一个可半自动化扩展的静态代码缺陷分析工具  

A Semi-Automatic Extensible Static Defect Analysis Tool

作　　者：梁广泰[1] 孟娜[1] 李进辉[1] 钟浩[1] 张路[1] 王千祥[1] 

机构地区：[1]北京大学信息科学技术学院高可信软件技术教育部重点实验室,北京100871

出　　处：《计算机学报》2011年第6期1114-1125,共12页Chinese Journal of Computers

基　　金：国家自然科学基金重点项目(61033006);国家"九七三"重点基础研究发展规划项目基金(2009CB320703);国家自然科学基金(60773160);国家创新研究群体科学基金(60821003)资助

摘　　要：基于缺陷模式的代码缺陷分析技术根据预先设定的缺陷模式知识对受检代码进行缺陷分析.这种分析技术具有使用简单、查找速度快等优点,是近年来静态代码缺陷分析方法中发展比较迅速的新技术.但是目前基于这种分析技术的大多数工具并没有为用户提供足够易用、高效的扩展方式以扩充其缺陷检测能力.针对这一问题,作者提出了一个"可半自动化扩展"的代码缺陷静态分析方法,设计并实现了一个支持该方法的工具——CODA(COde Defect Analysis tool).CODA不仅提供了"缺陷模式描述模板"以帮助用户快速地手工扩充缺陷模式库,还能在用户的指导下半自动化地挖掘新缺陷模式以快速扩充其缺陷模式库.一旦新的缺陷模式被定义并添加至缺陷模式库中,CODA便能自动具有针对该类缺陷的检测能力.The pattern based code defect analysis approach finds defects for subject programs with the aid of predefined defect pattern knowledge. The advantages of this kind of approach lie in the simplicity of its usage and the efficiency of its analysis, which make it a new technique with more rapid development among different approaches of static code defect analysis recently. How- ever, among the available tools based on the approach, the extension modes provided by most of them are neither friendly nor efficient enough for users to extend their defect analysis capability. In order to solve this problem, the authors proposes a semi-automatic extensible static code defect analysis approach. Based on the approach, a tool named CODA （COde Defect Analysis tool） has been designed and implemented. In order to support the efficient extension of the defect pattern library, CODA provides not only enough ＂defect pattern description templates＂ to facilitate users＇ manual extension, but also a ＂semi-automatic extension mechanism＂ which accelerates the process of discovering, summarizing and extending new defect patterns. Once a new defect pattern is defined and added into the defect pattern library, CODA can automatically own the detecting ability for its related defects.

关 键 词：静态分析 缺陷分析 半自动化扩展 缺陷模式 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]