# US 10,482,262 B2 · Static analysis based on abstract program representations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,262 B2 - Document ID: US10482262B2 - Status: Granted - Kind: B2 - Application number: 15/727,673 - Filed: 2017-10-09 - Published: 2018-02-01 - Granted: 2019-11-19 - Earliest claimed: 2014-12-19 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Babita Sharma; Andrew Mak; Richard Myer Goldberg; John Thomas Peyton, Jr.; Jeffrey Charles Turnham; Matthew Francis Murphy; Hua Xiao - Web page: https://patentgrep.com/patent/US10482262B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/3604: Analysis of software for verifying properties of programs (testing of software G06F11/3668) - G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation - G06F 21/1062: {Editing} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyses for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times. ## Claims ### Claim 1 A method of improving static security analysis, comprising: providing a generator tool to one of: a build system, and a code repository; receiving a set of build information associated with a source code component; analyzing the set of build information to generate a program representation for the source code component, the program representation identifying a path to a build output, a path to a source code directory, and at least one compile-time dependency; transforming the program representation into a container that secures the source code component from being reverse-engineered from the program representation; and performing a static security analysis on the container by using the path to the build output to locate the build output, and using source files identified from the path to the source code directory to map a security finding identified in the static security analysis on the build output to the source code component; wherein the receiving, analyzing and transforming operations occur in an automated manner in the generator tool executing in a hardware element. ### Claim 2 (depends on 1) The method as described in claim 1 further including receiving the container at a remote location prior to performing the static security analysis. ### Claim 3 (depends on 2) The method as described in claim 2, wherein the remote location is a cloud platform and the static security analysis is performed on the container on the cloud platform. ### Claim 4 (depends on 1) The method as described in claim 1, wherein the build information is received from the build system as the build information is generated. ### Claim 5 (depends on 1) The method as described in claim 1, wherein the build information is received from the code repository in association with a discovery operation. ### Claim 6 (depends on 5) The method as described in claim 5, wherein the receiving further includes: identifying, based on a run strategy, one or more source files that, together with the build information, are used to generate the program representation. ### Claim 7 Apparatus, comprising: one or more processors; computer memory holding computer program instructions executed by the one or more processors for improving static security analysis, the computer program instructions operative to: provide a generator tool to one of: a build system, and a code repository; receive a set of build information associated with a source code component; analyze the set of build information to generate a program representation of the source code component, the program representation identifying a path to a build output, a path to a source code directory, and at least one compile-time dependency; transform the program representation into a container that secures the source code component from being reverse-engineered from the program representation, wherein the receive, analyze and transform operations are carried out by the generator tool autonomously; and perform a static security analysis on the container by using the path to the build output to locate the build output, and using source files identified from the path to the source code directory to map a security finding identified in the static security analysis on the build output to the source code component. ### Claim 8 (depends on 7) The apparatus as described in claim 7, wherein the computer program instructions are further operative to receive the container at a remote location prior to performing the static security analysis. ### Claim 9 (depends on 8) The apparatus as described in claim 8, wherein the remote location is a cloud platform and the static security analysis is performed on the container on the cloud platform. ### Claim 10 (depends on 7) The apparatus as described in claim 7, wherein the build information is received from the build system as the build information is generated. ### Claim 11 (depends on 7) The apparatus as described in claim 7, wherein the build information is received from the code repository in association with a discovery operation. ### Claim 12 (depends on 11) The apparatus as described in claim 11, wherein the computer program instructions to receive the set of build information further include computer program instructions further operative to: identify, based on a run strategy, one or more source files that, together with the build information, are used to generate the program representation. ### Claim 13 A computer program product in a non-transitory computer readable medium for use in one or more data processing systems, the computer program product holding computer program instructions executed by the one or more data processing systems for improving static security analysis, the computer program instructions operative to: associate a generator tool with one of: a build system, and a code repository; receive a set of build information associated with a source code component; analyze the set of build information to generate a program representation of the source code component, the program representation identifying a path to a build output, a path to a source code directory, and at least one compile-time dependency; transform the program representation into a container that secures the source code component from being reverse-engineered from the program representation, wherein the receive, analyze and transform operations are carried out by the generator tool autonomously; and perform a static security analysis on the container by using the path to the build output to locate the build output, and using source files identified from the path to the source code directory to map a security finding identified in the static security analysis on the build output to the source code component. ### Claim 14 (depends on 13) The computer program product as described in claim 13, wherein the computer program instructions are further operative to receive the container at a remote location prior to performing the static security analysis. ### Claim 15 (depends on 14) The computer program product as described in claim 14, wherein the remote location is a cloud platform and the static security analysis is performed on the container on the cloud platform. ### Claim 16 (depends on 13) The computer program product as described in claim 13, wherein the build information is received from the build system as the build information is generated. ### Claim 17 (depends on 13) The computer program product as described in claim 13, wherein the build information is received from the code repository in association with a discovery operation. ### Claim 18 (depends on 17) The computer program product as described in claim 17, wherein the computer program instructions to receive the set of build information further include computer program instructions further operative to: identify, based on a run strategy, one or more source files that, together with the build information, are used to generate the program representation.