Static analysis based on abstract program representations

Apparatus, comprising:

• one or more processors;
• computer memory holding computer program instructions executed by the one or more processors for improving static security analysis, the computer program instructions operative to:
• provide a generator tool to one of:
• a build system, and a code repository;
• receive a set of build information associated with a source code component;
• analyze the set of build information to generate a program representation of the source code component, the program representation identifying a path to a build output, a path to a source code directory, and at least one compile-time dependency;
• transform the program representation into a container that secures the source code component from being reverse-engineered from the program representation, wherein the receive, analyze and transform operations are carried out by the generator tool autonomously;
• and
• perform a static security analysis on the container by using the path to the build output to locate the build output, and using source files identified from the path to the source code directory to map a security finding identified in the static security analysis on the build output to the source code component.

A computer program product in a non-transitory computer readable medium for use in one or more data processing systems, the computer program product holding computer program instructions executed by the one or more data processing systems for improving static security analysis, the computer program instructions operative to:

• associate a generator tool with one of:
• a build system, and a code repository;
• receive a set of build information associated with a source code component;
• analyze the set of build information to generate a program representation of the source code component, the program representation identifying a path to a build output, a path to a source code directory, and at least one compile-time dependency;
• transform the program representation into a container that secures the source code component from being reverse-engineered from the program representation, wherein the receive, analyze and transform operations are carried out by the generator tool autonomously;
• and
• perform a static security analysis on the container by using the path to the build output to locate the build output, and using source files identified from the path to the source code directory to map a security finding identified in the static security analysis on the build output to the source code component.