Static Source Code Analysis via Call Graph Symbolic Mapping

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional static analysis techniques face difficulties in inter-procedural analysis, particularly with mechanisms like indirect function calls, and are time-consuming compared to dynamic analysis.

Innovation Solution

The method involves identifying functions corresponding to function calls in source code, converting data into a symbolic form, and creating a modified model for static analysis, which includes replacing function calls with symbolic elements to enhance inter- and intra-procedural analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional static analysis techniques are used for inter-procedural analysis, then analysis can be performed without execution, but the analysis quality deteriorates when indirect function calls are involved

Engineering Contradiction:

Improveanalysis qualityVSAvoiddifficulty of handling indirect function calls

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces a call graph as an intermediary data structure that mediates between the static source code and the runtime behavior. The call graph captures function call relationships and resolves indirect calls by mapping them to concrete function pairs, enabling static analysis to handle complexity that would otherwise be undetectable without execution.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent performs preliminary actions by extracting and analyzing call graphs before the actual static analysis is performed. By pre-processing the source code to identify function call relationships and resolve indirect calls, the system prepares a structured representation that simplifies subsequent analysis while maintaining accuracy for complex call patterns.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If dynamic analysis is used to determine bugs in functions, then analysis can handle all function call mechanisms, but the analysis becomes very time consuming

Engineering Contradiction:

Improvebug detection capabilityVSAvoidanalysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent creates a simplified copy of the program's control flow through the call graph, which replicates the essential function call relationships without executing the actual code. This copy allows the system to analyze function interactions and detect bugs using static techniques, achieving the reliability of dynamic analysis while avoiding its time consumption.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces the mechanical execution process of dynamic analysis with a symbolic, graph-based representation system. Instead of actually running the code to observe behavior, the system uses the call graph to model and analyze function interactions, substituting runtime execution with static graph traversal and matching operations that are significantly faster.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If static analysis is performed without function call resolution, then analysis speed is maintained, but inter-procedural analysis accuracy deteriorates

Engineering Contradiction:

Improveanalysis speedVSAvoidinter-procedural analysis accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent segments the analysis process into distinct phases: first extracting the call graph to identify function call relationships, then using this segmented information to guide the inter-procedural analysis. This segmentation allows the system to maintain speed by processing the call graph separately while improving accuracy through the structured call relationship information.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent changes the parameters of the analysis by introducing the call graph as an additional data structure that captures function call relationships. By modifying the analysis to operate on both the source code and the call graph, the system improves inter-procedural accuracy without significantly impacting speed, as the call graph provides pre-computed relationship information that guides the analysis efficiently.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS7661097B2Method and system for analyzing source code

Publication Date: 2010.02.09 CISCO TECHNOLOGY INC

AI summary

Methods and systems are provided for analyzing a source code. The method includes collecting function entry information during the execution of tests on the source codes. The function entry information is then converted into symbolic codes. The function calls are replaced by the elements of the symbolic codes in the source codes. The elements can be in the form of functions. Subsequently, static analysis is performed on the source code by using the mapping between the function calls and the functions in the source code.