Software Immunization via Static and Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static program analysis often generates a high number of false-positives, leading to inefficient use of developer time as they must manually identify and correct potential code defects, while recurring defects in different parts of the code require similar effort to fix.
Innovation Solution
A system and method that combines static analysis with dynamic testing to prioritize and rank potential code defects, allowing developers to focus on actual defects and automatically apply fixes to similar defects identified elsewhere in the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If static program analysis is used to identify code defects, then a large number of potential defects can be discovered, but the number of false-positives increases significantly
Solution Approach 1:
The patent introduces an intermediary component that acts as a filter between static analysis and manual review. This intermediary automatically validates potential defects using additional analysis techniques, eliminating false-positives before they reach developers. The intermediary preserves the high detection quantity of static analysis while improving reliability by filtering out spurious results.
Solution Approach 2:
The patent replaces the manual mechanical review process with automated validation mechanisms. Instead of relying on developers to manually verify each potential defect (a time-consuming mechanical process), the system uses automated analysis tools to validate defects, thereby maintaining high detection rates while significantly improving accuracy and reducing false-positives.
2Reliability
If developers manually review and correct each potential defect, then defect accuracy can be ensured, but developer time and resources are wasted on false-positives
Solution Approach 1:
The patent introduces an intermediary validation layer that automatically verifies potential defects before presenting them to developers. This intermediary filters out false-positives, ensuring that only validated defects reach developers for review. This approach maintains high verification accuracy while dramatically reducing the time developers spend reviewing false-positives.
Solution Approach 2:
The patent performs preliminary validation of potential defects automatically before they reach the manual review stage. By conducting this preliminary action of validation upfront, the system ensures that only confirmed defects require developer attention, thereby maintaining accuracy while minimizing the time loss associated with manual review of false-positives.
3Manufacturing precision
If developers correct defects manually one by one, then each defect can be fixed accurately, but recurring defects require repeated manual effort
Solution Approach 1:
The patent implements a feedback mechanism that learns from corrected defects and applies the corrections automatically to similar recurring defects. When a defect is corrected, the system analyzes the correction pattern and uses it to identify and fix similar defects throughout the codebase, maintaining correction accuracy while dramatically improving productivity by eliminating repetitive manual work.
Solution Approach 2:
The patent uses copying by applying the correction pattern from one defect to multiple similar defects. Instead of manually correcting each recurring defect individually, the system copies the correction logic and applies it automatically to identical or similar defects elsewhere in the codebase, thereby maintaining precision while significantly boosting correction efficiency.
4Reliability
If static analysis is used extensively, then code quality can be improved, but the high number of false-positives reduces developer confidence and usage
Solution Approach 1:
The patent introduces an intermediary validation layer that filters out false-positives before they are presented to developers. This intermediary maintains the comprehensive code quality analysis provided by static analysis while improving ease of operation by ensuring that developers only see validated, high-confidence defects, thereby restoring developer confidence in the tool.
Solution Approach 2:
The patent converts the harmful effect of false-positives into a benefit by using the extensive static analysis capability to generate many potential defects, then systematically filtering them to reveal only the true issues. This approach maintains the advantage of comprehensive analysis while eliminating the disadvantage of false-positives, thereby improving both code quality and developer confidence.
Data Source
AI summary
Disclosed herein are systems, methods, and non-transitory computer-readable storage media for analyzing source code and identifying potential defects. The methods employ both static analysis and dynamic testing to detect program defects early in the development stage for better quality with less cost. The analysis also ranks identified potential defects and reports only the most likely defects to a human developer. Once defects are detected, they can be removed right away and similar defects can be prevented automatically.