introduces a hybrid program analyzer that acts as an intermediary between static and dynamic analysis. The static program analyzer identifies code constructs requiring dynamic analysis and generates queries, while the dynamic program analyzer executes the application with synthesized inputs to answer these queries. This intermediary hybrid system resolves the contradiction by coordinating both analysis approaches to achieve precision without requiring full dynamic execution.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the program analysis process into distinct phases: static analysis phase for identifying code constructs and generating queries, and dynamic analysis phase for executing the application with synthesized inputs to answer queries. This segmentation allows each phase to specialize in its strength while avoiding its weaknesses, resolving the precision-execution requirement contradiction.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If dynamic program analysis is used to determine precise input arguments, then the precision of analysis results improves, but the complexity of the analysis process increases

Engineering Contradiction:

Improveinput argument precisionVSAvoidanalysis process complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by using the static program analyzer to identify code constructs requiring dynamic analysis and generate queries before executing the dynamic analysis. This preliminary static analysis phase prepares the groundwork by determining which specific code constructs need precise dynamic analysis, thereby reducing the overall complexity compared to performing comprehensive dynamic analysis on all code constructs.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements partial action by applying dynamic program analysis only to specific code constructs identified by the static analyzer, rather than performing full dynamic analysis on the entire application. This selective approach achieves necessary precision for critical code constructs while avoiding the excessive complexity of comprehensive dynamic analysis.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If two-stage analysis is used to perform dynamic analysis first then static analysis, then the precision improves compared to pure static analysis, but the loss of precision remains due to unsound approximation

Engineering Contradiction:

Improveanalysis result precisionVSAvoidprecision loss

Core Design Contradiction:

Measurement precisionVSLoss of information

Solution Approach 1:

The patent inverts the conventional two-stage analysis approach by performing static analysis first to identify code constructs and generate queries, then performing targeted dynamic analysis to answer these queries. This inversion resolves the precision loss problem by using static analysis to guide dynamic analysis, ensuring that dynamic execution is applied only where necessary to answer specific queries, thereby minimizing information loss while maintaining soundness.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS10275238B2Hybrid program analysis

Publication Date: 2019.04.30 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A hybrid program analysis method includes initiating a static program analysis of an application, generating, by a static program analyzer, a query to a dynamic program analyzer upon determining a code construct of the application requiring dynamic analysis, resolving, by the dynamic program analyzer, the query into a set of arguments with which to invoke the code construct of the application, generating, by the dynamic program analyzer, the set of arguments, invoking, by the dynamic program analyzer, the code construct of the application using set of arguments, answering, by the dynamic program analyzer, the query, and continuing the static program analysis of the application.