Static Source Code Analysis Research Articles

Efficient hardware task migration for heterogeneous FPGA computing using HDL-based checkpointing

Task migration plays an important role in load balancing and energy savings in data centers. It also challenges service providers to minimize service interruptions during task migration. FPGA computing requires checkpointing as an essential function for hardware task migration. However, the current methods of implementing such a function for FPGAs have a high cost in hardware resources and significant degradation in performance. To overcome these problems, in this paper we propose a system using checkpointing at the hardware description language (HDL) level for hardware task migration. First, we propose a hardware task migration scheme in which checkpointing procedures and context transfer can overlap to reduce the service downtime. Second, we present a new checkpointing architecture for FPGAs that flattens the structure of nested modules at the HDL level. Third, we propose a static analysis of the original HDL source code to reduce the cost of hardware. Fourth, we introduce a Python-based tool to generate the checkpointing architecture at the HDL level. We evaluated our checkpointing architecture and the migration scheme using four application benchmarks running on a heterogeneous FPGA cluster. Our evaluations showed that the migration downtime was minimized at only 1.251 ms in the S-Search benchmark. When compared with a tree-based checkpointing architecture, the proposed architecture with the static analysis can reduce the LUT overhead by up to 50%, on the average. The checkpointing hardware caused small degradation in the maximum clock frequency (1.66% on the average), and consumed small memory footprints. Other comparisons with the previous hardware task migration scheme highlight the advantages of our migration scheme.

A RISC-V Processor Design for Transparent Tracing

Code instrumentation enables the observability of an embedded software system during its execution. A usage example of code instrumentation is the estimation of “worst-case execution time” using hybrid analysis. This analysis combines static code analysis with measurements of the execution time on the deployment platform. Static analysis of source code determines where to insert the tracing instructions, so that later, the execution time can be captured using a logic analyser. The main drawback of this technique is the overhead introduced by the execution of trace instructions. This paper proposes a modification of the architecture of a RISC pipelined processor that eliminates the execution time overhead introduced by the code instrumentation. In this way, it allows the tracing to be non-intrusive, since the sequence and execution times of the program under analysis are not modified by the introduction of traces. As a use case of the proposed solution, a processor, based on RISC-V architecture, was implemented using VHDL language. The processor, synthesized on a FPGA, was used to execute and evaluate a set of examples of instrumented code generated by a “worst-case execution time” estimation tool. The results validate that the proposed architecture executes the instrumented code without overhead.

A Comparative Study of Deep Learning-Based Vulnerability Detection System

Source code static analysis has been widely used to detect vulnerabilities in the development of software products. The vulnerability patterns purely based on human experts are laborious and error prone, which has motivated the use of machine learning for vulnerability detection. In order to relieve human experts of defining vulnerability rules or features, a recent study shows the feasibility of leveraging deep learning to detect vulnerabilities automatically. However, the impact of different factors on the effectiveness of vulnerability detection is unknown. In this paper, we collect two datasets from the programs involving 126 types of vulnerabilities, on which we conduct the first comparative study to quantitatively evaluate the impact of different factors on the effectiveness of vulnerability detection. The experimental results show that accommodating control dependency can increase the overall effectiveness of vulnerability detection F1-measure by 20.3%; the imbalanced data processing methods are not effective for the dataset we create; bidirectional recurrent neural networks (RNNs) are more effective than unidirectional RNNs and convolutional neural network, which in turn are more effective than multi-layer perception; using the last output corresponding to the time step for the bidirectional long short-term memory (BLSTM) can reduce the false negative rate by 2.0% at the price of increasing the false positive rate by 0.5%.

A systematic literature review on the detection of smells and their evolution in object‐oriented and service‐oriented systems

SummaryThis systematic literature review paper investigates the key techniques employed to identify smells in different paradigms of software engineering from object‐oriented (OO) to service‐oriented (SO). In this review, we want to identify commonalities and differences in the identification of smells in OO and SO systems. Our research method relies on an automatic search from the relevant digital libraries to find the studies published since January 2000 on smells until December 2017. We have conducted a pilot and author‐based search that allows us to select the 78 most relevant studies after applying inclusion and exclusion criteria. We evaluated the studies based on the smell detection techniques and the evolution of different methodologies in OO and SO. Among the 78 relevant studies selected, we have identified six different studies in which linguistic source code analysis received less attention from the researchers as compared to the static source code analysis. Smells like the yo‐yo problem, unnamed coupling, intensive coupling, and interface bloat received considerably less attention in the literature. We also identified a catalog of 30 smells infrequently reported for SO systems and that require further attention. Moreover, a suite of 20 smells reported for SO systems can also be detected using static source code metrics in OO. Finally, our review highlighted three major research trends that are further subdivided into 20 research patterns initiating the detection of smells toward their correction.

Directed Dynamic Symbolic Execution for Static Analysis Warnings Confirmation

Currently, there is no doubt among experts in the field of program certification and quality assurance that automated program analysis methods should be used to find bugs that lead to program security vulnerabilities. The national standard for the secure software development requires the use of source code static analysis tools as one of the measures of software quality assurance at the development stage and the application of dynamic analysis and fuzz-testing of the source code at the qualification testing stage. Fundamental limitations of automated program analysis and testing methods make it impossible to carry out simultaneously exhaustive and precise analysis of programs for errors. Thereof, researches are nowadays carried out aimed at reducing the effect of fundamental limitations on the quality and productivity of automated software error detection methods. This paper discusses an approach that combines methods of source code static analysis and dynamic symbolic execution in order to increase the program error detection efficiency.

A Framework for Legacy Source Code Audit Analytics

ABSTRACT An internal audit engagement at a large bank revealed that legacy software code can represent significant risk to an organization. In this engagement, several instances of malicious COBOL source code were discovered through manual inspection and identification. The internal auditors were concerned that more instances of faulty code could be in the production environment, and that manually inspecting over 100 million lines of source code would be infeasible. Under their auspices, I developed the Retrospective Static Source Code Analysis Framework for automatically identifying source code files likely to contain source code faults. We implemented this audit analytic framework in a tool called COBOL Analyzer. Using the tool, the auditors discovered thousands of potential source code files with faults and, using a ranking method, audited the most suspicious ones. The tool was deemed a success and it is undergoing further development by the internal audit team.

System-level state equality detection for the formal dynamic verification of legacy distributed applications

The ever increasing complexity of distributed systems mandates to formally verify their design and implementation. Unfortunately, the common approaches and existing tools to formally establish the correctness of these systems remain hardly applicable to most legacy HPC applications, that are commonly written in Fortran or C/C++, using the MPI standard.This work addresses the problem of automatically detecting at system-level the equality of the application's state. This allows to automatically verify safety and liveness properties on legacy HPC applications. We present how this state equality detection can be achieved without any source code static analysis, but at runtime using memory introspection and classical debugging techniques.We demonstrate the effectiveness of our approach through the exhaustive verification of several programs from the MPICH3 test suite and through the partial termination analysis of some applications from the Competition on Software Verification (SV-COMP).

Test-Based Clone Detection: an Initial Try on Semantically Equivalent Methods

Most code clone detection approaches identify clones via static source code analysis. Such approaches are effective and efficient in detecting lexically similar clones. However, they are less effective in detecting semantic clones that are similar in functionality but different in implementation. As an initial try to detect semantic clones, in this paper, we propose a test-based approach to detecting methods that are semantically equivalent to API methods. For a given method ${m}$ , we generate its test cases automatically and search for semantically equivalent API methods by running the generated test cases. If two methods generate the same output on each of the test cases, they are taken as semantically equivalent methods. One of the weakness of test-based clone detection is that it is often time consuming. To reduce the time complexity, we take the following measures. First, we focus on methods instead of arbitrary fragments. Second, for a given method, we only compare it against such API methods whose signatures are highly similar to that of the given method. We evaluate the proposed approach on 10 well-known applications. Evaluation results suggest that it is efficient and accurate, and its precision is up to 98%.

Characterization of runtime resource usage from analysis of binary executable programs

This paper introduces a methodology for characterizing the runtime resource demands of a computer program from the analysis of its binary executable file. Categorization of applications according to the kind of resources required during execution – such as CPU and memory usage – is a sough-after piece of knowledge for the aims of computer system design and management. Conventional techniques available for this purpose include white-box static source code analysis and profile matching based on historical execution data. The former tends to be challenging in face of complex software architectures and requires access to the source code; the latter is dependent on the availability of reliable past data and on the selection of features yielding effective correlations with resource usage. The alternative data mining approach proposed in this paper avoids those difficulties by manipulating binary executable files. The method combines techniques from information theory, complex networks and phylogenetics to produce a hierarchical clustering of a set of executable files, which can be used to infer potential similarities in terms of runtime resource usage. The paper introduces the method's rationales and presents results of its application to characterize CPU and IO usages of benchmark applications executed on a standard PC platform. Essays carried out over a set of 80 programs from varying sources yielded numerically significant evidences that the prediction of resource usage similarity obtained by the approach is consistent with experimentally measured runtime profile.

Detecting the Behavior of Design Patterns through Model Checking and Dynamic Analysis

We present a method and tool (ePAD) for the detection of design pattern instances in source code. The approach combines static analysis, based on visual language parsing and model checking, and dynamic analysis, based on source code instrumentation. Visual language parsing and static source code analysis identify candidate instances satisfying the structural properties of design patterns. Successively, model checking statically verifies the behavioral aspects of the candidates recovered in the previous phase. We encode the sequence of messages characterizing the correct behaviour of a pattern as Linear Temporal Logic (LTL) formulae and the sequence diagram representing the possible interaction traces among the objects involved in the candidates as Promela specifications. The model checker SPIN verifies that candidates satisfy the LTL formulae. Dynamic analysis is then performed on the obtained candidates by instrumenting the source code and monitoring those instances at runtime through the execution of test cases automatically generated using a search-based approach. The effectiveness of ePAD has been evaluated by detecting instances of 12 creational and behavioral patterns from six publicly available systems. The results reveal that ePAD outperforms other approaches by recovering more actual instances. Furthermore, on average ePAD achieves better results in terms of correctness and completeness.

Multilingual Source Code Analysis: A Systematic Literature Review

Contemporary software applications are developed using cross-language artifacts, which are interdependent with each other. The source code analysis of these applications requires the extraction and examination of artifacts, which are build using multiple programming languages along with their dependencies. A large number of studies presented on multilingual source code analysis and its applications in the last one and half decade. The objective of this systematic literature review (SLR) is to summarize state of the art and prominent areas for future research. This SLR is based on different techniques, tools, and methodologies to analyze multilingual source code applications. We finalized 56 multi-discipline published papers relevant to multilingual source code analysis and its applications out of 3820 papers, filtered through multi-stage search criterion. Based on our findings, we highlight research gaps and challenges in the field of multilingual applications. The research findings are presented in the form of research problems, research contributions, challenges, and future prospects. We identified 46 research issues and requirements for analyzing multilingual applications and grouped them in 13 different software engineering domains. We examined the research contributions and mapped them with individual research problems. We presented the research contributions in the form of tools techniques and approaches that are presented in the form of research models, platforms, frameworks, prototype models, and case studies. Every research has its limitations or prospects for future research. We highlighted the limitations and future perspectives and grouped them in various software engineering domains. Most of the research trends and potential research areas are identified in static source code analysis, program comprehension, refactoring, reverse engineering, detection, and traceability of cross-language links, code coverage, security analysis, cross-language parsing, and abstraction of source code models.

Software Evolution-based Aspect Mining: A Novel Approach

Aspect mining is the search of candidate aspects in existing systems and isolates them from the system into separately described aspects. The cross-cutting concerns are candidate aspects. The aspect-mining techniques that have been proposed in literature perform static or dynamic analysis of source code to identify the candidate aspect. The data-mining techniques such as clustering and association rule mining have also been applied on execution traces or in combination with source code metrics. History-based aspect mining is based on mining methods calls that have been inserted during the evolution of software. It assumes that cross-cutting concerns do not exist from beginning but are introduced over time. However, the cross-cutting concerns may exist in the system from the beginning. We have been investigating an approach to mine frequent patterns from the version histories of legacy system to recommend candidate aspects. A novel approach, Software Evolution based Aspect Mining (SEAM) software evolution-based aspect mining for mining candidate aspects from version history files is proposed in the paper. In the proposed approach, while mining aspects from legacy code, the source files that have been changed frequently and set of source code files that have been changed together frequently during the evolution of system are mined. Mined frequent change patterns are then visualised for structural relationship. On the basis of the structural relationship between the files, candidate aspects are recommended for the pattern. Two types of candidate aspects are reported – simple candidate aspects and complex candidate aspects. In this paper, algorithms are proposed for mining simple and complex candidate aspects. Overall, the paper presents a novel approach to accurately identify aspects based on co-changing files existing in version history. The identification of aspects not only gives the opportunity to rewrite the code but also has potential to enhance maintainability and reliability of system.

Automating the Refactoring Process

To decrease software maintenance cost, software development companies use static source code analysis techniques. Static analysis tools are capable of finding potential bugs, anti-patterns, coding rule violations, and they can also enforce coding style standards. Although there are several available static analyzers to choose from, they only support issue detection. The elimination of the issues is still performed manually by developers. Here, we propose a process that supports the automatic elimination of coding issues in Java. We introduce a tool that uses a third-party static analyzer as input and enables developers to automatically fix the detected issues for them. Our tool uses a special technique, called reverse AST-search, to locate source code elements in a syntax tree, just based on location information. Our tool was evaluated and tested in a two-year project with six software development companies where thousands of code smells were identified and fixed in five systems that have altogether over five million lines of code.

Cobra: a light-weight tool for static and dynamic program analysis

Static source code analysis tools have become indispensable for the development of reliable software applications. The best analyzers can reveal subtle flaws in a code base, but they can also be slow. In part this is due to the collection of detailed information about the possible data and control flow of an application to support the broadest possible range of analyses. For larger code bases it is not unusual that even the best of breed static analyzers can take an hour or more to complete an analysis. In this paper we describe a framework for a much faster, but more light-weight type of static analysis that can support interactive use for standard types of queries. The Cobra tool we designed for this purpose can scale to explore millions of lines of code interactively. The tool is mostly language agnostic, and can therefore easily be configured to resolve even dynamic program analysis queries.

Detecting and Removing Web Application Vulnerabilities with Static Analysis and Data Mining

Although a large research effort on web application security has been going on for more than a decade, the security of web applications continues to be a challenging problem. An important part of that problem derives from vulnerable source code, often written in unsafe languages like PHP. Source code static analysis tools are a solution to find vulnerabilities, but they tend to generate false positives, and require considerable effort for programmers to manually fix the code. We explore the use of a combination of methods to discover vulnerabilities in source code with fewer false positives. We combine taint analysis, which finds candidate vulnerabilities, with data mining, to predict the existence of false positives. This approach brings together two approaches that are apparently orthogonal: humans coding the knowledge about vulnerabilities (for taint analysis), joined with the seemingly orthogonal approach of automatically obtaining that knowledge (with machine learning, for data mining). Given this enhanced form of detection, we propose doing automatic code correction by inserting fixes in the source code. Our approach was implemented in the WAP tool, and an experimental evaluation was performed with a large set of PHP applications. Our tool found 388 vulnerabilities in 1.4 million lines of code. Its accuracy and precision were approximately 5% better than PhpMinerII's and 45% better than Pixy's.

The ALICE Software Release Validation cluster

One of the most important steps of software lifecycle is Quality Assurance: this process comprehends both automatic tests and manual reviews, and all of them must pass successfully before the software is approved for production. Some tests, such as source code static analysis, are executed on a single dedicated service: in High Energy Physics, a full simulation and reconstruction chain on a distributed computing environment, backed with a sample “golden” dataset, is also necessary for the quality sign off. The ALICE experiment uses dedicated and virtualized computing infrastructures for the Release Validation in order not to taint the production environment (i.e. CVMFS and the Grid) with non-validated software and validation jobs: the ALICE Release Validation cluster is a disposable virtual cluster appliance based on CernVM and the Virtual Analysis Facility, capable of deploying on demand, and with a single command, a dedicated virtual HTCondor cluster with an automatically scalable number of virtual workers on any cloud supporting the standard EC2 interface. Input and output data are externally stored on EOS, and a dedicated CVMFS service is used to provide the software to be validated. We will show how the Release Validation Cluster deployment and disposal are completely transparent for the Release Manager, who simply triggers the validation from the ALICE build system's web interface. CernVM 3, based entirely on CVMFS, permits to boot any snapshot of the operating system in time: we will show how this allows us to certify each ALICE software release for an exact CernVM snapshot, addressing the problem of Long Term Data Preservation by ensuring a consistent environment for software execution and data reprocessing in the future.

On the capability of static code analysis to detect security vulnerabilities

Context:Static analysis of source code is a scalable method for discovery of software faults and security vulnerabilities. Techniques for static code analysis have matured in the last decade and many tools have been developed to support automatic detection.Objective: This research work is focused on empirical evaluation of the ability of static code analysis tools to detect security vulnerabilities with an objective to better understand their strengths and shortcomings.Method: We conducted an experiment which consisted of using the benchmarking test suite Juliet to evaluate three widely used commercial tools for static code analysis. Using design of experiments approach to conduct the analysis and evaluation and including statistical testing of the results are unique characteristics of this work. In addition to the controlled experiment, the empirical evaluation included case studies based on three open source programs.Results: Our experiment showed that 27% of C/C++ vulnerabilities and 11% of Java vulnerabilities were missed by all three tools. Some vulnerabilities were detected by only one or combination of two tools; 41% of C/C++ and 21% of Java vulnerabilities were detected by all three tools. More importantly, static code analysis tools did not show statistically significant difference in their ability to detect security vulnerabilities for both C/C++ and Java. Interestingly, all tools had median and mean of the per CWE recall values and overall recall across all CWEs close to or below 50%, which indicates comparable or worse performance than random guessing. While for C/C++ vulnerabilities one of the tools had better performance in terms of probability of false alarm than the other two tools, there was no statistically significant difference among tools’ probability of false alarm for Java test cases.Conclusions: Despite recent advances in methods for static code analysis, the state-of-the-art tools are not very effective in detecting security vulnerabilities.

A Method of Extended Finite State Machines Construction from HDL Descriptions Based on Static Analysis of Source Code

A Method of Extended Finite State Machines Construction from HDL Descriptions Based on Static Analysis of Source Code

Mining architectural violations from version history

Software architecture conformance is a key software quality control activity that aims to reveal the progressive gap normally observed between concrete and planned software architectures. However, formally specifying an architecture can be difficult, as it must be done by an expert of the system having a high level understanding of it. In this paper, we present a lightweighted approach for architecture conformance based on a combination of static and historical source code analysis. The proposed approach relies on four heuristics for detecting absences (something expected was not found) and divergences (something prohibited was found) in source code based architectures. We also present an architecture conformance process based on the proposed approach. We followed this process to evaluate the architecture of two industrial-strength information systems, achieving an overall precision of 62.7 % and 53.8 %. We also evaluated our approach in an open-source information retrieval library, achieving an overall precision of 59.2 %. We envision that an heuristic-based approach for architecture conformance can be used to rapidly raise architectural warnings, without deeply involving experts in the process.

基于函数调用路径的软件实现与设计一致性验证

Whether the developed software system completed all functions in the software design specification and consistent with the design algorithm is an important work in software testing. Analysis of the source code artificial and verify whether the software system is to meet the requirements of the design specification is laborious job. Testers need to have rich experience in programming and strong ability of algorithm analysis. This paper proposes a method to verify consistency of software implementation and design based on function call path. The method can be summarized as analyze the calling relationship of functions from design specifications and source code, extraction function calling path, generation function cluster model. In documents aspect, the function calling relationship can be got by manual analysis of the design specification, then the designed function cluster model can be generated automatically. We can get function calling relationship, function features by static analysis of source code and the specific implementations of function with those features. Finally, compare the two function cluster model to verify that the consistency of software implementation and design. The experimental results showed that this method can obtain the system function structure and algorithm features accurately, make effective judgment of the consistency of the design specification and the software implementation, provides a new way to verify the consistency of software implementation and design.