Scalable Defect Detection via Traversal on Code Graph
<|reference_start|>Scalable Defect Detection via Traversal on Code Graph: Detecting defects and vulnerabilities in the early stage has long been a challenge in software engineering. Static analysis, a technique that inspects code without execution, has emerged as a key strategy to address this challenge. Among recent advancements, the use of graph-based representations, particularly Code Property Graph (CPG), has gained traction due to its comprehensive depiction of code structure and semantics. Despite the progress, existing graph-based analysis tools still face performance and scalability issues. The main bottleneck lies in the size and complexity of CPG, which makes analyzing large codebases inefficient and memory-consuming. Also, query rules used by the current tools can be over-specific. Hence, we introduce QVoG, a graph-based static analysis platform for detecting defects and vulnerabilities. It employs a compressed CPG representation to maintain a reasonable graph size, thereby enhancing the overall query efficiency. Based on the CPG, it also offers a declarative query language to simplify the queries. Furthermore, it takes a step forward to integrate machine learning to enhance the generality of vulnerability detection. For projects consisting of 1,000,000+ lines of code, QVoG can complete analysis in approximately 15 minutes, as opposed to 19 minutes with CodeQL.<|reference_end|>
@article{liu2024scalable,
    title={Scalable Defect Detection via Traversal on Code Graph},
    author={Zhengyao Liu, Xitong Zhong, Xingjing Deng, Shuo Hong, Xiang Gao,
  Hailong Sun},
    journal={arXiv preprint arXiv:2406.08098},
    year={2024},
    archivePrefix={arXiv},
    eprint={2406.08098},
    primaryClass={cs.SE}
}