Static code analysis

A computer program product comprising a tangible computer readable recordable storage device including computer useable program code for static code analysis, the computer program product including:

• computer useable program code for routing a code analysis request to a selected set of one or more static code analysis tools based on a context of the request, wherein the set of one or more static code analysis tools is selected based on a capability of each tool towards one or more categories of analysis included in the code analysis request;
• computer useable program code for merging one or more tool-specific analysis outputs of the selected set of one or more static code analysis tools, wherein merging the one or more tool-specific outputs comprises using one or more tool-specific mappings to one or more static code analysis abstractions and one or more source linkages of one or more static code analysis defects;
• computer useable program code for performing a deep analysis on a selected set of one or more defect categories request, wherein the set of one or more defect categories are selected based on an amount of false positives generated from the code analysis performed by the set of one or more static code analysis tools;
• computer useable program code for combining results of the merging with results of the deep analysis to filter out one or more false-positives and to add one or more new true positives to create an optimal set of defects;
• and
• computer useable program code for re-configuring the selected set of one or more static code analysis tools for a subsequent code analysis request, wherein said re-configuring is based on tool-specific user feedback.

A system for static code analysis, comprising:

• a memory;
• and
• at least one processor coupled to the memory and operative to:
• route a code analysis request to a selected set of one or more static code analysis tools based on a context of the request, wherein the set of one or more static code analysis tools is selected based on a capability of each tool towards one or more categories of analysis included in the code analysis request;
• merge one or more tool-specific analysis outputs of the selected set of one or more static code analysis tools, wherein merging the one or more tool-specific outputs comprises using one or more tool-specific mappings to one or more static code analysis abstractions and one or more source linkages of one or more static code analysis defects;
• perform a deep analysis on a selected set of one or more defect categories request, wherein the set of one or more defect categories are selected based on an amount of false positives generated from the code analysis performed by the set of one or more static code analysis tools;
• combine results of the merging with results of the deep analysis to filter out one or more false-positives and to add one or more new true positives to create an optimal set of defects;
• and
• re-configure the selected set of one or more static code analysis tools for a subsequent code analysis request, wherein said re-configuring is based on tool-specific user feedback.