Skip to main content

Idea: Measuring the Effect of Code Complexity on Static Analysis Results

  • Conference paper
  • 465 Accesses

Part of the Lecture Notes in Computer Science book series (LNSC,volume 5429)


To understand the effect of code complexity on static analysis, thirty-five format string vulnerabilities were studied. We analyzed two code samples for each vulnerability, one containing the vulnerability and one in which the vulnerability was fixed. We examined the effect of code complexity on the quality of static analysis results, including successful detection and false positive rates. Static analysis detected 63% of the format string vulnerabilities, with detection rates decreasing with increasing code complexity. When the tool failed to detect a bug, it was for one of two reasons: the absence of security rules specifying the vulnerable function or the presence of a bug in the static analysis tool. Complex code is more likely to contain complicated code constructs and obscure format string functions, resulting in lower detection rates.


  • Static analysis
  • code complexity

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
USD   39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. Gcc 3.4 changes,

  2. Heffley, J., Meunier, P.: Can Source Code Auditing Software Identify Common Vulnerabilities and Be Used to Evaluate Software Security? In: Proceedings of the 37th Hawaii International Conference on System Sciences. IEEE Press, New York (2004)

    Google Scholar 

  3. Kratkiewicz, K., Lippmann, R.: Using a Diagnostic Corpus of C Programs to Evaluate Buffer Overflow Detection by Static Analysis Tools. In: 2005 Workshop on the Evaluation of Software Defect Tools (2005)

    Google Scholar 

  4. McCabe, T.J.: A Complexity Measure. IEEE Transactions on Software Engineering 2(4), 308–320 (1976)

    CrossRef  MathSciNet  MATH  Google Scholar 

  5. Newsham, T., Chess, B.: ABM: A Prototype for Benchmarking Source Code Analyzers. In: Workshop on Software Security Assurance Tools, Techniques, and Metrics. U.S. National Institute of Standards and Technology (NIST) Special Publication (SP), pp. 500–265 (2006)

    Google Scholar 

  6. NVD,


  8. SLOCCount,

  9. Wilander, J., Kamkar, M.: A Comparison of Publicly Available Tools For Static Intrusion Prevention. In: Proceedings of the 7th Nordic Workshop on Secure IT Systems, Karlstad, Sweden, pp. 68–84 (2002)

    Google Scholar 

  10. Zitser, M., Lippmann, R., Leek, T.: Testing Static Analysis Tools using Exploitable Buffer Overflows from Open Source Code. SIGSOFT Software Engineering Notes 29(6), 97–106 (2004)

    CrossRef  Google Scholar 

Download references

Author information

Authors and Affiliations


Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2009 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Walden, J., Messer, A., Kuhl, A. (2009). Idea: Measuring the Effect of Code Complexity on Static Analysis Results. In: Massacci, F., Redwine, S.T., Zannone, N. (eds) Engineering Secure Software and Systems. ESSoS 2009. Lecture Notes in Computer Science, vol 5429. Springer, Berlin, Heidelberg.

Download citation

  • DOI:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-00198-7

  • Online ISBN: 978-3-642-00199-4

  • eBook Packages: Computer ScienceComputer Science (R0)