Probabilistic Call-Graph Construction for Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing static analysis techniques for object-oriented programs face challenges in constructing precise call graphs due to dynamic dispatches, leading to over- or under-approximation of calling relationships, which affects their accuracy and scalability, especially when analyzing incomplete program code like libraries.
Innovation Solution
A probabilistic-based static analysis technique constructs a call graph by quantifying the probabilities of calling relationships, allowing for prioritization and inclusion of uncertain call relationships, using a type-propagation graph that represents program variables and their types, and propagates type tuples to refine the call graph based on user-configurable criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis techniques make overly-pessimistic assumptions to cover all possible calling relationships from dynamic dispatches, then the call graph becomes highly-inclusive and covers more potential relationships, but the precision decreases because it includes call relationships that would never occur in actual runs
Solution Approach 1:
The patent changes the parameter of call relationship representation from binary (present/absent) to probabilistic (0-1 probability). Each call edge is assigned a probability value indicating the likelihood of that call occurring at runtime, allowing the system to maintain both completeness (all possible calls are represented) and precision (probability values indicate actual likelihood). This resolves the contradiction by transforming the nature of the data rather than choosing between the two extremes.
2Measurement precision
If static analysis techniques omit call relationships that are not sure to be present at run-time, then the call graph becomes more precise, but it under-estimates call relationships and does not completely represent the modeled program
Solution Approach 1:
The patent transforms call relationship data from binary to probabilistic, allowing the system to include all potential call relationships while indicating their likelihood through probability values. This resolves the contradiction by enabling both precision (through probability indication) and completeness (through inclusion of all possible calls).
Solution Approach 2:
The patent takes an excessive action by including all possible call relationships in the call graph, even those with low probability. Rather than filtering out uncertain relationships, it includes them all with appropriate probability markings, allowing consumers to filter based on their needs. This resolves the contradiction by providing complete information with precision indicators.
3Reliability
If whole program analysis is performed to generate comprehensive call graphs, then more complete information about calling relationships is obtained, but the analysis becomes computationally expensive and not available for analyzing libraries
Solution Approach 1:
The patent performs partial analysis by analyzing only the portion of the program that is available (application code or library code separately), rather than requiring whole program analysis. It uses probabilistic modeling to compensate for the incomplete information, allowing the system to produce useful call graphs without the computational burden of analyzing entire programs including all libraries.
Solution Approach 2:
The patent introduces probability values as an intermediary that bridges the gap between incomplete static information and runtime behavior. This probabilistic mediator allows the system to work with partial information (from incomplete program code) and still produce meaningful results without requiring complete whole-program analysis.
4Reliability
If call graphs model very large object-oriented libraries with high inclusiveness, then more potential call relationships are captured, but the call graph contains more information than could feasibly be used by real-world applications
Solution Approach 1:
The patent changes the parameter of call relationship representation from binary to probabilistic, enabling the system to handle large libraries by providing probability-based filtering. Applications can use the probability values to filter out low-likelihood calls, reducing the effective complexity of the call graph while maintaining the option to include all relationships if needed.
Solution Approach 2:
The patent generates excessively inclusive call graphs that include all possible call relationships from large libraries, but provides probability information that enables consumers to take partial action by filtering based on their specific needs. This resolves the complexity issue by providing the full data set with tools for selective consumption.
Data Source
AI summary
Embodiments construct a precise and scalable call graph that models potentially incomplete object-oriented program code, including libraries. The call graph encodes the probabilities of call relationships in the graph, where the probabilities are based on context information from the program, and are adjusted based on client configurations. Embodiments derive topics to associate with unknown elements, as well as probabilities for those topics, from declared types of the unknown elements. Configuration information encodes sets of feature conditions that direct the weighting of the unknown element types. As embodiments propagate type tuples through the graph, the probabilities of the types for each node are recalculated based on the type/probability information for the predecessors of the node. Type/probability information joins are necessary for nodes with multiple dependencies, where the manner of the join is configurable by the client.