AUTOMATIC GENERATION OF ANALYSIS-EQUIVALENT APPLICATION CONSTRUCTS

• US 20150067653A1
• Filed: 08/28/2013
• Published: 03/05/2015
• Est. Priority Date: 08/28/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Guarnieri, Salvatore A., Pistoia, Marco, Tripp, Omer
• Granted Patent: US 9,459,986 B2
• Time in Patent Office: Days
• US Class Current: 717/126
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 8/24 Object-oriented
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/35 model driven
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/43 Checking; Contextual analysis
• CPC Class Codes: G06F 8/75 Structural analysis for program understanding

Abstract

A computer program to be subjected to static analysis includes at least one framework, in turn including high-level code and at least one configuration file. A specification which describes run-time behavior of the program, including run-time behavior of the at least one framework including the high-level code and the at least one configuration file, is created from the computer program. Based on the specification, synthetic high-level code which accurately simulates the run-time behavior of the at least one framework including the high-level code and the at least one configuration file, without framework usage, is created. Static analysis of the computer program is carried out based on the synthetic high-level code.

Claims

1. A method comprising:

accessing a computer program to be subjected to static analysis, said computer program comprising at least one framework, said at least one framework comprising high-level code and at least one configuration file;

creating from said computer program a specification which describes run-time behavior of said program, including run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file;

based on said specification, generating synthetic high-level code which accurately simulates said run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file, without framework usage; and

carrying out said static analysis of said computer program, based on said synthetic high-level code.

2. The method of claim 1, wherein said step of creating said specification further comprises establishing new entry points, further comprising considering said new entry points when carrying out said static analysis.

3. The method of claim 2, wherein said step of creating said specification further comprises creating a set of synthetic methods and a set of call replacements, each of said call replacements having a corresponding one of said synthetic methods associated therewith, and wherein said generating step comprises replacing actual method call targets in said computer program with calls to said synthetic methods.

4. The method of claim 3, further comprising compiling said synthetic high-level code prior to carrying out said static analysis, said static analysis being carried out on said compiled synthetic high-level code.

5. The method of claim 1, wherein said high-level code comprises JAVA code and wherein said carrying out of said static analysis comprises carrying out taint analysis.

6. The method of claim 1, further comprising providing a system, wherein the system comprises distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise a code specification generator module and a synthetic code generator module;

wherein;

said accessing and said creating are carried out by said code specification generator module executing on at least one hardware processor; and

said generating is carried out by said synthetic code generator module executing on said at least one hardware processor.

7. The method of claim 6, wherein, in said providing step, said distinct software modules further comprise a static analysis module, and wherein said static analysis of said computer program is carried out by said static analysis module executing on said at least one hardware processor.

8. A computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, said computer readable program code comprising:

computer readable program code configured to access a computer program to be subjected to static analysis, said computer program comprising at least one framework, said at least one framework comprising high-level code and at least one configuration file;

computer readable program code configured to create from said computer program a specification which describes run-time behavior of said program, including run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file;

computer readable program code configured to, based on said specification, generate synthetic high-level code which accurately simulates said run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file, without framework usage; and

computer readable program code configured to carry out said static analysis of said computer program, based on said synthetic high-level code.

9. The computer program product of claim 8, wherein said computer readable program code configured to create said specification further comprises computer readable program code configured to create establish new entry points, further comprising computer readable program code configured to consider said new entry points when carrying out said static analysis.

10. The computer program product of claim 9, wherein said computer readable program code configured to create said specification further comprises computer readable program code configured to create a set of synthetic methods and a set of call replacements, each of said call replacements having a corresponding one of said synthetic methods associated therewith, and wherein said computer readable program code configured to generate comprises replacing actual method call targets in said computer program with calls to said synthetic methods.

11. The computer program product of claim 10, further comprising computer readable program code configured to facilitate compilation of said synthetic high-level code prior to carrying out said static analysis, said static analysis being carried out on said compiled synthetic high-level code.

12. The computer program product of claim 8, wherein said high-level code comprises JAVA code and wherein said carrying out of said static analysis comprises carrying out taint analysis.

13. An apparatus comprising:

a memory; and

at least one processor, coupled to said memory, and operative to;

access a computer program to be subjected to static analysis, said computer program comprising at least one framework, said at least one framework comprising high-level code and at least one configuration file;

create from said computer program a specification which describes run-time behavior of said program, including run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file;

based on said specification, generate synthetic high-level code which accurately simulates said run-time behavior of said at least one framework comprising said high-level code and said at least one configuration file, without framework usage; and

carry out said static analysis of said computer program, based on said synthetic high-level code.

14. The apparatus of claim 13, wherein said at least one processor is further operative to create said specification by establishing new entry points, and to consider said new entry points when carrying out said static analysis.

15. The apparatus of claim 14, wherein said at least one processor is further operative to create said specification by creating a set of synthetic methods and a set of call replacements, each of said call replacements having a corresponding one of said synthetic methods associated therewith, and wherein said at least one processor is further operative to generate by replacing actual method call targets in said computer program with calls to said synthetic methods.

16. The apparatus of claim 15, wherein said at least one processor is further operative to facilitate compilation of said synthetic high-level code prior to carrying out said static analysis, said static analysis being carried out on said compiled synthetic high-level code.

17. The apparatus of claim 13, wherein said high-level code comprises JAVA code and wherein said carrying out of said static analysis comprises carrying out taint analysis.

18. The apparatus of claim 13, further comprising a plurality of distinct software modules, each of the distinct software modules being embodied on a computer-readable storage medium, and wherein the distinct software modules comprise a code specification generator module and a synthetic code generator module;

wherein;

said at least one processor is operative to access and create by executing said code specification generator module; and

said at least one processor is operative to generate by executing said synthetic code generator module.

19. The apparatus of claim 18, wherein the distinct software modules further comprise a static analysis module, and wherein said at least one processor is operative to carry out said static analysis by executing said static analysis module.