Eliminating false-positive reports resulting from static analysis of computer software

摘要

A system for eliminating false-positive reports resulting from static analysis of computer software is provided herein. The system includes the following components executed by a processor: a modeler configured to model a computer code into a model that defines sources, sinks, and flows; a static analyzer configured to apply static analysis to the code or the model, to yield reports indicative of at least one issue relating to one or more of the flows; a preconditions generator configured to generate preconditions for eliminating false-positive issues in the reports, based on the model and user-provided input; and a preconditions checker configured to apply the generated preconditions to the reports for eliminating false-positive issues in the reports.

主权项

1. A method comprising:
modeling a computer code into a model that defines sources, sinks, and flows; applying static analysis to the code or the model, to yield reports indicative of at least one issue relating to one or more of the flows; generating preconditions for eliminating false-positive issues in the reports reports, based on the model and user-provided input; and applying the generated preconditions to the reports for eliminating false-positive issues in the reports, wherein at least one of the modeling, the applying, and the generating is executed by at least one computer processor.