# US 11,836,068 B2 · System and method for recommending static analysis fixes

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,836,068 B2
- Document ID: US11836068B2
- Status: Granted
- Kind: B2
- Application number: 17/574,466
- Filed: 2022-01-12
- Published: 2022-07-14
- Granted: 2023-12-05
- Earliest claimed: 2021-01-14
- Assignees: Parasoft Corporation
- Applicants: Parasoft Corporation
- Inventors: Leszek Jerzy Raszka; Leonid Borodaev
- Web page: https://patentgrep.com/patent/US11836068B2

## CPC

- G06F 11/3608: {using formal methods, e.g. model checking, abstract interpretation (theorem proving G06N5/013)}
- G06F 11/3616: {using software metrics}
- G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers}
- G06F 11/327: {Alarm or error message display}
- G06N 3/045: Combinations of networks
- G06N 20/00: Machine learning
- G06N 3/08: Learning methods
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

System and method for recommending static analysis fixes in a computer program include: receiving violations from a static analysis tool and the meta data related to the violations; for each violation, encoding a code snippet in which said each violation is located into a first vector and encoding meta-data associated with each violation into a second vector; for each violation, concatenating the first vector and the second vector into a single vector; generating a utility matrix from the single vectors, where values in each cell correspond to a certain user's action on one of the violations; revising the utility matrix, based on user selection of selected violations of the plurality of violations; and executing a matrix factorization process to build intermediate representations of users and sets of violations to update the utility matrix as an updated utility matrix to obtain predictions for missing values, as recommendation to the user.

## Claims

### Claim 1

A method for recommending static analysis fixes in a computer program, the method comprising:
receiving, over a computer network, a plurality of violations from a static analysis tool and meta-data related to the plurality of violations;
for each of the plurality of violations, encoding a code snippet in which said each violation is located into a first vector and encoding the meta-data associated with said each violation into a second vector;
for each of the plurality of violations, concatenating the first vector and the second vector into a single concatenated vector for said each violation;
generating a utility matrix from the single vectors of each violation, wherein every row of the utility matrix corresponds to a user and every column corresponds to a violation, and wherein values in each cell of the utility matrix correspond to a certain user's action on one of the violations;
revising the utility matrix, based on user selection of selected violations of the plurality of violations; and
executing a matrix factorization process to build intermediate representations of users and violations to update the utility matrix as an updated utility matrix to obtain predictions for missing values, as recommendation to the user.

### Claim 2 (depends on 1)

The method of claim 1, wherein the concatenated vector is generated by a bag of words (BOW) counting a number of occurrences of every word and token in a source code of the computer program; and representing the first vector and the second vector as a fixed length with counts of a certain token or word in a specific position in the first vector and the second vector.

### Claim 3 (depends on 1)

The method of claim 1, wherein the concatenated vector is generated by embeddings obtained from training a neural network model on a source code of the computer program and the plurality of violations.

### Claim 4 (depends on 1)

The method of claim 1, wherein the concatenated vector is generated by a source code embedding technique created from snippet of source code of the computer program surrounding each of the plurality of violations.

### Claim 5 (depends on 1)

The method of claim 1, further comprising factorizing the meta-data by transforming every value into a category and assigning to every category an integer number.

### Claim 6 (depends on 1)

The method of claim 1, wherein every row of the utility matrix includes a static analysis rule associated with the violation, an analysis type, a priority of the static analysis rule, a name of the build where the violation appeared, a flow analysis category, and a path to a source code of the computer program.

### Claim 7 (depends on 1)

The method of claim 1, wherein each of the first vector and the second vector for each violation are constructed from a source code snipped containing the violation created using baq of words (BOW) model with the vector created from meta-data information about the violation.

### Claim 8 (depends on 1)

The method of claim 1, wherein when a value for updated utility matrix is equal to 0, the violation is recommended to be suppressed, and when the value for updated utility matrix is equal to 1, the violation is recommended to be fixed.

### Claim 9 (depends on 1)

The method of claim 1, wherein the plurality of violations from the static analysis tool includes detected errors and code snippets vectors.

### Claim 10 (depends on 1)

The method of claim 1, wherein encoding and concatenating the first vector and the second vector is performed by a machine learning (ML) engine.

### Claim 11

A system for recommending static analysis fixes in a computer program comprising:
a machine learning (ML) engine for receiving, over a computer network, a plurality of violations from a static analysis tool and meta-data related to the plurality of violations;
for each of the plurality of violations, encoding a code snippet in which said each violation is located into a first vector and encoding the meta-data associated with said each violation into a second vector;
for each of the plurality of violations, concatenating the first vector and the second vector into a single concatenated vector for said each violation;
generating a utility matrix from the single vectors of each violation, wherein every row of the utility matrix corresponds to a user and every column corresponds to a violation, and wherein values in each cell of the utility matrix correspond to a certain user's action on one of the violations;
revising the utility matrix, based on user selection of selected violations of the plurality of violations; and
executing a matrix factorization process to build intermediate representations of users and sets of violations to update the utility matrix as an updated utility matrix to obtain predictions for missing values, as recommendation to the user; and
a display for displaying the recommendation to the user.

### Claim 12 (depends on 11)

The system of claim 11, wherein the concatenated vector is generated by a bag of words (BOW) counting a number of occurrences of every word and token in a source code of the computer program; and representing the first vector and the second vector as a fixed length with counts of a certain token or word in a specific position in the first vector and the second vector.

### Claim 13 (depends on 11)

The system of claim 11, wherein the concatenated vector is generated by embeddings obtained from training a neural network model on a source code of the computer program and the plurality of violations.

### Claim 14 (depends on 11)

The system of claim 11, wherein the concatenated vector is generated by a source code embedding technique created from snippet of source code of the computer program surrounding each of the plurality of violations.

### Claim 15 (depends on 11)

The system of claim 11, wherein the machine learning (ML) engine further factorizes the meta-data by transforming every value into a category and assigning to every category an integer number.

### Claim 16 (depends on 11)

The system of claim 11, wherein every row of the utility matrix includes, astatic analysis rule associated with the violation, an analysis type, a priority of the static analysis rule, a name of the build where the violation appeared, a flow analysis category, and a path to the a source code of the computer program.

### Claim 17 (depends on 11)

The system of claim 11, wherein each of the first vector and the second vector for each violation are constructed from a source code snipped containing the violation created using bag of words (BOW) BOW model with the vector created from meta-data information about the violation.

### Claim 18 (depends on 11)

The system of claim 11, wherein when a value for updated utility matrix is equal to 0, the violation is recommended to be suppressed, and when the value for updated utility matrix is equal to 1, the violation is recommended to be fixed.

### Claim 19 (depends on 11)

The system of claim 11, wherein the plurality of violations from the static analysis tool includes detected errors and code snippets vectors.