KR20180120966A - Method and device for defect tracking - Google Patents

Abstract

Embodiments disclosed in the present application relate to a method and device for detecting a defect and, more specifically, to a method and device for detecting a defect facilitating correction of a defect by visualizing occurrence of a defect according to a category of a defect detected in a source code. As a technical means for achieving a technical objective, according to one embodiment of the present application, the method performed by the device comprises the steps of: generating a control flowchart based on a source code to be analyzed; analyzing the source code to detect a defect; analyzing the defect to determine a category of the defect; and generating a trace graph for the defect based on the category and the control flowchart.

Description

[0001] METHOD AND DEVICE FOR DEFECT TRACKING [0002]

Embodiments disclosed herein relate to a defect tracking method and a defect tracking apparatus, and more particularly, to a defect tracking method and a defect tracking method for visualizing a defect occurrence process according to a category of a defect detected in a source code, And a defect tracking apparatus.

In software development, source code can have potential execution errors and security weaknesses, especially when it is designed, developed and tested according to the software development process, making it difficult to detect errors or weak points in the source code. Therefore, a technique for finding errors or weak points in the source code is proposed.

For example, software security and quality checking tools that detect errors such as execution errors and security vulnerabilities by applying a technique of analyzing computer program source code and estimating program behavior are widely utilized.

Using these analysis tools, the developer can correct the defect, but it takes considerable time and difficulty in correcting the defect, especially when the entire program is composed of a large number of source codes.

Therefore, it is necessary to develop a technique for solving the above-mentioned problems.

Korean Patent Application No. 10-2010-0057732, which is related to the prior art, describes an apparatus and a system for integrally managing the plurality of static analysis tools in an environment using a plurality of program static analysis tools, The problem is not solved.

On the other hand, the background art described above is technical information acquired by the inventor for the derivation of the present invention or obtained in the derivation process of the present invention, and can not necessarily be a known technology disclosed to the general public before the application of the present invention .

The embodiments disclosed herein are aimed at providing a defect analysis method and a defect analysis apparatus.

In addition, the embodiments are intended to visualize and report the occurrence of defects in the source code, thereby allowing the developer to more intuitively grasp the cause of defects, and to reduce the time and cost required for defect correction.

According to an embodiment of the present invention, there is provided a defect tracking method performed by a defect tracking apparatus, comprising: generating a control flowchart based on a source code to be analyzed; Analyzing the source code to detect defects; Analyzing the defect to determine a category of the defect; And generating a tracking graph for the defect based on the category and the control flow diagram.

According to yet another embodiment, a computer-readable recording medium on which a program for performing a defect tracking method is recorded is disclosed. At this time, the defect tracking method is performed by the defect tracking device, and includes the steps of generating a control flowchart based on the source code to be analyzed; Analyzing the source code to detect defects; Analyzing the defect to determine a category of the defect; And generating a trace graph for the defect based on the category and the control flow diagram.

According to yet another embodiment, a computer program stored on a medium for performing a defect tracking method, which is performed by a defect tracking apparatus, is disclosed. At this time, the defect tracking method is performed by the defect tracking device, and includes the steps of generating a control flowchart based on the source code to be analyzed; Analyzing the source code to detect defects; Analyzing the defect to determine a category of the defect; And generating a trace graph for the defect based on the category and the control flow diagram.

According to another embodiment, there is provided an information processing apparatus including a storage unit for storing a source code to be analyzed; And a control unit for generating a control flowchart based on the source code, analyzing the source code to determine a category of a defect of the detected source code, and generating a trace graph for the defect based on the category A defect tracking device is disclosed.

According to any one of the above-mentioned means for solving the above-mentioned problems, the embodiments disclosed herein can suggest a defect analysis method and a defect analysis apparatus.

In addition, according to the embodiment, it is possible to visualize and report the occurrence process of a defect of the source code, thereby allowing the developer to more intuitively understand the cause of the defect, and to save time and cost for defect correction.

The effects obtained in the disclosed embodiments are not limited to the effects mentioned above, and other effects not mentioned are obvious to those skilled in the art to which the embodiments disclosed from the following description belong It can be understood.

1 is a block diagram showing the configuration of a defect tracking apparatus according to an embodiment.
2 is a flowchart for explaining a defect tracking method according to one embodiment.

Various embodiments are described in detail below with reference to the accompanying drawings. The embodiments described below may be modified and implemented in various different forms. In order to more clearly describe the features of the embodiments, detailed descriptions of known matters to those skilled in the art are omitted. In the drawings, parts not relating to the description of the embodiments are omitted, and like parts are denoted by similar reference numerals throughout the specification.

Throughout the specification, when a configuration is referred to as being "connected" to another configuration, it includes not only a case of being directly connected, but also a case of being connected with another configuration in between. In addition, when a configuration is referred to as " including ", it means that other configurations may be included, as well as other configurations, as long as there is no specially contradicted description.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of a defect tracking apparatus 100 according to an embodiment of the present invention.

Here, the defect tracking apparatus 100 may be embodied as a computing device capable of storing a source code of a program to be subjected to program analysis and performing an application for analyzing the program.

For example, the defect tracking device 100 may be implemented as an electronic terminal equipped with an application, or may be implemented as a server-client system, and the system may include an electronic terminal equipped with a client for interaction with a user .

At this time, the electronic terminal may be implemented as a computer, a portable terminal, a television, a wearable device, or the like, which may include an interface capable of interacting with a user. Here, the computer includes, for example, a notebook computer, a desktop computer, a laptop computer, and the like, each of which is equipped with a web browser (WEB Browser), and the portable terminal may be a wireless communication device , Personal Communication System (PCS), Personal Digital Cellular (PDC), Personal Handyphone System (PHS), Personal Digital Assistant (PDA), Global System for Mobile communications (GSM), International Mobile Telecommunication (IMT) (W-CDMA), Wibro (Wireless Broadband Internet), Smart Phone, Mobile WiMAX (Mobile Worldwide Interoperability for Microwave Access) (Handheld) based wireless communication device. In addition, the television may include an Internet Protocol Television (IPTV), an Internet television (TV), a terrestrial TV, a cable TV, and the like. Further, the wearable device is an information processing device of a type that can be directly worn on a human body, for example, a watch, a glasses, an accessory, a garment, shoes, and the like. The wearable device can be connected to a remote server via a network, Lt; / RTI >

The server may be implemented as a computing device capable of communicating with an electronic terminal equipped with a client for interacting with a user via a network, and may include a storage device capable of storing data, or a third server (not shown) Data can be stored.

Further, the defect tracking apparatus 100 may be implemented in the form of an electronic terminal or a server-client as described above.

Hereinafter, a process of performing the defect tracking method by the defect tracking apparatus 100 according to an embodiment will be described in detail.

Referring to FIG. 1, a defect tracking apparatus 100 according to an embodiment may include an input / output unit 110, a storage unit 120, and a control unit 130.

The input / output unit 110 may include an input unit for receiving inputs such as user settings in program analysis, and an output unit for displaying information such as a result of performing an operation or a status of the defect tracking apparatus 100. For example, the input / output unit 110 may include an operation panel for receiving user input and a display panel for displaying a screen.

In particular, the input unit may include devices capable of receiving various types of user input, such as a keyboard, a physical button, a touch screen, a camera or a microphone. Further, the output unit may include a display panel, a speaker, a headset, or the like. However, the present invention is not limited to this, and the input / output unit 110 may include various input / output support structures.

On the other hand, the storage unit 120 may store the source code of the program to be analyzed by the program, or may store and operate software such as application and / or device driver for program analysis. According to an embodiment, the storage unit 120 may include a synchronous random access memory (SRAM) and / or a dynamic random access memory (DRAM). A solid state drive (SSD), a flash memory, a magnetic random access memory (MRAM), a phase change RAM (PRAM), a ferroelectric RAM (FeRAM) hard disk, a flash memory, and the like.

Meanwhile, the controller 130 controls the overall operation of the defect tracking method performed by the defect tracking apparatus 100, and may include a processor such as a CPU.

The controller 130 may analyze the source code stored in the storage unit 120 according to an embodiment of the present invention. At this time, the control unit 130 analyzes the source code based on the user setting received through the input unit, and controls the output unit to output the analysis result of the source code.

For example, the control unit 130 analyzes syntax, flow, control flow, and semantics of the source code to detect defects such as execution errors and security vulnerabilities in advance .

According to a specific embodiment, the control unit 130 can generate the control flow chart based on the source code to be analyzed. At this time, the control flow chart can be a basis for generating a defect tracking graph to be described later.

Meanwhile, the control unit 130 may determine the category of the detected defect in the process of analyzing the source code. At this time, the controller 130 may visualize the process of generating the defect based on the category of the defect and the control flowchart. For example, the control unit 130 may be based on a control flow chart, and may include at least one of adding a connection line for tracking the occurrence of a defect according to the category of the defect, adding highlight color to the node and adding a defect report including text describing the defect You can do one to generate a trace graph for the defect.

In relation to the determination of the category of the defect, the control unit 130 searches for the cause point and the occurrence point of the defect, and determines whether the cause point and the occurrence point are present and whether the cause point and the generation point are the same. It can be judged. At this time, the cause of the defect can be predicted by judging the category, and the defect tracking and graph generation can be performed more quickly.

For example, if there is a cause point and an occurrence point of a defect, and the cause point and the occurrence point are the same, the control unit 130 can classify the defect at this time into the first category.

In this case, the control unit 130 may add a defect report describing the defect to the defect occurrence point of the control flow diagram. In addition, defects can be visualized by assigning highlight colors to defect occurrence points.

Also, the controller 130 may classify defects at the time of occurrence of defects, if there are no defect points, into the second category. Such defects may include inadequate resource release defects. In the case of 'Inadequate resource release defect', it is a code that allocates a resource but omits release of the resource. In this case, it is the 'location to allocate resources' that is reported as the cause of the defect, but it is necessary to indicate that the release of the resource is missing in order to show why the allocation of the resource is defective.

Accordingly, the controller 130 searches for an allocation point for the cause resource of the defect and the inaccessible point for the cause resource, and adds the connection line and the defect report for the allocation point and the inaccessible point. The 'inaccessible point' may include the end point of the function.

For example, the control unit 130 may add an explanation that the resource is allocated to the allocation point, and may give a highlight color. In addition, the controller 130 may add a connection line connecting the control flow from the allocation point to the inaccessible point, and may add a defect report indicating that the resource release is missing to the connection line. In addition, the controller 130 may assign an emphasis color to intermediate nodes of the control flow.

On the other hand, if the cause point and the occurrence point of the defect exist, but the cause point and the occurrence point are not the same, the control unit 130 can classify the defect at this time into the third category. Defects in the third category may include problems with SQL injection. That is, a defect of the third category may include a problem of allowing an unintended operation by directly transmitting an SQL command to a function without an external input checking process. In this case, the function or variable corresponding to the external input becomes the cause point, and the function that executes the SQL command becomes the generation point.

At this time, the controller 130 may add a connection line to the cause point and the occurrence point. In connection with the cause point and the connection line to the point of occurrence, the connection line may include a connection line indicating at least one of a data flow and a control flow.

In addition, the control unit 130 may add a defect report to the external input, which is the cause of the defect, and a report on the manipulation processing of the external input. For example, the control unit 130 may add, to the cause point, a defect report that explains that the defect is due to an external input. Also, the control unit 130 may add a defect report to the connection line, which explains that there is no processing for the SQL operation of the external input. At this time, the processing for the SQL operation may include a check to be performed before applying the SQL command to the function. The control unit 130 may add a defect report to the point of occurrence that explains that an external input that may include an SQL operation has been transferred, and may give an emphasis color to the point of occurrence.

On the other hand, if it is determined that there is no defective point and the defective point only exists, the controller 130 classifies the defective point into the fourth category. According to the embodiment, in the case of a defect of the fourth category, an integer overflow defect may be included. An integer overflow fault is a fault that occurs when the integer data type is out of the range of the integer data type. In this case, since the change of the value itself causes the defect, the point where the defect occurs is obvious to the point where the result of the operation is generated, but the cause point may not be clearly determined.

At this time, the controller 130 detects the occurrence of the integer overflow and may add a defect report for the operation defect causing the integer overflow. For example, the control unit 130 may add a defect report to the occurrence point to explain that an integer overflow has occurred as a result of the operation, and may give a highlight color.

Further, the control unit 130 may add a connection line for the flow of data and the control flow from the point of occurrence. That is, the generation process of the defect can be visualized by adding a connection line that follows the data flow and control flow in reverse order from the generation point. At this time, the control unit 130 may add a connection line connected to at least one of a generation point and a parameter of data for generating the integer overflow. For example, the control unit 130 may add a connection line connecting the generation point of the data to the generation point of the data when the generation point of the data causing the defect is in the function. The generation point of the data causing the defect may be outside the function, You can add a connection line that connects up to the parameter.

In addition, the control unit 130 reports a predicted value before and after the operation of the corresponding node to a node involved in the operation, that is, a node involved in the change of the value among the intermediate nodes of the data flow and the control flow Can be added. At this time, emphasis effect such as emphasis color or the like can be given to the node and the connecting line of the portion where the value changes.

In this regard, the controller 130 may provide a tracking extension to provide more effective defect tracking. According to an embodiment, the control unit 130 may provide a tracking extension by providing the tracking extension button to the user, and receiving an input to the tracking extension button. For example, the control unit 130 displays a trace extension button in the vicinity of a parameter involved in the occurrence of a defect, and upon receiving an input to the trace extension button, provides a point for calling a function associated with the parameter, And a defect tracking graph for the fourth category defect described above can be generated and provided again at the call point selected by the user.

As described above, the defect tracking apparatus 100 can display at least one of a data flow, a control flow, and a function call in generating a defect tracking graph based on a control flow chart. At this time, Data flow, control flow, and function calls can be mixed and displayed as needed, polymorphically. Accordingly, the user can intuitively determine the cause and the occurrence process of the defect, thereby shortening the time for correcting the source code and saving effort.

2 is a flowchart for explaining a defect tracking method according to embodiments. The defect tracking method according to the embodiments shown in FIG. 2 includes the steps of time-series processing in the defect tracking apparatus 100 shown in FIG. Therefore, even if omitted from the following description, the above description of the defect tracking apparatus 100 shown in FIG. 1 can be applied to the defect tracking method according to the embodiments shown in FIG.

Referring to FIG. 2, the defect tracking apparatus 100 may generate a control flowchart based on a source code to be analyzed (S21). Also, the defect tracking apparatus 100 may analyze the source code to detect a defect (S22), and analyze the defect to determine the category of the defect (S23). Then, the defect tracking apparatus 100 can generate a trace graph for the defect based on the category and the control flow chart (S24).

According to the embodiment, the defect tracking apparatus 100 searches the cause point and the occurrence point of the defect in determining the category of the defect by analyzing the defect (S23), and based on the presence and absence of the cause point and the occurrence point The category can be judged.

According to the related embodiment, the defect tracking apparatus 100 judges a category based on the cause and the occurrence point of the defect and the presence or absence of the defect, and if the cause point and the occurrence point of the defect exist and the cause point and the occurrence point are the same , The defect can be classified into the first category. In this case, the defect tracking apparatus 100 may add a defect report to the generation point in generating a defect tracking graph (S24).

In addition, the defect tracking apparatus 100 determines the category based on the cause and the location of the defect and whether or not there is a defect, and if there is a defect cause point and a defect occurrence point does not exist, Category. In this case, the defect tracking apparatus 100 searches the allocation point for the cause resource of the defect and the inaccessible point for the cause resource in generating the defect tracking graph (S24) You can add connectors and fault reports.

On the other hand, the defect tracking apparatus 100 judges a category on the basis of the cause point and the occurrence point of the defect based on the presence or absence of the defect, and if the cause point and the occurrence point of the defect exist and the cause point and the occurrence point are not the same, Defects can be classified into the third category. In this case, in generating a defect tracing graph (S24), the defect tracking apparatus 100 adds a connection line to a cause point and a generation point, and performs a defect report on the external input, which is the cause of the defect, Can be added to the defect report.

Then, the defect tracking apparatus 100 judges the category based on the cause of the defect and the presence or absence of the defect, and if there is no cause of the defect and the defect occurs, . In this case, the defect tracking apparatus 100 detects the occurrence of an integer overflow in generating a defect tracking graph (S24), adds a defect report for an operation result that causes an integer overflow, You can add connection lines to display data flow and control flow.

At this time, the defect tracking apparatus 100 adds a defect report to the node that performs the calculation that causes the defect caused by the integer overflow among the nodes included in the data flow and the control flow, You can add a defect report that reports the value.

The defect tracking apparatus 100 may add a connection line, and may add a connection line to at least one of a data generation point and a parameter for generating an integer overflow from a generation point.

When the defect tracking apparatus 100 receives from the user a trace extension for the parameter, the defect tracking apparatus 100 also provides one or more function call points connected to the parameter for the user and generates a defect trace graph for the selected function call point from the user .

The term " part " used in the above embodiments means a hardware component such as a software or a field programmable gate array (FPGA) or an ASIC, and the 'part' performs certain roles. However, 'part' is not meant to be limited to software or hardware. &Quot; to " may be configured to reside on an addressable storage medium and may be configured to play one or more processors. Thus, by way of example, 'parts' may refer to components such as software components, object-oriented software components, class components and task components, and processes, functions, , Subroutines, segments of program patent code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

The functions provided within the components and components may be combined with a smaller number of components and components or separated from additional components and components.

In addition, the components and components may be implemented to play back one or more CPUs in a device or a secure multimedia card.

The defect tracking method according to the embodiments described with reference to FIG. 2 may also be implemented in the form of a computer-readable medium for storing instructions and data executable by a computer. At this time, the command and data may be stored in the form of program code, and when executed by the processor, a predetermined program module may be generated to perform a predetermined operation. In addition, the computer-readable medium can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. The computer-readable medium can also be a computer storage medium, which can be volatile and non-volatile, implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, Volatile, removable and non-removable media. For example, the computer recording medium may be a magnetic storage medium such as an HDD and an SSD, an optical recording medium such as a CD, a DVD and a Blu-ray Disc, or a memory included in a server accessible via a network.

The defect tracking method according to the embodiments described with reference to FIG. 2 may also be implemented as a computer program (or a computer program product) including instructions executable by a computer. A computer program includes programmable machine instructions that are processed by a processor and can be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language . The computer program may also be recorded on a computer readable recording medium of a type (e.g., memory, hard disk, magnetic / optical medium or solid-state drive).

Thus, the defect tracking method according to the embodiments described with reference to FIG. 2 can be implemented by a computer program as described above being executed by the computing device. The computing device may include a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using a variety of buses and can be mounted on a common motherboard or mounted in any other suitable manner.

Where the processor may process instructions within the computing device, such as to display graphical information to provide a graphical user interface (GUI) on an external input, output device, such as a display connected to a high speed interface And commands stored in memory or storage devices. As another example, multiple processors and / or multiple busses may be used with multiple memory and memory types as appropriate. The processor may also be implemented as a chipset comprised of chips comprising multiple independent analog and / or digital processors.

The memory also stores information within the computing device. In one example, the memory may comprise volatile memory units or a collection thereof. In another example, the memory may be comprised of non-volatile memory units or a collection thereof. The memory may also be another type of computer readable medium such as, for example, a magnetic or optical disk.

And the storage device can provide a large amount of storage space to the computing device. The storage device may be a computer readable medium or a configuration including such a medium and may include, for example, devices in a SAN (Storage Area Network) or other configurations, and may be a floppy disk device, a hard disk device, Or a tape device, flash memory, or other similar semiconductor memory device or device array.

It will be apparent to those skilled in the art that the above-described embodiments are for illustrative purposes only and that those skilled in the art will readily understand that other embodiments can be readily modified without departing from the spirit or essential characteristics of the embodiments described above You will understand. It is therefore to be understood that the above-described embodiments are to be considered in all respects only as illustrative and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is to be understood that the scope of the present invention is defined by the appended claims rather than the foregoing description and should be construed as including all changes and modifications that come within the meaning and range of equivalency of the claims, .

100: defect tracking device 110: input /
120: storage unit 130:

Claims (13)

A defect tracking method performed by a defect tracking apparatus,
Generating a control flow diagram based on source code to be analyzed;
Analyzing the source code to detect defects;
Analyzing the defect to determine a category of the defect; And
And generating a tracking graph for the defect based on the category and the control flow diagram. The method according to claim 1,
Wherein the step of analyzing the defect to determine the category of the defect comprises:
Wherein the defect location is searched for the cause point and the occurrence point of the defect, and the category is determined based on whether the cause point and the occurrence point exist or not. 3. The method of claim 2,
Wherein the step of analyzing the defect to determine the category of the defect comprises:
And classifying the defects into the first category when the cause point and the occurrence point of the defect exist, and if the cause point and the occurrence point are the same, the defect is classified into the first category and,
Wherein generating the defect tracking graph based on the category comprises:
And adding a defect report to the occurrence point. 3. The method of claim 2,
Wherein the step of analyzing the defect to determine the category of the defect comprises:
And classifying the defect into a second category if the cause point of the defect exists and the point of occurrence of the defect does not exist,
Wherein generating the defect tracking graph based on the category comprises:
Searching for an allocation point for the cause resource of the defect and an inaccessible point for the cause resource, and adding a connection line and a defect report for the allocation point and the inaccessible point. 3. The method of claim 2,
Wherein the step of analyzing the defect to determine the category of the defect comprises:
The defect category is classified into a third category when the cause point and the occurrence point of the defect exist and the cause point and the generation point are not the same, Lt; / RTI &
Wherein generating the defect tracking graph based on the category comprises:
Adding a causal point and a connection line to the occurrence point, and adding a defect report for the external input that is the cause of the defect and a defect report for the manipulation processing of the external input. 3. The method of claim 2,
Wherein the step of analyzing the defect to determine the category of the defect comprises:
Wherein the category is determined based on the presence and absence of the defect, and if the cause of the defect does not exist and a defect occurrence point exists, the defect is classified into a fourth category,
Wherein generating the defect tracking graph based on the category comprises:
Characterized in that it detects the occurrence of an integer overflow, adds a defect report for the operational fault causing the integer overflow, and adds a connection line indicating the flow of data and the flow of control from the point of occurrence, Way. The method according to claim 6,
Wherein generating the defect tracking graph based on the category comprises:
Adding a defect report to the node performing an operation that causes the defect and the flow of the data and the node included in the control flow to report an expected value before and after the operation is performed A defect tracking method, characterized in. The method according to claim 6,
Wherein generating the defect tracking graph based on the category comprises:
Wherein a connection line is added to at least one of a generation point and a parameter of data generating the integer overflow from the generation point. The method according to claim 6,
Wherein generating the defect tracking graph based on the category comprises:
Upon receipt from the user of a trace extension for a parameter that generates the integer overflow, providing one or more function call points associated with the parameter to the user, and providing a trace graph of the defect to the function call point selected by the user The defect tracking method comprising: A computer-readable recording medium on which a program for carrying out the method according to claim 1 is recorded. A computer program stored on a medium for performing a defect tracking method as claimed in claim 1, which is performed by a defect tracking device. A storage unit for storing a source code to be analyzed; And
Generating a control flow chart based on the source code, analyzing the source code to determine a category of a defect of the detected source code, and generating a trace graph for the defect based on the category, Defect tracking device. 13. The method of claim 12,
Wherein,
Wherein the category of the defect is determined by searching the cause point and the occurrence point of the defect and determining the category based on whether the cause point and the occurrence point exist or not.

Images