Static Analysis False Positive Elimination via CNV Variables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis tools generate a large number of false positives during code analysis, leading to high costs for manual review and inefficiencies in model checking due to scalability issues.
Innovation Solution
A system and method that identifies redundant verification calls by computing complete-range non-deterministic value variables through data flow analysis, checks their status, and skips unnecessary model checker calls to eliminate false positives efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If model checking is used to verify assertions to eliminate false positives, then precision is improved, but productivity deteriorates due to scalability issues and state space explosion
Solution Approach 1:
The patent applies preliminary action by performing data flow analysis before model checking to identify CNV variables. This pre-analysis prepares the system by marking variables that receive arbitrary values from outside the context, allowing the model checker to skip redundant verification calls and focus only on necessary assertions, thus improving productivity while maintaining precision
Solution Approach 2:
The patent implements partial action by selectively applying model checking only to assertions involving non-CNV variables. Instead of verifying all assertions through model checking (excessive action), the system performs partial verification on a subset of critical assertions, reducing the verification burden and improving productivity while maintaining sufficient precision through targeted analysis
2Measurement precision
If calling context is expanded to include more callers in model checking, then precision is improved, but productivity deteriorates due to increased verification time
Solution Approach 1:
The system performs preliminary data flow analysis to identify CNV variables before model checking. This pre-marking of variables with arbitrary values allows the model checker to operate with minimal calling context (only the immediate function), eliminating the need to expand context to multiple callers while maintaining precision through the CNV variable mechanism
Solution Approach 2:
The patent segments the verification process into two distinct phases: (1) data flow analysis phase that identifies and marks CNV variables, and (2) model checking phase that verifies only non-CNV variables with minimal context. This segmentation allows precision to be achieved through the combination of both phases without the time penalty of expanding calling context in the model checking phase
3Measurement precision
If multiple calls to model checker are made for the same assertion, then precision is improved, but productivity deteriorates due to redundant verification
Solution Approach 1:
The patent applies preliminary action by marking CNV variables through data flow analysis before model checking. This pre-identification allows the system to recognize that multiple verification calls for assertions involving only CNV variables are redundant, as these variables inherently take arbitrary values. The model checker is called only once for non-CNV variables, eliminating redundant calls and improving productivity while maintaining precision
Data Source
AI summary
A method and a system is disclosed herein for model checker based efficient elimination of false positives from static analysis warnings generated during static analysis of an application code. The system computes complete-range non-deterministic value variables (cnv variables) that are based on data flow analysis or static approximation of execution paths by control flow paths. During computation of cnv variables, over approximation (may-cnv variables) and under approximation (must-cnv variables) of a set of cnv variables at a program point is identified. The computed cnv variables are used to check whether an assertion variable is a cnv variable and the corresponding assertion verification call is redundant or otherwise. The identified redundant calls are then skipped for the efficiency of the false positives elimination and the model checker is invoked corresponding to the non-redundant assertion verification calls.