Browse Definitions :
Definition

static analysis (static code analysis)

Static analysis, also called static code analysis, is a method of computer program debugging that is done by examining the code without executing the program. The process provides an understanding of the code structure and can help ensure that the code adheres to industry standards. Static analysis is used in software engineering by software development and quality assurance teams. Automated tools can assist programmers and developers in carrying out static analysis. The software will scan all code in a project to check for vulnerabilities while validating the code.

Static analysis is generally good at finding coding issues such as:

  • Programming errors
  • Coding standard violations
  • Undefined values
  • Syntax violations
  • Security vulnerabilities

The static analysis process is also useful for addressing weaknesses in source code that could lead to buffer overflows -- a common software vulnerability.

How is static analysis done?

The static analysis process is relatively simple, as long as it's automated. Generally, static analysis occurs before software testing in early development. In the DevOps development practice, it will occur in the create phases.

Once the code is written, a static code analyzer should be run to look over the code. It will check against defined coding rules from standards or custom predefined rules. Once the code is run through the static code analyzer, the analyzer will have identified whether or not the code complies with the set rules. It is sometimes possible for the software to flag false positives, so it is important for someone to go through and dismiss any. Once false positives are waived, developers can begin to fix any apparent mistakes, generally starting from the most critical ones. Once the code issues are resolved, the code can move on to testing through execution.

Without having code testing tools, static analysis will take a lot of work, since humans will have to review the code and figure out how it will behave in runtime environments. Therefore, it's a good idea to find a tool that automates the process. Getting rid of any lengthy processes will make for a more efficient work environment.

Types of static analysis

There are several static analysis methods an organization could use, which include:

  • Control analysis -- focuses on the control flow in a calling structure. For example, a control flow could be a process, function, method or in a subroutine.
  • Data analysis -- makes sure defined data is properly used while also making sure data objects are properly operating.
  • Fault/failure analysis -- analyzes faults and failures in model components.
  • Interface analysis -- verifies simulations to check the code and makes sure the interface fits into the model and simulation.

In a broader sense, with less official categorization, static analysis can be broken into formal, cosmetic, design properties, error checking and predictive categories. Formal meaning if the code is correct; cosmetic meaning if the code syncs up with style standards; design properties meaning the level of complexities; error checking which looks for code violations; and predictive, which asks how code will behave when run.

static analysis objectivesThis image shows some of the objectives within static analysis.

Benefits and drawbacks of static analysis

Benefits of using static analysis include:

  • It can evaluate all the code in an application, increasing code quality.
  • It provides speed in using automated tools compared to manual code review
  • Paired with normal testing methods, static testing allows for more depth into debugging code.
  • Automated tools are less prone to human error.
  • It will increase the likelihood of finding vulnerabilities in the code, increasing web or application security.
  • It can be done in an offline development environment.

However, static analysis comes with some drawbacks. For example, organizations should stay aware of the following:

  • False positives can be detected.
  • A tool might not indicate what the defect is if there is a defect in the code.
  • Not all coding rules can always be followed, like rules that need external documentation.
  • Static analysis may take more time than comparable methods.
  • Static analysis can't detect how a function will execute.
  • System and third-party libraries may not be able to be analyzed.

Static verification vs. dynamic verification

The principal advantage of static analysis is the fact that it can reveal errors that do not manifest themselves until a disaster occurs weeks, months or years after release. Nevertheless, static analysis is only a first step in a comprehensive software quality-control regime. After static analysis has been done, dynamic analysis is often performed in an effort to uncover subtle defects or vulnerabilities. In computer terminology, static means fixed, while dynamic means capable of action and/or change. Dynamic analysis involves the testing and evaluation of a program based on execution. Static and dynamic analysis, considered together, are sometimes referred to as glass-box testing.

Static analysis tools and vendors

There are plenty of static verification tools out there, so it can be confusing to pick the right one. Software tools will work at a variety of levels. Unit-level tools look at programs or subroutines. Technology-level tools will test between unit programs and a view of the overall program. System-level tools will analyze the interactions between unit programs. And mission-level tools will focus on mission layer terms, rules and processes. Before committing to a tool, an organization should also make sure that the tool supports the programming language they're using as well as the standards they want to comply with.

Embold is an example static analysis tool which claims to be an intelligent software analytics platform. The tool can automatically prioritize issues with code and give a clear visualization of it. The tool will also verify the correctness and accuracy of design patterns used in the code.

Kiuwan is another example of a static analyzer. It is a large platform that focuses on implementing static analysis in a DevOps environment. It features up to 4,000 updated rules based around 25 security standards. It also integrates well with Jenkins.

PyCharm is another example tool that is built for developers who work in Python with large code bases. The tool features code navigation, automatic refactoring as well as a set of other productivity tools.

This was last updated in July 2020

Continue Reading About static analysis (static code analysis)

SearchNetworking
  • virtual network functions (VNFs)

    Virtual network functions (VNFs) are virtualized tasks formerly carried out by proprietary, dedicated hardware.

  • network functions virtualization (NFV)

    Network functions virtualization (NFV) is a network architecture model designed to virtualize network services that have ...

  • overlay network

    An overlay network is a virtual or logical network that is created on top of an existing physical network.

SearchSecurity
  • encryption

    Encryption is the method by which information is converted into secret code that hides the information's true meaning.

  • X.509 certificate

    An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) ...

  • directory traversal

    Directory traversal is a type of HTTP exploit in which a hacker uses the software on a web server to access data in a directory ...

SearchCIO
  • resource allocation

    Resource allocation is the process of assigning and managing assets in a manner that supports an organization's strategic ...

  • chief digital officer (CDO)

    A chief digital officer (CDO) is charged with helping an enterprise use digital information and advanced technologies to create ...

  • security audit

    A security audit is a systematic evaluation of the security of a company's information system by measuring how well it conforms ...

SearchHRSoftware
SearchCustomerExperience
  • implementation

    Implementation is the execution or practice of a plan, a method or any design, idea, model, specification, standard or policy for...

  • first call resolution (FCR)

    First call resolution (FCR) is when customer service agents properly address a customer's needs the first time they call.

  • customer intelligence (CI)

    Customer intelligence (CI) is the process of collecting and analyzing detailed customer data from internal and external sources ...

Close