Advancing Static Code Analysis With Language-Agnostic Component Identification

Abstract

Static code analysis of software systems has proven beneficial for a broad range of domains, including security assessments, coding practice, error detection, and others. However, as modern systems have grown in complexity and heterogeneity over the past few decades, advances in development frameworks have dominated. Rather than involving low-level language constructs, these frameworks typically focus on software components, including data entities, controllers, and endpoints. As a result, current code analysis approaches have become unsuitable for analyzing these modern systems due to their focus on low-level constructs in a single language. Thus, code analysis has become a far more complicated endeavor thanks to the plethora of languages, frameworks, and design approaches in modern software development. This paper presents a novel approach to solving the problem of being tied to a single language and its low-level constructs. The system's source code is transformed into an intermediate representation called a languageagnostic abstract-syntax tree. This system representation is then assessed by generalized component parsers that extract relevant high-level information, such as components, from low-level structures. The design of the approach is presented here in detail, along with its evaluation in a case study involving two large, heterogeneous, cloud-native system benchmarks (Java and C++ microservices). The study demonstrates a unified identification approach to determine system data entities and endpoints. Utilizing higher-level constructs, such as components, can advance the current practice of system analysis to better face broader problems introduced by modern system development practices.INDEX TERMS Code analysis, distributed systems, enterprise architecture, microservices.

Microvision: Static analysis-based approach to visualizing microservices in augmented reality

“…In future work, we plan to perform a large user study for which we have already obtained IRB approval. The SAR process will also be generalized to a platformagnostic approach as initiated in [48]. We will also assess more architectural views and alternative 3D models.…”

Static analysis tools in the era of cloud-native systems

“…In our research and prototyping[24, 2] 1 and [12] 2 , we focused on microservice middleware, on the detection communication patterns between services [16,20,21] and on metrics to detect coupling based on the interaction between microservices detected with static analsyis [15]. Furthermore, we observed that most microservices would be developed using particular platform frameworks that introduce components [5,18]. Among examples, consider Spring or Java Enterprise.…”

“…In our follow-up work [18] 3 , we intended for generalization and proposed that the AST is extended to be a superset across languages, which we call Language Agnostic AST (LAAST). Using LAAST, it is fairly simple to build or customize pattern matching agents to detect components or higher-level structures.…”

“…Still, the developer can customize these matchers for naming conventions and apply custom callback to populate the IR with a given component. We have tested this prototype success on the previous testbeds [25,4] and added one in C++ [8], manually validating precision and recall for component detection above 95% [18]. Still, more experiments for other platforms remain.…”

Using Microservice Telemetry Data for System Dynamic Analysis

“…The major challenge with static analysis is the code analysis language dependency and distribution. While the initial approach to address this challenge has been proposed [9], the tooling support is not yet available.…”