Interactive Static Software Performance Analysis in the IDE

Microservice Architecture (MSA) is becoming the predominant direction of new cloud-based applications. There are many advantages to using microservices, but also downsides to using a more complex architecture than a typical monolithic enterprise application. Beyond the normal poor coding practices and code smells of a typical application, microservice-specific code smells are difficult to discover within a distributed application setup. There are many static code analysis tools for monolithic applications, but tools to offer code-smell detection for microservice-based applications are lacking. This paper proposes a new approach to detect code smells in distributed applications based on microservices. We develop an MSANose tool to detect up to eleven different microservice specific code smells and share it as open-source. We demonstrate our tool through a case study on two robust benchmark microservice applications and verify its accuracy. Our results show that it is possible to detect code smells within microservice applications using bytecode and/or source code analysis throughout the development process or even before its deployment to production.

Asynchronous methodologies are gaining their presence in modern integrated circuit design. Cycle-time analysis of asynchronous design is nontrivial and crucial to circuit optimization. Among prior methods, linear programming-based analysis (LPA) and static performance analysis (SPA) are two representatives with high accuracy (but inefficient) and high efficiency (but inaccurate), respectively. However, the exactness of LPA remains unknown and the accuracy of SPA remains room for improvement. In this work, we demonstrate the inexactness of LPA and enhance the accuracy of SPA. Experimental results suggest our enhanced SPA almost always returns exact cycle-times while achieving up to 4000× speedup over LPA.

This research investigates numerically the potential failure of different framed structures after removal of a corner column. This study is directed towards the role of the joint above the removed column in terms of framed structures stability and internal forces redistribution utilizing linear static, nonlinear static and nonlinear dynamic analysis procedures. First, the preliminary linear static analysis as a part of more detailed nonlinear static and dynamic analysis to model reinforced concrete frames is performed. For nonlinear numerical models, three different moment-rotation capacity curves are considered for the joint above the removed column. These curves are taken according to FEMA 356 regulation according to the reinforcement condition at the joint location to represent normal joint, anchorage deficient joint and shear deficient joint. In linear static models, the results confirmed that, the more moment the joint can resist at the removed column location, the less moment is generated at the beam’s other end. In nonlinear static analysis, the model with normal plastic hinge properties recorded a higher carrying capacity than the model with both shear and anchorage plastic hinges. Nonlinear dynamic analysis with less assumptions offer the more representative modeling for the considered case study which is obvious from its closer perdition of internal forces and deflection compared to the reference findings.

Some trade-offs in reducing the overhead of assertion run-time checks via static analysis

This work extents the project Technological Development of a Low-cost Wrist Rehabilitation Robot. The project goal is to develop a robotic system to aid physiatrists in their work of rehabilitating patients with injuries at the wrist joint. The rehabilitation protocol of the wrist often follows three stages: i) the physiatrist immobilizes the wrist for a time, ii) then, he/she treats the wrist by applying heat or cold over sore tendons and muscles, and iii) the physiatrist applies force on the wrist to give smooth movements until recovering its range of motion. In the latter stage, the physiatrist performs several exercises for long periods of time, which opens a great opportunity for being substituted for a robotic device. Earlier works, based on analyzing several rehabilitation therapies, allowed to set up the design specifications and a robot first design. Thus, the aims of this work is to present the kinematic and static analysis of a 2 degree of freedom serial robot designed for wrist rehabilitation. First, the physiatrists’ team from the Traumatology Service at the IAHULA, Mérida Venezuela recorded rehabilitation therapies normally used when treating an injured wrist. Then, the kinematic and static models to study recorded trajectories are developed. Findings allow us to improve the actual robot design, and they also show that the designed robot can tackle the therapies required for wrist rehabilitation.

<div class="htmlview paragraph">Clutch systems applications require that their components resist to high dynamics and static efforts that should be considered in the development process. These requirements are determined taking account the vehicle application, such as loadcases, materials, life time and environment conditions. In the case of CRB components generally the design is based on contact angular ball bearing. Normally static analysis are performed, computing stresses and displacements, however in this specification the results are checked using static and fatigue safety factors according to the strength assessment evaluation, Germany standard: FKM (Richtlinie - Rechnerischer Festigkeitsnachweis für Maschinenbauteile). Actually more powerful computers have reduced gradativally the cost for industries and with the constant improvements of FE programs, it is possible to simulate the complete assembly using contact interactions to get closer to the reality. Nevertheless due their properties as non-linear, rolling bearings requires high demands on calculation methods and this is a limitation on time calculation. For future case it could be shown a new method to represent the non -linear mechanical behavior of ball elements and respective raceways. A method were developed for static finite element analysis and converted into the form of user -defined element, improving results accuracy and time-calculation.</div>

Context:Static analysis of source code is a promising opportunity to detect faults and badly designed areas, which will have a negative effect on the overall product quality. In addition, it is inexpensive to integrate it into the development process, because it is easy to automate. Objective:Despite these benefits, static analysis is not as commonly accepted as other quality assurance techniques. To be able to realise its full potential, we need to better understand the problems which prevent software developers from successfully using static analysis tools. Method: To gain new insights we propose to combine the observation methodologies eye tracking, think aloud and questionnaires for a comprehensive investigation on the usage barriers. Results: Our first experimental results with students show new issues: Automated static analysis tools could benefit from a more direct feedback to changes and a more clear guidance of the users. Conclusion:Therefore, we consider the approach as promising and we will conduct further experiments to understand the barriers in static analysis usage.

The growing demand for productivity in hardware development opens up new opportunities for applying programming language (PL) techniques to hardware description languages (HDLs). Chisel, a leading agile HDL, embraces this shift by leveraging modern PL features to enhance hardware design productivity. However, verification for Chisel remains a major productivity bottleneck, requiring substantial time and manual effort. To address this issue, we advocate the use of static analysis —a technique proven well-suited to agile development workflows in software—for lightweight Chisel verification. This work establishes a theoretical foundation for Chisel static analysis. At its core is λ C , a formal core calculus of ChAIR (a Chisel-specific intermediate representation for analysis). λ C is the first formalism that captures the essence of Chisel while being deliberately minimal to ease rigorous reasoning about static analysis built on λ C . We prove key properties of λ C that reflect real hardware characteristics, which in turn offer a form of retrospective validation for its design. On the basis of λ C , we define and formalize the hardware value flow analysis (HVFA) problem, which underpins our static analyses for critical Chisel verification tasks, including bug detection and security analysis. We then propose a synchronized fixed-point solution to the HVFA problem, featuring hardware-specific treatment of the synchronous behavior of clock-driven hardware registers—the essential feature of Chisel programs. We further prove key theorems establishing the guarantees and limitations of our solution. As a proof of concept, we develop ChiSA (30K+ LoC)—the first Chisel static analyzer that can analyze intricate hardware value flows to enable lightweight analyses for critical Chisel verification tasks such as bug detection and security analysis. To facilitate thorough evaluation of both ChiSA and future work, we provide ChiSABench (11M+ LoC), a comprehensive benchmark for Chisel static analysis. Our evaluation on ChiSABench demonstrates that ChiSA offers an effective and significantly more lightweight approach for critical Chisel verification tasks, especially on large and complex real-world designs. For example, ChiSA identified 69 violable developer-inserted assertions in large-scale Chisel designs (9.7M+ LoC) in under 200 seconds—eight of which were recognized by developers and scheduled for future fixes—and detected all 60 information-leak vulnerabilities in the well-known TrustHub benchmark (1.1M+ LoC) in just one second—outperforming state-of-the-art Chisel approaches like ChiselTest’s bounded model checking and ChiselFlow’s secure type system. These results underscore the high promise of static analysis for lightweight Chisel verification. To encourage continued research and innovation, we will fully open-source ChiSA (30K+ LoC) and ChiSABench (11M+ LoC).

Multi-objective optimization of surface textured journal bearing by Taguchi based Grey relational analysis

The prevalence and significance of web services in our daily lives make it imperative to ensure that they are – as much as possible – free from vulnerabilities. However, developing a complex piece of software free from any security vulnerabilities is hard, if not impossible. One way to progress towards achieving this holy grail is by using static code analysis tools to root out any common or known vulnerabilities that may accidentally be introduced during the development process. Static code analysis tools have significantly contributed to addressing the problem above, but are imperfect. It is conceivable that static code analysis can be improved by using AI-powered tools, which have recently increased in popularity. However, there is still very little work in analysing both types of tools’ effectiveness, and this is a research gap that our paper aims to fill. We carried out a study involving 11 static code analysers, and one AI-powered chatbot named ChatGPT, to assess their effectiveness in detecting 92 vulnerabilities representing the top 10 known vulnerability categories in web applications, as classified by OWASP. We particularly focused on PHP vulnerabilities since it is one of the most widely used languages in web applications. However, it has few security mechanisms to help its software developers. We found that the success rate of ChatGPT in terms of finding security vulnerabilities in PHP is around 62-68%. At the same time, the best traditional static code analyser tested has a success rate of 32%. Even combining several traditional static code analysers (with the best features on certain aspects of detection) would only achieve a rate of 53%, which is still significantly lower than ChatGPT’s success rate. Nonetheless, ChatGPT has a very high false positive rate of 91%. In comparison, the worst false positive rate of any traditional static code analyser is 82%. These findings highlight the promising potential of ChatGPT for improving the static code analysis process but reveal certain caveats (especially regarding accuracy) in its current state. Our findings suggest that one interesting possibility to explore in future works would be to pick the best of both worlds by combining traditional static code analysers with ChatGPT to find security vulnerabilities more effectively.

Secure software engineering has emerged in recent decades by encouraging the idea of software security has to be an integral part of all the phases of the software development lifecycle. As a result, each phase of the lifecycle is associated with security-specific best practices such as threat modeling and static code analysis. It was observed that various artifacts (i.e., security requirements, architectural flaws, bug reports, security test cases) generated as a result of security best practices tend to be segregated. This creates a significant barrier to resolve the security issues at the implementation phase since most of them are originated in the design phase. In order to address this issue, this paper presents a knowledge-modeling based approach to semantically infer the associations between architectural level security flaws and code-level security bugs, which is manually tedious. Threat modeling and static analysis are used to identify security flaws and security bugs, respectively. The case study based experimental results revealed that the architectural level security flaws have a significant impact on originating security bugs in the code level. Besides, the evaluation results confirmed the scalability of the proposed approach to large-scale industrial software products.

In an increasingly popular model of software distribution, software is developed in one computing environment and deployed in other environments by transfer over the internet. Extraction tools perform a static whole-program analysis to determine unused functionality in applications in order to reduce the time required to download applications. We have identified a number of scenarios where extraction tools require information beyond what can be inferred through static analysis: software distributions other than complete applications, the use of reflection, and situations where an application uses separately developed class libraries. This paper explores these issues, and introduces a modular specification language for expressing the information required for extraction. We implemented this language in the context of Jax, an industrial-strength application extractor for Java, and present a small case study in which different extraction scenarios are applied to a commercially available library-based application.

As a measure of software quality, current static code analyses reveal thousands of quality defects on systems in brown-field development in practice. Currently, there exists no way to prioritize among a large number of quality defects and developers lack a structured approach to address the load of refactoring. Consequently, although static analyses are often used, they do not lead to actual quality improvement. Our approach recommends to remove quality defects, exemplary code clones and long methods, which are easy to refactor and, thus, provides developers a first starting point for quality improvement. With an empirical industrial Java case study, we evaluate the usefulness of the recommendation based on developers’ feedback. We further quantify which external factors influence the process of quality defect removal in industry software development.

To reduce the verification costs and to be more confident on software, static program analysis offers ways to prove properties on source code. Unfortunately, these techniques are difficult to apprehend and to use for non-specialists. Modelling allows users to specify some aspects of software in an easy way. More precisely, in embedded software, state machine models are frequently used for behavioural design. The aim of this paper is to bridge the gap between model and code by offering automatic generation of annotations from model to source code. These annotations are then verified by static analysis in order to ensure that the code behaviour conforms to the model-based design. The models we consider are UML state machines with a formal non-ambiguous semantics, the annotation generation and verification is implemented in a tool and applied to a case study.

File Edit Options Buffers Tools TeX Help Memory leaks have significant impact on software availability, performance, and security. Static analysis has been widely used to find memory leaks in C/C++ programs. Although a static analysis is able to find all potential leaks in a program, it often reports a great number of false warnings. Manually validating these warnings is a daunting task, which significantly limits the practicality of the analysis. In this paper, we develop a novel dynamic technique that automatically validates and categorizes such warnings to unleash the power of static memory leak detectors. Our technique analyzes each warning that contains information regarding the leaking allocation site and the leaking path, generates test cases to cover the leaking path, and tracks objects created by the leaking allocation site. Eventually, warnings are classified into four categories: MUST-LEAK, LIKELY-NOT-LEAK, BLOAT, and MAY-LEAK. Warnings in MUST-LEAK are guaranteed by our analysis to be true leaks. Warnings in LIKELY-NOT-LEAK are highly likely to be false warnings. Although we cannot provide any formal guarantee that they are not leaks, we have high confidence that this is the case. Warnings in BLOAT are also not likely to be leaks but they should be fixed to improve performance. Using our approach, the developer's manual validation effort needs to be focused only on warnings in the category MAY-LEAK, which is often much smaller than the original set.