Call graph analysis: Leveraging public test suites

Master thesis (2023)

Authors

J. Li Electrical Engineering, Mathematics and Computer Science

Contributors

S. Proksch Software Engineering - EEMCS (mentor)
A. van Deursen Software Technology (graduation committee member)
Z. Erkin Cyber Security - EEMCS (graduation committee member)
Faculty
Electrical Engineering, Mathematics and Computer Science, Electrical Engineering, Mathematics and Computer Science
Copyright: © 2023 Jingyu Li
More Info
expand_more

Published Date

22-08-2023

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Abstract

Call graphs are useful tools for representing method relationships within software projects and correlations between dependencies. Although static analysis is a prevalent method for call graph construction, it has its limitations such as struggling with handling dynamic features and lambda expressions. In this research, we introduced an approach that utilizes test suites from public Java Maven projects to construct dynamic call graphs and then merge them with static call graphs. Our objective is to explore the efficacy of the merged call graph in uncovering additional information. We employed OPAL and Soot to generate static call graphs and Java agents to trace edges during actual execution. Subsequently, a merging procedure, coupled with a filtering mechanism, was implemented to eliminate duplications. We conducted vulnerability detection analysis to assess the results and a version analysis to investigate the potential for extending our approach by merging multiple versions. Our results indicated that the merged call graph offers a modest increase in edges compared to solely static analysis. Additionally, we discovered that vulnerability identification followed a comparable pattern, supporting the consistency of our methodology. Additionally, we discover that combining several minor/patch versions of a project is a successful tactic for enhancing test coverage. Our research highlights the value of using test suites from open-source projects to build more in-depth call graphs.