Static Program Analysis Report Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static code analysis tools often produce a high number of false reports due to over-approximations, leading to cluttered and difficult-to-use vulnerability reports, making it hard to identify actual security issues and take remediation actions.
Innovation Solution
Performing multiple analyses at differing levels of precision and mapping findings to generate a concise combination report that groups similar violations together, suppressing less important findings and linking them to more detailed reports for important ones, allowing for easier identification of root causes and actionable remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis tools use over-approximations to bound the state space, then the analysis can handle infinite state spaces and provide safety guarantees, but the number of false reports increases significantly
Solution Approach 1:
The patent segments the analysis into multiple levels (high-level and low-level analyses) with different approximation strengths. The high-level analysis uses strong over-approximations for safety guarantees, while the low-level analysis uses weaker approximations to reduce false reports. This segmentation allows the system to maintain reliability where needed while reducing harmful false reports in other areas.
Solution Approach 2:
The patent applies different analysis precision locally to different parts of the program. Critical sections requiring safety guarantees receive high-level analysis with strong over-approximations, while less critical areas receive low-level analysis with weaker approximations. This local differentiation allows the system to maintain reliability where needed while reducing false reports in other areas.
2Loss of information
If static analysis tools report all detected violations, then the completeness of the report is high, but the usability decreases due to the large size and poor quality of findings
Solution Approach 1:
The patent extracts and separates high-quality findings from low-quality false reports by performing multiple analyses at different levels. The mapping module identifies and extracts only the most relevant findings (those confirmed by multiple analyses or having high confidence) while filtering out spurious reports, thereby maintaining information completeness for valid issues while improving usability by removing noise.
Solution Approach 2:
The patent merges results from multiple analyses (high-level and low-level) through a mapping module that consolidates findings. By combining the strengths of both analysis levels, the system produces a unified report that maintains completeness through comprehensive coverage while improving usability through deduplication and prioritization of high-confidence findings.
3Productivity
If the analysis uses stronger approximations to bound the state space, then the analysis speed increases, but the precision of the analysis decreases
Solution Approach 1:
The patent applies partial analysis precision selectively. The high-level analysis uses stronger (coarser) approximations for faster execution, while the low-level analysis uses weaker (finer) approximations for higher precision where needed. This partial application of precision allows the system to achieve good productivity overall while maintaining sufficient precision for critical verification tasks.
Data Source
AI summary
Systems for program analysis include a high-level scanning tool configured to perform a high-level analysis on a program using a processor to generate one or more high-level findings; one or more low-level scanning tools, each configured to perform a low-level analysis on the program using a processor to generate a low-level finding; and a mapping module configured to map the one or more low-level findings to the high-level findings to generate a concise combination report that categorizes each finding according to the highest-level analysis that produces the finding.