Self-Optimizing Static Program Analysis

Introduction

Software systems pervade our personal and professional lives, yet their insecurity threatens our society. To assure that software systems are dependable and secure, one must reason about their code. Static program analysis enables such reasoning.

Importance of Static Program Analysis

It can be applied to individual software components, and it can show not only the presence but also prove the absence of bugs and vulnerabilities. Yet, to be useful to software developers, static analyses must be adapted to the context in which they are used.

Challenges with Current Static Analyses

Studies show that poorly adapted analyses slow down rather than assist development. They report large sets of false warnings that distract developers from actual bugs, which the analyses often miss. Additionally, they often run so long that results are reported when they are already outdated.

Research Hypothesis of SOSA

SOSA’s main research hypothesis is that one can generate precise and efficient static analyses of software systems by making static analysis self-aware and self-optimizing.

Groundbreaking Paradigm Shift

With SOSA, a static analysis conducts analyses and optimizations not just of programs but of itself. This is a groundbreaking paradigm shift: no previous research has regarded complex program analyses themselves as the primary object of automated analysis and optimization.

Self-Adaptive Analyses

SOSA will introduce, for the first time, static analyses whose execution is not pre-defined by their creators but is inherently self-adaptive. As a result, analyses automatically adapt themselves to yield a performance/precision tradeoff that is optimal with respect to how the analysis is deployed and which program it analyzes.

Benefits of SOSA

With SOSA, static analyses will report true and relevant warnings at minimal analysis time without requiring manual optimizations by end users. SOSA will boost progress in the field of program-analysis research, mapping the landscape of static-analysis optimizations and how and where they are best applied.

Conclusion

By enabling software developers to optimally deploy static analyses with ease, SOSA will help secure millions of software systems.