Industrial perspective on static analysis

Wichmann, Brian; Canning, Audrey; Clutterbuck, D.L.; Winsborrow, L.; Ward, Nicholas J; Marsh, Daniel

doi:10.1049/sej.1995.0010

Cited by 60 publications

(26 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Static analysis is widely used within industry for the analysis of safety critical code (see [WCC95]). Whilst there are a number of commercial tools which include static analysis such as QAC [QAC99], CANTATA [IPL99], and LDRA Testbed [Ldr99], the static analysis component of the tools are mostly examining only static properties.…”

Section: Industrial Static Analysismentioning

confidence: 99%

Safety analysis of Hawk In Flight monitor

Whiting¹,

Hill²

1999

Proceedings of the 1999 ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering

View full text Add to dashboard Cite

The development of a military safety critical system has many facets, one of which is the collecting of evidence that can be used to assist the production of the safety case necessary for certification of a system into military use. Within the certification process, static analysis is required by the UK Ministry of Defence to provide evidence of a systems integrity and fitness for purpose. In this paper we describe how we have extended the approach of static analysis to gain evidence of the dynamic integrity of a system. This work, based on the abstract interpretation of variable values into sets of ranges of values, has resulted in the development of a software tool, called the Exception Analyser. This tool can investigate the potential for code, written in C, C++ and Ada, to raise run time exceptions and then derive the system constraints which would prevent these exceptions from occurring. We outline the foundation behind our approach and present the results of a case study into the successful application of the tool on a safety critical military project. Safety Critical System AssessmentSoftware analysis is essential for any formal assessment of software, whether on the grounds of quality, system acceptance or the demonstration of levels of integrity required for safety critical systems. Understanding the source code of a program is difficult enough for the people who wrote it, but it is considerably harder for anyone making an independent assessment. Software analysis tools can be used to demonstrate properties such as control flow complexity or the dependency relations between variables and this can provide valuable insight and checks on obscure conditions, which might otherwise go unnoticed. As a result there are requirements for software analysis in the MOD standard for PASTE "99 9/99 Toulouse, France 1-58113-137-2/99/0008... safety critical software DEF STAN 00-55 [MOD91] and also in the avionics standard DO178B [RTC92]. Software analysis is very widely used in industry, not only for safety critical systems, but also as an aid to the production of high quality software.There are also a wide range of hazard analysis approach which are applied to software development, for eaxmple Fault Tree Analysis, Event Tree Analysis, Failure Modes and Effects Analysis, and HAZOP to name but a few. However, these approaches are aimed at determining the underlying risks of a system and not at analysis of the software produced (see Leveson [Lev95 ] for an outline of the above approaches).Software analysis can be either static or dynamic, see for example Osterweil [Ost81]. In static analysis, the code is analysed and the: assessment result produced directly from the analysis. Whereas in dynamic analysis, the compiled code is instrumented to measure the properties required, and the modified program is run to produce the assessment resuit. Static analysis is widely used for testing a large range of properties and is more desirable than dynamic analysis because it provides general, rather than specific properties, which are ...

show abstract

Section: Industrial Static Analysismentioning

confidence: 99%

Safety analysis of Hawk In Flight monitor

Whiting¹,

Hill²

1999

Proceedings of the 1999 ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering

View full text Add to dashboard Cite

show abstract

“…Static code analysis is the analysis of computer software that is performed without actually executing programs built from that software. This is in contrast to the analysis performed on executing programs which is known as dynamic analysis [2]. Empirical evidence from [3] and [4] showed that software maintenance consumed between 50% and 80% of the resources in the total software budget.…”

Section: Introductionmentioning

confidence: 98%

Re-tooling Code Structure Based Analysis with Model-Driven Program Slicing for Software Maintenance

Francisca¹

2012

IJACSA

View full text Add to dashboard Cite

Abstract-Static code analysis is a methodology of detecting errors in program code based on the programmer's reviewing the code in areas within the program text where errors are likely to be found and since the process considers all syntactic program paths; there is the need for a model-based approach with slicing. This paper presented a model of high-level abstraction of code structure analysis for a large component based software system. The work leveraged on the most important advantage of static code structure analysis in re-tooling software maintenance for a developing economy. A program slicing technique was defined and deployed to partition the source text to manageable fragments to aid in the analysis and statecharts were deployed as visual formalism for viewing the dynamic slices. The resulting model was a high-tech static analysis process aimed at determining and confirming the expected behaviour of a software system using slices of the source text presented in the statecharts.

show abstract

“…The static analysis method [2] is often used in the security analysis for computer software. Great efforts have been devoted to the development of static analyzers.…”

Section: Introductionmentioning

confidence: 99%

A Model Guided Security Analysis Approach for Android Applications

Yan¹,

Li²,

Ma³

2016

JSW

View full text Add to dashboard Cite

Abstract:Revealing security vulnerabilities is one of great challenges for the Android ecosystem. Static analysis is the usual approach of the security analysis for computer software. However, it is undirected and time-consuming for the common static analysis methods to analyze the entire Android application systematically from the main entry point. In order to adapt to the event-driven feature of Android applications, a model guided security analysis approach for Android applications is introduced and implemented into the prototype tool MSAS. This approach builds and utilizes the Operation Security Model to guide the targeted analysis process, and then concentrate on the identified analysis surface to reduce analysis workload, thereby achieving fast analysis speed and on-demand code coverage based on the security rules. The test result shows that this approach can improve the efficiency and effect of security analysis for Android applications, and it has revealed 11 security vulnerabilities by analyzing several popular Android applications.

show abstract

Industrial perspective on static analysis

Cited by 60 publications

References 3 publications

Safety analysis of Hawk In Flight monitor

Safety analysis of Hawk In Flight monitor

Re-tooling Code Structure Based Analysis with Model-Driven Program Slicing for Software Maintenance

A Model Guided Security Analysis Approach for Android Applications

Contact Info

Product

Resources

About