Robust Graph-Based Static Code Analysis

Inhaltsverzeichnis (Table of Contents)

• Abstract
• Kurzfassung
• Contents
• Glossary
• 1 Introduction
  • 1.1 Problem Statement
  • 1.2 Thesis Structure
• 2 Background and State of the Art
  • 2.1 Static Code Analysis
  • 2.2 Robust Analysis
    • 2.2.1 Handling Incomplete Code
    • 2.2.2 Handling Erroneous Code
    • 2.2.3 Handling Inheritance and Interprocedural Dataflow
  • 2.3 Code Property Graph
    • 2.3.1 Abstract Syntax Tree
    • 2.3.2 Control Flow Graph
    • 2.3.3 Data Flow Graph
  • 2.4 Graph Databases
  • 2.5 Related Work
• 3 Approach and Implementation
  • 3.1 Existing Setup
    • 3.1.1 CPG Generation from Java Source Code
    • 3.1.2 Graph Persistence with Neo4j-OGM
  • 3.2 Improvements to CPG Generation for Robust Analysis
    • 3.2.1 Wrapping Incomplete Code Snippets
    • 3.2.2 Enhanced Analysis Passes
    • 3.2.3 Data Flow Analysis
    • 3.2.4 Type Propagation and the Type Listener System

Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)

This thesis aims to extend the concept of Code Property Graphs (CPGs) for static analysis of Java code, specifically focusing on the robustness of the analysis. This involves handling incomplete code snippets and erroneous code, as well as addressing the challenges of inheritance and interprocedural data flow. The primary goal is to improve the accuracy and comprehensiveness of static code analysis by enabling the identification of vulnerabilities whose code patterns span across multiple methods and classes.

• Robust static code analysis of Java code
• Handling incomplete code snippets and erroneous code
• Addressing inheritance and interprocedural data flow
• Identification of vulnerabilities with patterns spanning multiple methods and classes
• Improving the accuracy and comprehensiveness of static code analysis

Zusammenfassung der Kapitel (Chapter Summaries)

The thesis begins with an introduction, defining the problem of static code analysis and outlining the structure of the thesis. Chapter 2 provides a detailed background on the state of the art in static code analysis, including concepts like robust analysis, Code Property Graphs (CPGs), and graph databases. Chapter 3 delves into the approach and implementation of the thesis, outlining the existing setup for CPG generation and discussing improvements made to enhance robustness. The improvements include strategies for handling incomplete code snippets, enhanced analysis passes, data flow analysis, and a type propagation system.

Schlüsselwörter (Keywords)

The core keywords and concepts explored in this thesis include static code analysis, Code Property Graphs (CPGs), robust analysis, incomplete code, erroneous code, inheritance, interprocedural data flow, graph databases, Neo4j, Java, and security vulnerabilities.