KR102021383B1 - Method and apparatus for analyzing program by associating dynamic analysis with static analysis - Google Patents

Abstract

Disclosed is a program analysis method that combines static and dynamic analysis performed by a program analysis device. Program analysis method that combines static analysis and dynamic analysis, as a result of performing a static analysis of the source code of the web application, obtaining a static issue including the location of the defective source code, according to the location of the source code Parsing the source code to obtain at least one first Uniform Resource Locator (URL) address mapped to the static issue; performing dynamic analysis on the web application; Obtaining a dynamic issue that includes and matching the at least one first URL address with the at least one second URL address to determine an association issue between the dynamic issue and the static issue. As a result, software errors can be resolved more accurately and quickly by associating defects resulting from dynamic and static analysis.

Description

METHOD AND APPARATUS FOR ANALYZING PROGRAM BY ASSOCIATING DYNAMIC ANALYSIS WITH STATIC ANALYSIS}

The present invention relates to a method and apparatus for analyzing a program that combines dynamic analysis and static analysis. More specifically, the program is efficiently analyzed by additionally identifying a URL in the static analysis and linking it with dynamic analysis based on the identified URL. And a method and apparatus for detecting errors.

Test methods for detecting software defects (or errors) include static analysis and dynamic analysis.

In this case, the static analysis is a test method for detecting a defect without executing the software. The static analysis is a method of determining a criterion for a software error and comparing the test result with a criterion to detect the error. For example, static analysis can detect potential syntax defects, semantic defects, and the like in the source code.

At this time, the static analysis can determine the location of the defect in the source code as the analysis result, there is a problem that it is difficult to identify the test case causing the defect.

Dynamic analysis, on the other hand, is a test method that detects defects in the execution process by directly executing the software. After inputting specific data into the software, it is a method of determining whether the actual result and the expected result match.

At this time, the dynamic analysis generates a test case that can cause a software defect as a result of the analysis, it is difficult to determine the source code location where the software defect occurs, it is difficult to fix the defect quickly.

Therefore, there is a need for a method of linking dynamic analysis and static analysis to more easily identify and correct software defects.

An object of the present invention for solving the above problems is to provide a program analysis method incorporating static analysis and dynamic analysis.

Another object of the present invention for solving the above problems is to provide a program analysis device incorporating static analysis and dynamic analysis.

One aspect of the present invention for achieving the above object, there is provided a program analysis method incorporating static analysis and dynamic analysis performed by the program analysis device.

Here, the program analysis method that combines static analysis and dynamic analysis, as a result of performing a static analysis of the source code of the web application, obtaining a static issue including the location of the defective source code, the location of the source code Acquiring at least one first Uniform Resource Locator (URL) address mapped to the static issue by analyzing the source code according to the at least one second URL, and performing at least one second URL as a result of performing dynamic analysis on the web application. Obtaining a dynamic issue including an address and matching the at least one first URL address and the at least one second URL address with each other to determine an association issue between the dynamic issue and the static issue; can do.

The acquiring of the at least one first Uniform Resource Locator (URL) address may include classifying a source code according to a location of the source code into at least one of a controller code and a view code. The method may include obtaining a base URL address using a classified code, and processing the base URL address to obtain the first URL address.

The processing of the base URL address and obtaining the first URL address may include analyzing a configuration file of the web application to determine a prefix URL and a suffix URL associated with the base URL address. Verifying and removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address.

The acquiring the base URL address by using the classified code may include analyzing the controller code to obtain first additional information included in the controller code or a second related to the controller code in the configuration file. Obtaining the additional information and obtaining the base URL address from the first additional information or the second additional information.

The acquiring the base URL address by using the classified code may include obtaining a file path for the view code and processing the file path to obtain the base URL address.

The determining of an association issue between the dynamic issue and the static issue may include selecting at least one of the dynamic issues and at least one of the static issues to generate a first candidate group and generating the first candidate group. And matching the at least one first URL address with the at least one second URL address, and determining the related issue.

Here, the program analysis method linking the static analysis and the dynamic analysis, source code location of the static issue corresponding to the dynamic issue, based on a matching relationship between the at least one first URL address and the at least one second URL address. It may further comprise the step of deriving.

Here, the program analysis method that combines static analysis and dynamic analysis, deriving a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. It may further include.

Another aspect of the present invention for achieving the above object, there is provided a program analysis device that combines static analysis and dynamic analysis.

Here, the program analysis device incorporating static analysis and dynamic analysis may include at least one processor and a memory storing instructions for instructing the at least one processor to perform at least one step. It may include.

The at least one step may include obtaining a static issue including a location of a defective source code as a result of performing a static analysis of the source code of the web application, and extracting the source code according to the location of the source code. Analyzing and obtaining at least one first Uniform Resource Locator (URL) address mapped to the static issue; performing dynamic analysis on the web application, wherein the dynamic includes at least one second URL address Obtaining an issue and matching the at least one first URL address and the at least one second URL address with each other to determine an association issue between the dynamic issue and the static issue.

The acquiring of the at least one first Uniform Resource Locator (URL) address may include classifying a source code according to a location of the source code into one of a controller code and a view code; The method may include obtaining a base URL address using a classified code, and processing the base URL address to obtain the first URL address.

The processing of the base URL address and obtaining the first URL address may include analyzing a configuration file of the web application to determine a prefix URL and a suffix URL associated with the base URL address. Verifying and removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address.

The acquiring the base URL address by using the classified code may include analyzing the controller code to obtain first additional information included in the controller code or a second related to the controller code in the configuration file. Obtaining the additional information and obtaining the base URL address from the first additional information or the second additional information.

The acquiring the base URL address by using the classified code may include obtaining a file path for the view code and processing the file path to obtain the base URL address.

The determining of an association issue between the dynamic issue and the static issue may include selecting at least one of the dynamic issues and at least one of the static issues to generate a first candidate group and generating the first candidate group. And matching the at least one first URL address with the at least one second URL address, and determining the related issue.

Here, the instructions may be derived by the at least one processor, the source code location of the static issue corresponding to the dynamic issue, based on a matching relationship between the at least one first URL address and the at least one second URL address. May be instructed to perform further steps.

The instructions may further include, by the at least one processor, deriving a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. Can be instructed to perform.

When using the method and apparatus for analyzing a program by associating a dynamic analysis with a static analysis according to the present invention as described above, it is possible to identify a related issue between a dynamic issue (defect) and a static issue (defect).

In addition, it is possible to easily determine the location of the source code where the dynamic issue occurs, there is an advantage that can be easily repaired according to the dynamic issue.

In addition, the test case according to the static issue can be easily identified, so that the maintenance and testing of the static issue can be performed conveniently.

1 is an exemplary diagram of an overall system configuration in which a method for analyzing a program in association with dynamic analysis and static analysis according to an embodiment of the present invention is performed.
2 is a flowchart illustrating a program analysis method in which static analysis and dynamic analysis are combined according to an embodiment of the present invention.
3 is a flowchart illustrating a process of obtaining a URL address from source code of a web application according to an embodiment of the present invention.
4 is an exemplary diagram for determining an association issue between a static issue and a dynamic issue according to an embodiment of the present invention.
5 is a block diagram of a program analysis apparatus in which static analysis and dynamic analysis are linked according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the drawings, similar reference numerals are used for similar elements.

Terms such as first, second, A, and B may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary diagram of an overall system configuration in which a method for analyzing a program by associating a dynamic analysis with a static analysis according to an embodiment of the present invention is performed.

Referring to FIG. 1, the entire system targets the web application 10 and the source code 11 of the web application 10, such as the static analysis module 20, the dynamic analysis module 30, and the analysis device 40. It may include at least one of.

The program analysis method according to an embodiment of the present invention may be performed on the web application 10 and its source code 11 that are being developed or completed and run.

Here, the static analysis module 20 may be a software module that automatically analyzes the source code to search for defects in the source code, or may be a device in which the software module is driven.

Specifically, the static analysis module 20 includes a defect that assigns or references a value to a null pointer, a defect that terminates without returning the data resource generated by the function or method, or a defect that terminates without closing the stream generated by the method. For example, it is possible to detect and analyze various defects or errors in the source code, such as defects related to exception handling or defects caused by misuse of operators or functions. In this case, various defects or errors found may be referred to as static issues, or locations or source code contents of source codes in which various defects or errors occur may be referred to as static issues.

Here, the dynamic analysis module 30 may be a software module or a device on which the software module for driving the web application by accessing the web application on the web using various character strings set in advance for the web application as the URL parameter.

In detail, the dynamic analysis module 30 may generate an input value or a test case showing the malfunction or response when the web application malfunctions or exhibits a weak security response by operating the web application. In this case, the test case may be configured with a specific URL address and URL parameters to access the web application. Test cases may also be referred to as dynamic issues below.

 Here, the analysis device 40 may store a static issue and a dynamic issue by mediating between the static analysis module 20 and the dynamic analysis module 30. In addition, the analysis device 40 may identify the related issues in the matching relationship by matching the static issues with the dynamic issues.

Here, the static analysis module 20, the dynamic analysis module 30, and the analysis device 40 may be implemented as one integrated analysis device 50.

Here, the analysis device 40 or the integrated analysis device 50 may be referred to as a program analysis device in which static analysis and dynamic analysis are linked below.

2 is a flowchart illustrating a program analysis method in which static analysis and dynamic analysis are combined according to an embodiment of the present invention. 3 is a flowchart illustrating a process of obtaining a URL address from source code of a web application according to an embodiment of the present invention.

Referring to FIG. 2, a program analysis method incorporating static analysis and dynamic analysis performed by a program analysis device is a result of performing a static analysis on a source code of a web application, and includes a static source including a location of a defective source code. Obtaining an issue (S100), analyzing source code according to the location of the source code, and obtaining at least one first Uniform Resource Locator (URL) address mapped to the static issue (S200); As a result of performing dynamic analysis on the application, obtaining a dynamic issue including at least one second URL address (S300) and the at least one first URL address and the at least one second URL address are mutually different. Matching may include determining an association issue between the dynamic issue and the static issue (S400).

Here, the static analysis or the dynamic analysis may be performed directly in the above steps, or may be performed in another external device. When executed in another external device, the static and dynamic issues may be received and obtained from another external device.

Here, referring to FIG. 3, an operation (S200) of obtaining the at least one first Uniform Resource Locator (URL) address may be described in more detail.

In detail, referring to FIG. 3, in the obtaining of the at least one first Uniform Resource Locator (URL) address (S100), the source code according to the location of the source code may be a controller code and a view code. classifying into one of the view codes (S110), obtaining a base URL address using the classified code (S120), and processing the base URL address to obtain the first URL address (S130). It may include.

Here, the source code according to the position of the source code may indicate the source code on the position of the defective source code as a result of the static analysis. At this time, the source code on the location may indicate a method, a function, or in some cases, the entire class including the location.

Here, the controller code is a part of the source code for controlling the operation and operation of the web application, the view code may be the source code constituting the web page displayed on the screen in the web application.

In operation S130, the processing of the base URL address to obtain the first URL address may include analyzing a configuration file of the web application to fix a prefix URL and a suffix URL associated with the base URL address. URL) and removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address. Here, the suffix URL may be referred to as a postfix URL.

Here, the web application can determine the detailed operation according to the suffix URL, not the prefix URL, and the test case according to the dynamic analysis is also derived including the URL, so that the prefix URL can be removed for easy matching.

2 and 3, in step S120 of obtaining a base URL address using the classified code, analyzing the controller code to obtain first additional information included in the controller code, or The method may include obtaining second additional information related to the controller code from a configuration file (S122) and obtaining the base URL address from the first additional information or the second additional information (S124).

Here, the obtaining of the base URL address using the classified code (S120) may include obtaining the file path for the view code (S126) and processing the file path to obtain the base URL address. It may include (S128).

Here, the determining of the association issue between the dynamic issue and the static issue (S400) may include generating a first candidate group by selecting at least one of the dynamic issue and at least one of the static issue, and generating the first candidate group. In the candidate group, the at least one first URL address and the at least one second URL address may be matched with each other to determine the related issue.

Here, the program analysis method linking the static analysis and the dynamic analysis, source code location of the static issue corresponding to the dynamic issue, based on a matching relationship between the at least one first URL address and the at least one second URL address. It may further comprise the step of deriving.

By deriving the source code location of the static issue corresponding to the dynamic issue, the source code location corresponding to the dynamic issue can be quickly identified and repaired.

Here, the program analysis method that combines static analysis and dynamic analysis, deriving a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. It may further include.

That is, since dynamic issues corresponding to static issues can be derived, it is possible to determine whether they have been correctly repaired by testing test cases according to dynamic issues when solving problems of static issues.

4 is an exemplary diagram for determining an association issue between a static issue and a dynamic issue according to an embodiment of the present invention.

Referring to FIG. 4, it is possible to identify a related issue 42 having a relation between the static issue 22 and the dynamic issue 32, and to explain the selection of the candidate group 44.

Specifically, as a result of the static analysis, one or more static issues 22 may be derived, each of which has location information of source code in which an error or a defect is found (for example, org.path1.path3). , org.path2.path2, etc.), and a plurality of source code location information can be found for one static issue.

Next, by directly analyzing the source code on the location of the source code based on the location information of the source code, it is possible to obtain a URL address associated with the source code.

 In addition, as a result of the dynamic analysis, one or more URL addresses (eg url / url2, etc.) may be derived as one or more dynamic issues 32.

Next, based on whether the URL addresses match or exclude partial URLs (e.g. protocols such as http, domain names on the Internet of the server or computer such as www. ***. Com, etc.), By matching the matching static and dynamic issues, matching issues can be referred to as association issues.

On the other hand, in order to identify the related issues, dynamic and static issues can be matched with each other, so many issues must be compared with each other.

In particular, in general, millions of dynamic issues or static issues may occur, and many dynamic issues or static issues are frequently viewed at a time, which may further deteriorate performance.

Therefore, rather than querying all dynamic issues and static issues, it is possible to reduce the performance degradation by combining static issues and some dynamic issues into one candidate group and matching dynamic issues and static issues individually for each candidate group.

Specifically, referring to FIG. 4, one candidate group 44 may include a static issue having issue numbers 1 and 2 and a dynamic issue having issue number 1.

Subsequently, when searching for related issues, matching is performed for one candidate group to prevent performance degradation caused by all matching at once.

Specifically, when there is a candidate group, the inquiry (or analysis) cost may be an inquiry cost for the number of candidate groups and one candidate group. On the other hand, the inquiry cost when the candidate group is not configured may be as shown in Equation 1 below.

Here, the source code URL information may be information including a URL address derived from the source code location according to the static issue.

5 is a block diagram of a program analysis apparatus in which static analysis and dynamic analysis are linked according to an embodiment of the present invention.

Referring to FIG. 5, the program analysis apparatus 100 that combines static analysis and dynamic analysis may include instructions for instructing at least one processor 110 and the at least one processor 110 to perform at least one step. It may include a memory (120) for storing the instructions (memory).

The at least one step may include obtaining a static issue including a location of a defective source code as a result of performing a static analysis of the source code of the web application, and extracting the source code according to the location of the source code. Analyzing and obtaining at least one first Uniform Resource Locator (URL) address mapped to the static issue; performing dynamic analysis on the web application, wherein the dynamic includes at least one second URL address Obtaining an issue and matching the at least one first URL address and the at least one second URL address with each other to determine an association issue between the dynamic issue and the static issue.

The acquiring of the at least one first Uniform Resource Locator (URL) address may include classifying a source code according to a location of the source code into one of a controller code and a view code; The method may include obtaining a base URL address using a classified code, and processing the base URL address to obtain the first URL address.

The processing of the base URL address and obtaining the first URL address may include analyzing a configuration file of the web application to determine a prefix URL and a suffix URL associated with the base URL address. Verifying and removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address.

The acquiring the base URL address by using the classified code may include analyzing the controller code to obtain first additional information included in the controller code or a second related to the controller code in the configuration file. Obtaining the additional information and obtaining the base URL address from the first additional information or the second additional information.

The acquiring the base URL address by using the classified code may include obtaining a file path for the view code and processing the file path to obtain the base URL address.

The determining of an association issue between the dynamic issue and the static issue may include selecting at least one of the dynamic issues and at least one of the static issues to generate a first candidate group and generating the first candidate group. And matching the at least one first URL address with the at least one second URL address, and determining the related issue.

In this case, the instructions may be generated by the at least one processor 110 based on a matching relationship between the at least one first URL address and the at least one second URL address. It may be instructed to further perform the step of deriving the position.

Herein, the instructions may be generated by the at least one processor 110 to derive a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. You may be instructed to perform further steps.

Herein, the program analysis device 100 linking the static analysis and the dynamic analysis further includes a communication module 130 that receives a static issue or a dynamic issue that is a result of performing the static analysis or the dynamic analysis from an external static analysis device or the dynamic analysis device. It may include.

Here, the program analysis apparatus 100 integrating the static analysis and the dynamic analysis may further include a storage 140 for storing the dynamic issue and the static issue and storing the related issue matching the dynamic issue and the static issue.

Examples of the program analysis apparatus 100 that combines static analysis and dynamic analysis include a desktop computer, a laptop computer, a notebook, a smartphone, a tablet PC ( tablet PC), mobile phone, smart watch, smart glass, e-book reader, portable multimedia player, portable game console, navigation device, digital camera camera, digital multimedia broadcasting (DMB) player, digital audio recorder, digital audio player, digital video recorder, digital video player, personal digital assistant (PDA) Digital Assistant).

Here, the program analysis apparatus 100 in which the static analysis and the dynamic analysis are linked may perform the program analysis method or a method corresponding thereto according to FIGS. 2 and 3, and redundant description is omitted.

The methods according to the invention can be implemented in the form of program instructions that can be executed by various computer means and recorded on a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like. The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in computer software.

Examples of computer readable media may include hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions may include high-level language code that can be executed by a computer using an interpreter, as well as machine code such as produced by a compiler. The hardware device described above may be configured to operate with at least one software module to perform the operations of the present invention, and vice versa.

In addition, the method or apparatus described above may be implemented by combining all or part of the configuration or function, or may be implemented separately.

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art will be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below I can understand that you can.

Claims (16)

In the program analysis method that combines static analysis and dynamic analysis performed by the program analysis device,
Obtaining a static issue including a location of the defective source code as a result of performing a static analysis on the source code of the web application;
Analyzing the source code according to the location of the source code to obtain at least one first Uniform Resource Locator (URL) address mapped to the static issue;
Obtaining a dynamic issue including at least one second URL address as a result of performing the dynamic analysis on the web application; And
Matching the at least one first URL address and the at least one second URL address with each other to determine an association issue between the dynamic issue and the static issue,
Obtaining the at least one first Uniform Resource Locator (URL) address,
Obtaining a base URL address from the source code;
Analyzing a configuration file of the web application to identify a prefix URL and a suffix URL associated with the base URL address; And
Removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address. In claim 1,
Obtaining the base URL address,
Classifying the source code according to the location of the source code into one of a controller code and a view code; And
A program analysis method incorporating static analysis and dynamic analysis, comprising obtaining a base URL address using the classified code. delete In claim 2,
Obtaining a base URL address using the classified code,
Analyzing the controller code to obtain first additional information included in the controller code or to obtain second additional information related to the controller code from the configuration file; And
And acquiring the base URL address from the first additional information or the second additional information. In claim 2,
Obtaining a base URL address using the classified code,
Obtaining a file path for the view code; And
Processing the file path to obtain the base URL address. In claim 1,
The determining of the association issue between the dynamic issue and the static issue may include:
Selecting at least one of the dynamic issues and at least one of the static issues to generate a first candidate group; And
In the generated first candidate group, matching the at least one first URL address and the at least one second URL address with each other, and determining the association issue. Way. In claim 1,
Deriving a source code location of a static issue corresponding to the dynamic issue based on a matching relationship between the at least one first URL address and the at least one second URL address. Program analysis method linked to. In claim 1,
And deriving a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. Way. At least one processor; And
A program analysis device incorporating static analysis and dynamic analysis, comprising: a memory for storing instructions instructing the at least one processor to perform at least one step;
The at least one step,
Obtaining a static issue including a location of the defective source code as a result of performing a static analysis on the source code of the web application;
Analyzing the source code according to the location of the source code to obtain at least one first Uniform Resource Locator (URL) address mapped to the static issue;
Obtaining a dynamic issue including at least one second URL address as a result of performing the dynamic analysis on the web application; And
Matching the at least one first URL address and the at least one second URL address with each other to determine an association issue between the dynamic issue and the static issue,
Obtaining the at least one first Uniform Resource Locator (URL) address,
Obtaining a base URL address from the source code;
Analyzing a configuration file of the web application to identify a prefix URL and a suffix URL associated with the base URL address; And
And removing the prefix URL from the base URL, and adding the suffix URL to obtain the first URL address. In claim 9,
Obtaining the base URL address,
Classifying the source code according to the location of the source code into one of a controller code and a view code; And
A program analysis device incorporating static analysis and dynamic analysis, comprising obtaining a base URL address using the classified code. delete In claim 10,
Obtaining a base URL address using the classified code,
Analyzing the controller code to obtain first additional information included in the controller code or to obtain second additional information related to the controller code from the configuration file; And
And obtaining the base URL address from the first additional information or the second additional information. In claim 10,
Obtaining a base URL address using the classified code,
Obtaining a file path for the view code; And
And processing the file path to obtain the base URL address. In claim 9,
The determining of the association issue between the dynamic issue and the static issue may include:
Selecting at least one of the dynamic issues and at least one of the static issues to generate a first candidate group; And
In the generated first candidate group, matching the at least one first URL address and the at least one second URL address with each other, and determining the association issue. Device. In claim 9,
The instructions may include the at least one processor,
And based on a matching relationship between the at least one first URL address and the at least one second URL address, deriving a source code location of a static issue corresponding to the dynamic issue. Program analysis device incorporating dynamic analysis. In claim 9,
The instructions may be generated by the at least one processor,
Linking the static analysis with the dynamic analysis, further instructing to derive a dynamic issue corresponding to the static issue based on a matching relationship between the at least one first URL address and the at least one second URL address. Program analysis device.

Images