Call graph analysis: Leveraging public test suites

Call graph analysis: Leveraging public test suites

Li, Jingyu (TU Delft Electrical Engineering, Mathematics and Computer Science)

Proksch, S. (mentor)
van Deursen, A. (graduation committee)
Erkin, Z. (graduation committee)

Delft University of Technology

Computer Science

2023-08-22

Call graphs are useful tools for representing method relationships within software projects and correlations between dependencies. Although static analysis is a prevalent method for call graph construction, it has its limitations such as struggling with handling dynamic features and lambda expressions. In this research, we introduced an approach that utilizes test suites from public Java Maven projects to construct dynamic call graphs and then merge them with static call graphs. Our objective is to explore the efficacy of the merged call graph in uncovering additional information. We employed OPAL and Soot to generate static call graphs and Java agents to trace edges during actual execution. Subsequently, a merging procedure, coupled with a filtering mechanism, was implemented to eliminate duplications. We conducted vulnerability detection analysis to assess the results and a version analysis to investigate the potential for extending our approach by merging multiple versions. Our results indicated that the merged call graph offers a modest increase in edges compared to solely static analysis. Additionally, we discovered that vulnerability identification followed a comparable pattern, supporting the consistency of our methodology. Additionally, we discover that combining several minor/patch versions of a project is a successful tactic for enhancing test coverage. Our research highlights the value of using test suites from open-source projects to build more in-depth call graphs.

Call graph
Static analysis
Dynamic analysis

http://resolver.tudelft.nl/uuid:f0051ccf-8704-4d27-a338-6143d8a20ab1

Student theses

master thesis

© 2023 Jingyu Li