Idea: Measuring the Effect of Code Complexity on Static Analysis Results

  • James Walden
  • Adam Messer
  • Alex Kuhl
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5429)

Abstract

To understand the effect of code complexity on static analysis, thirty-five format string vulnerabilities were studied. We analyzed two code samples for each vulnerability, one containing the vulnerability and one in which the vulnerability was fixed. We examined the effect of code complexity on the quality of static analysis results, including successful detection and false positive rates. Static analysis detected 63% of the format string vulnerabilities, with detection rates decreasing with increasing code complexity. When the tool failed to detect a bug, it was for one of two reasons: the absence of security rules specifying the vulnerable function or the presence of a bug in the static analysis tool. Complex code is more likely to contain complicated code constructs and obscure format string functions, resulting in lower detection rates.

Keywords

Static analysis code complexity 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • James Walden
    • 1
  • Adam Messer
    • 1
  • Alex Kuhl
    • 1
  1. 1.Department of Computer ScienceNorthern Kentucky UniversityHighland HeightsUSA

Personalised recommendations