System and method to classify automated code inspection services defect output for defect analysis

• US 9,753,838 B2
• Filed: 07/21/2016
• Issued: 09/05/2017
• Est. Priority Date: 09/11/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Baker, Ian E., Bassin, Kathryn A., Kagan, Steven, Smith, Susan E.
• Primary Examiner(s): Das, Chameli
• Application Number:
  US15/215,664
• Publication Number:
  US 20160328313A1
• Time in Patent Office: 411 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 9/44589 Program code verification, e.g. Java bytecode verification, proof-carrying code high-level semantic checks G06F8/43; testing and debugging software G06F11/36

Abstract

A method is implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions. The programming instructions are operable to receive a tool error output determined by a code inspection tool and select at least one defect classification mapping profile based on the code inspection tool. Additionally, the programming instructions are operable to map the tool error output to one or more output classifications using the selected at least one defect classification mapping profile and generate at least one report based on the one or more output classifications.

Claims

1. A system comprising:

an error output receiving tool implemented in a processor and operable to;

receive a tool error output determined by one of a plurality of code inspection tools offered, respectively, by one of a plurality of code inspection services;

compare the tool error output to a listing of possible error outputs for a plurality of code inspection tools; and

determine an identification of the one of the code inspection tools, from among the plurality of code inspection tools, that generated the tool error output based on the comparison;

a selection tool implemented in the processor and operable to;

select at least one defect classification mapping profile based on the identified one of the code inspection tools; and

quantify occurrences of each of the possible tool error outputs for each of the plurality of code inspection tools; and

a mapping tool implemented in the processor and operable to;

map the tool error output to one or more output classifications using the selected at least one defect classification mapping profile; and

quantify a number of defects of the possible tool error outputs based on the one or more of the output classifications,

wherein the selecting the at least one defect classification mapping profile comprises selecting one or more designated defect classification mapping profiles, which each comprise;

the listing of possible tool error outputs for a particular code inspection tool; and

for each of the possible tool error outputs, a corresponding output classification with a common classification schema.

2. The system of claim 1, wherein the one or more output classifications comprise at least one of:

a target, a trigger, an impact, a type, a qualifier and a severity.

3. The system of claim 2, wherein:

the target indicates a level cause of a defect;

the trigger indicates at least one of how the defect was discovered and circumstances surrounding a defect discovery;

the impact indicates an impact to a user;

the type indicates a size and complexity of a fix for the defect;

the qualifier indicates whether the defect is related to incorrect, extraneous or missing code; and

the severity indicates a relative severity of the defect.

4. The system of claim 2, wherein the comparing of the tool error output is based on organization codes of individual ones of the plurality of code inspection services.

5. The system of claim 4, wherein the tool error output comprises one or more error texts.

6. The system of claim 5, wherein the code inspection tools comprise automated code inspection tools.

7. The system of claim 1, wherein:

the tool error output comprises one or more error texts; and

the mapping the tool error output to the one or more output classifications using the selected at least one defect classification mapping profile comprises for each of the one or more error texts, determining a corresponding output classification.

8. The system of claim 7, wherein the corresponding output classification comprises at least one of a corresponding target, a corresponding trigger, a corresponding impact, a corresponding type, a corresponding qualifier and a corresponding severity in accordance with a common classification schema.

9. The system of claim 7, wherein the comparing of the tool error output is based on organization codes of individual ones of the plurality of code inspection services.

10. The system of claim 9, wherein the tool error output comprises one or more error texts.

11. The system of claim 10, wherein the code inspection tools comprise automated code inspection tools.

12. The system of claim 11, wherein the report generation tool is operable to generate a report containing defect analysis metrics using classified tool output information received from the mapping tool.

13. The system of claim 12, wherein the report generation tool is operable to provide a report of defect discoveries which include mitigated risk.

14. The system of claim 13, wherein the report of the defect discoveries includes a plurality of defect categories.

15. The system of claim 1, wherein the tool error output identifies at least one code defect which is at least one of an accessibility defect, a memory defect, a security defect and a technical quality defect.

16. The system of claim 1, wherein the comparing of the tool error output is based on organization codes of individual ones of the plurality of code inspection services.

17. The system of claim 16, wherein the tool error output comprises one or more error texts.

18. The system of claim 17, wherein the code inspection tools comprise automated code inspection tools.

19. The system of claim 18, further comprising a report generation tool implemented in the processor and operable to generate at least one report based on the one or more output classifications.

20. The system of claim 1, further comprising a report generation tool implemented in the processor and operable to generate at least one report based on the one or more output classifications.