Case study: Source code static analysis for performance issues detection

EDSA (expert data flow and static analysis tool) which uses static analysis of source code to help gain an understanding of existing code, is described. This may be for the purpose of tracking down a bug or to determine in advance whether an intended change will have any undesirable side effects. In either case, the phase of the development life cycle that is most likely to benefit from a tool like EDSA is the maintenance phase. EDSA provides three kinds of facilities. It helps to browse through code, following either the control flow or data flow, rather than the order in which the code happens to be written. It displays code with unimportant source lines eluded, so that the user can get a more global view of the program. Finally, it provides search management to make it easier to examine all possibilities when browsing. The mechanism used to create and display various views of programs is described and the approach to the user interface is discussed. The state of the current implementation is described. >

Unit testing is an established practice in professional software development. However, in high-performance computing (HPC) with its scientific applications, it is not widely applied. Besides general problems regarding testing of scientific software, for many HPC applications the effort of creating small test cases with a consistent set of test data is high.We have created a tool called FortranTestGenerator, that significantly reduces the effort of creating unit tests for subroutines of an existing Fortran application. It is based on Capture & Replay (C&R), that is, it extracts data while running the original application and uses the extracted data as test input data. The tool automatically generates code for capturing the input data and a basic test driver which can be extended by the developer to an appropriate unit test. A static source code analysis is conducted, to reduce the number of captured variables. Code is generated based on flexibly customizable templates. Thus, both the capturing process and the unit tests can easily be integrated into an existing software ecosystem.Since most HPC applications use message passing for parallel processing, we also present an approach to extend our C&R model to MPI communication. This allows extraction of unit tests from massively parallel applications that can be run with a single process.

Static analysis of source code is considered to be a powerful tool for detecting potential security vulnerabilities. However, only limited information regarding the current quality of static analysis tools exist. A public assessment of the capabilities of the competing approaches and products is not available. Also, neither a common benchmark nor a standard evaluation procedure has yet been defined. In this paper, we propose a general methodology for systematically evaluating static analysis tools. We document the design of an automatic execution and evaluation framework to support iterative test case design and reliable result analysis. Furthermore, we propose a methodology for creating test cases which can assess the specific capabilities of static analysis tools on a very fine level of detail. We conclude the paper with a brief discussion of our experiences which we collected through a practical evaluation study of six commercial static analysis products.

Context:Static analysis of source code is a promising opportunity to detect faults and badly designed areas, which will have a negative effect on the overall product quality. In addition, it is inexpensive to integrate it into the development process, because it is easy to automate. Objective:Despite these benefits, static analysis is not as commonly accepted as other quality assurance techniques. To be able to realise its full potential, we need to better understand the problems which prevent software developers from successfully using static analysis tools. Method: To gain new insights we propose to combine the observation methodologies eye tracking, think aloud and questionnaires for a comprehensive investigation on the usage barriers. Results: Our first experimental results with students show new issues: Automated static analysis tools could benefit from a more direct feedback to changes and a more clear guidance of the users. Conclusion:Therefore, we consider the approach as promising and we will conduct further experiments to understand the barriers in static analysis usage.

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

This dataset was developed to support research at the intersection of web accessibility and artificial intelligence, with a focus on evaluating how large language models (LLMs) can detect and remediate accessibility issues in source code. It consists of code examples written in PHP, Angular, React, and Vue.js, organized into accessible and non-accessible versions of tabular components. A substantial portion of the dataset was collected from student-developed Vue components, implemented using both the Options and Composition APIs. The dataset is structured to enable both static analysis of source code and dynamic analysis of rendered outputs, supporting a range of accessibility research tasks. All files are in plain text and adhere to the FAIR principles, with open licensing (CC BY 4.0) and long-term hosting via Zenodo. This resource is intended for researchers and practitioners working on LLM-based accessibility validation, inclusive software engineering, and AI-assisted front-end development.

Whether the developed software system completed all functions in the software design specification and consistent with the design algorithm is an important work in software testing. Analysis of the source code artificial and verify whether the software system is to meet the requirements of the design specification is laborious job. Testers need to have rich experience in programming and strong ability of algorithm analysis. This paper proposes a method to verify consistency of software implementation and design based on function call path. The method can be summarized as analyze the calling relationship of functions from design specifications and source code, extraction function calling path, generation function cluster model. In documents aspect, the function calling relationship can be got by manual analysis of the design specification, then the designed function cluster model can be generated automatically. We can get function calling relationship, function features by static analysis of source code and the specific implementations of function with those features. Finally, compare the two function cluster model to verify that the consistency of software implementation and design. The experimental results showed that this method can obtain the system function structure and algorithm features accurately, make effective judgment of the consistency of the design specification and the software implementation, provides a new way to verify the consistency of software implementation and design.

Programmers can benefit from static source code analysis techniques in various ways: they can understand their code better, test it more effectively, debug it more efficiently, and so on. However, they often face the challenge of discovering how to reproduce faulty executions that cause runtime errors. The term symbolic execution refers to a static source code analysis method that can help with this challenge. In this paper, we are showing a symbolic execution-based analysis method to find the source of a runtime error. The method uses a control-flow graph to select the execution paths reaching the targeted runtime error. The algorithm is implemented as part of the RefactorErl static program analysis and transformation framework.

At present, Web application vulnerability safety problems widely exist because of the lack of effective validation and filtering mechanism for untrusted user data. This paper shows the design of the prototype system against SQL injection and cross-site scripting vulnerability. The main steps of the detection are as follows: construct the taint dependency graph for the program by the static analysis of source code; use finite state automata to represent the value of tainted string; verify whether the program has effective safe handling for the user input by matching with the attack pattern and then implement the prototype system for automatic detection on the Java Web program vulnerability based on taint dependency analysis. The experimental results show that the system is comprehensive and accurate for the detection of related vulnerabilities.

Many intrusion detection systems monitor process behavior by tracing system calls. Frequent patterns or inherent rules are extracted as features from system call traces of normal process to model the behavior, and any significant deviation from the model is diagnosed as intrusive. Current approaches suffer from heavy modeling complexity in extracting essential features to reduce false alarms. In this paper, we propose a novel approach, which analyzes property of individual system call and its context at semantic level to discover function structures from system call traces efficiently without any static analysis of source code or runtime information. We monitor process behaviors by perceiving such structures as preconditions, which is effective and consistent with mechanism of process execution. Experiments are conducted on two sets of intrusion detection data and the results show that our approach is feasible and effective.

State transition machines are high-level behavior descriptions often used as modeling tools for the design and implementation of a large class of software systems. Some of the state transition machine implementation approaches are such that the static structure of the resulting code closely matches that of the original state transition machines. Therefore, having a representation of the original state transition machines is likely to improve the corresponding code understandability. We present an approach supported by a prototype tool, to extract state transition machines by static analysis of source code. An objective of this work is to enhance program comprehension with visual representations of the behavior of the programs being analyzed.

In modern software engineering, API (Application Programming Interface) is widely used to develop applications rapidly by reusing data structure, frameworks, class libs, and etc. However, due to the considerable number of interfaces, lack of documents and timely maintenance and updates, APIs are often used in a wrong way. Therefore, it has become an important problem to detect API misuse in an automatic way. Many existing automatic API detecting methods do not make full use of APIs’ potential semantic information and independent integrity of each API. In this paper, we employ Stacked LSTM to learn the API usage specification to detect the API misuse defects. Specifically, first, we obtain ACSG (API Call Syntax Graph) through the static analysis of source code. And then, based on ACSG, we generate API sequences, and transform the sequences into for training. Third, in order to represent the APIs in a semantic way, we apply word2vec as a pre-training model to embed features of each API. Though the stacked LSTM model, we regard embedding precious API sequence as the input to model the API use specifications and discover the potential API misuse defects by judging whether the next API is in the output (API probability list) or not. We design experiments to evaluate the effectiveness our method with Java Cryptography APIs and their used code, and the results show the advancement of our proposed method.

KAFE is a tool for kernel inspection, navigation, iterative drill down and analysis with an easy to use interface for searching and sorting on kernel files, functions, types, variables, macros, and symbols. Although debuggers are geared towards run-time program analysis, the information they rely on offers a powerful basis for the static analysis of programs. The KAFE relational database is automatically gen-erated by analyzing the Debug With Arbitrary Records Format information. While we gain a great deal of insight into the workings of the Linux kernel and could hopefully recognize potentially problematic violations of data isolation and encapsulation, the scope of the KAFE tool goes behind kernel inspection and could be applied to program understanding in general. This paper shows how this approach differs from static source code analysis, run-time analysis or debuggers. The database generation and architecture are described and the interface is illustrated.

Recent scholarship has sought to bridge the gap between small states’ security and financial vulnerabilities. Two key works by Tom Long and former Armenian president Armen Sarkissian highlight this effort. Long explains how small states can navigate asymmetries with greater powers by adopting context-specific strategies, while Sarkissian’s practitioner-focused analysis examines nine case studies, stressing the perplexities of navigating both economic and security vulnerabilities. This paper critiques Long’s framework, arguing that it overlooks critical real-world complexities small states face when balancing security and financial pressures. Using Greece’s early 21st-century economic crisis as a case study, it demonstrates how financial instability affected Greece’s foreign relations, particularly with China and Turkey. Greece was chosen because Long used its negotiations during the Eurozone crisis as a case study. Sarkissian’s perspective underscores the interconnected nature of crises in small states, showing that challenges in one domain—economic or security—inevitably affect the other. The analysis calls for a more comprehensive approach incorporating theoretical insights and practical realities in understanding small-state behaviour.

Fuzzing remains to be the most effective method for identifying security vulnerabilities in software. In the context of fuzz testing, the fuzzer supplies varied inputs to fuzz targets, which are designed to comprehensively exercise critical sections of the client code. Various studies have focused on optimizing and developing advanced fuzzers, such as AFL++, libFuzzer, Hongfuzz, syzkaller, ISP-Fuzzer, which have substantially enhanced vulnerability detection in widely used software and libraries. Nevertheless, achieving greater coverage necessitates improvements in both the quality and quantity of fuzz targets. In large-scale software projects and libraries — characterized by numerous user defined functions and data types — manual creation of fuzz targets is both labor-intensive and time-consuming. This challenge underscores the need for automated techniques not only to generate fuzz targets but also to streamline the execution and analysis of their results. In this paper, we introduce an approach to improving fuzz target generation through static analysis of library source code. The proposed method encompasses several key aspects: it analyzes source code structures to accurately construct function calls and generate fuzz targets; it maps fuzzer input data to the corresponding function parameters; it synthesizes compilation information for the fuzz targets; and it automatically collects and analyzes execution results. Experimental results on C/C++ libraries demonstrate that this approach outperforms several existing methods in the field.