Static Analysis Warning Review Interface with Contextual Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static analysis tools generate numerous warnings that require manual review, which is time-consuming, error-prone, and lacks assisting information, making it difficult for users to determine whether program points are safe or unsafe, especially in large software applications.
Innovation Solution
A system and method that includes a processor with modules for selecting and determining review-assisting information, which transitively locates modification points and controlling conditions to help users judge the safety of program points, and a user-interface module that filters out non-useful information to display relevant modification points and controlling conditions, indicating root-causes for warnings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis tools are used to detect programming bugs, then detection capability is improved, but the number of warnings generated increases
Solution Approach 1:
The patent segments the large set of warnings into smaller groups based on their program points and associated variables. By organizing warnings into manageable segments with shared characteristics, reviewers can focus on one group at a time, reducing the cognitive load and making the review process more efficient despite the large number of warnings generated.
Solution Approach 2:
The patent extracts and displays only the relevant information needed for review (program point locations, variable names, modification points, control dependencies) while filtering out unnecessary details. This extraction of essential information from the full warning data helps reviewers quickly understand each warning without being overwhelmed by the complete set of warnings.
2Reliability
If manual review of warnings is performed, then verification accuracy is improved, but time consumption increases
Solution Approach 1:
The patent performs preliminary actions by automatically computing and displaying control dependencies, modification points, and variable value flows before the reviewer begins analysis. This pre-computation of relevant information saves reviewers from manually tracing through code to understand warning contexts, significantly reducing review time while maintaining accuracy.
Solution Approach 2:
The patent introduces an intermediary system (the review interface with automated analysis components) that mediates between the static analysis tool and the human reviewer. This intermediary automatically performs code traversal, variable tracking, and control flow analysis, providing reviewers with pre-processed information that reduces their manual effort and time consumption.
3Measurement precision
If code traversal is performed to collect information, then review accuracy is improved, but effort and time increase
Solution Approach 1:
The patent implements self-service by enabling the review system to automatically perform code traversal, variable tracking, and control dependency analysis without requiring manual reviewer intervention. The system autonomously computes modification points, traces variable flows, and identifies control conditions, freeing reviewers from tedious manual code navigation while maintaining high review accuracy.
Solution Approach 2:
The patent introduces an intermediary automated analysis system that performs code traversal and information collection on behalf of the reviewer. This intermediary handles the time-consuming tasks of tracking variable modifications and analyzing control flows, providing reviewers with ready-analyzed information that maintains accuracy without requiring manual code exploration.
4Loss of information
If all modification points are displayed, then completeness of information is improved, but information overload increases
Solution Approach 1:
The patent applies local quality by differentiating between relevant and irrelevant modification points based on their relationship to the warning's program point and variable. Rather than uniformly displaying all modification points, the system selectively highlights those that are locally relevant to understanding the specific warning, reducing information overload while maintaining necessary completeness.
Solution Approach 2:
The patent extracts and displays only the modification points that are relevant to the specific warning being reviewed, filtering out unrelated modifications. This selective extraction presents a manageable subset of information that maintains completeness for the specific warning context without overwhelming the reviewer with all possible modification points in the codebase.
Data Source
AI summary
A system and method for facilitating verification of software code. A first program point is selected, from the software code, indicating static analysis warning to be reviewed. Further, review-assisting information including at least one of a set of modification points and a controlling condition are determined for the user to judge whether the warning generated is safe or unsafe. From the set of modification points, non-useful modification points may be filtered out in order to determine only relevant modification points. After filtering, the system presents the review-assisting information (relevant modification points and controlling conditions) in a systematic manner to the user for facilitating verification of the software code.