# US 2018/0025162 A1 · Application program analysis apparatus and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025162 A1
- Document ID: US20180025162A1
- Status: Published application
- Kind: A1
- Application number: 15/646,693
- Filed: 2017-07-11
- Published: 2018-01-25
- Earliest claimed: 2016-07-19
- Assignees: Fasoo.Com Co., Ltd
- Applicants: Fasoo.Com Co., Ltd.
- Inventors: Min Sik JIN; Jong Won YOON; Jong Hwan IM
- Web page: https://patentgrep.com/patent/US20180025162A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed is an application program analysis apparatus comprising a first analyzer performing a dynamic analysis on an application program and extracting a method call graph, a model-view-controller (MVC) information extractor extracting MVC information from the method call graph, and a second analyzer generating an extended call graph by extending the method call graph based on the MVC information, the extended call graph being applied to an analysis of a source code of the application program. Using the application program analysis apparatus, it is made possible to analyze an application program using an MVC pattern, which has been difficult to analyze through the conventional static analysis, thereby complementing the security vulnerability of the static analysis.

## Claims

### Claim 1

An application program analysis apparatus comprising:
a first analyzer performing a dynamic analysis on an application program and extracting a method call graph;
a model-view-controller (MVC) information extractor extracting MVC information from the method call graph; and
a second analyzer generating an extended call graph by extending the method call graph based on the MVC information, the extended call graph being applied to an analysis of a source code of the application program.

### Claim 2 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the MVC information includes information on controller-view relationship.

### Claim 3 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the second analyzer uses the extended call graph to analyze a control flow of the application program.

### Claim 4 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the first analyzer is a dynamic analyzer.

### Claim 5 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the second analyzer is a static analyzer.

### Claim 6 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the second analyzer comprises:
a code analysis part generating analysis information by analyzing the source code of the application program; and
a method call graph extension part extending the method call graph by using the MVC information.

### Claim 7 (depends on 2)

The application program analysis apparatus according to claim 2, wherein the MVC information extractor recognizes a MVC pattern from the method call graph, and identifies controller methods and view methods called by a dispatcher servlet in the recognized MVC pattern.

### Claim 8 (depends on 1)

The application program analysis apparatus according to claim 1, wherein the MVC pattern is implemented using Spring or Struts framework library.

### Claim 9

An application program analysis method comprising:
performing a dynamic analysis on an application program and extracting a method call graph;
extracting MVC information from the method call graph; and
generating an extended call graph by extending the method call graph based on the MVC information, the extended call graph being applied to an analysis of a source code of the application program.

### Claim 10 (depends on 9)

The application program analysis method according to claim 9, wherein the MVC information includes information on controller-view relationship.

### Claim 11 (depends on 9)

The application program analysis method according to claim 9, further comprising analyzing a control flow of the application program by using the extended call graph.

### Claim 12 (depends on 9)

The application program analysis method according to claim 9, further comprising generating analysis information by analyzing the source code and control flow of the application program.

### Claim 13 (depends on 9)

The application program analysis method according to claim 9, wherein the extracting MCV information comprises:
recognizing a MVC pattern from the method call graph; and
identifying controller methods and view methods called by a dispatcher servlet in the recognized MVC pattern.

### Claim 14 (depends on 13)

The application program analysis method according to claim 13, wherein the MVC pattern is implemented using Spring or Struts framework library.