Intel has released the first significant release of the ControlFlag 1.0 toolkit, which detects errors and anomalies in source code using a machine learning system trained on a vast volume of existing code. Unlike traditional static analyzers, ControlFlag does not rely on predefined rules, which are often unable to account for all possible variations. Instead, it is based on the statistics of the usage of various language constructs in a large number of existing projects. The ControlFlag code is written in C++ and is open-source under the MIT license.
The system learns by constructing a statistical model of the available code from open-source projects published on GitHub and similar public repositories. During the training phase, the system identifies typical patterns of code constructions and builds a syntax tree of relations between these patterns, reflecting the execution flow in the program. As a result, a reference decision tree is formed, combining the development experience of all analyzed source texts. For the code being checked, a similar process of pattern identification is performed, which is compared with the reference decision tree. Significant discrepancies with neighboring branches indicate anomalies in the checked pattern.
As an example of ControlFlag's capabilities, developers analyzed the source texts of the OpenSSL and cURL projects:
- In OpenSSL, anomalous constructs "(s1 == NULL) ∧ (s2 == NULL)" and "(s1 == NULL) | (s2 == NULL)" were identified, which do not correspond to the commonly used pattern "(s1 == NULL) || (s2 == NULL)". The code also revealed anomalies in the expressions "(-2 == rv)" (the minus was a typo) and "BIO_puts(bp, ":") <= 0)" (in the context of checking for a successful function completion, it should have been "== 0").
- In cURL, a previously unnoticed error by static analyzers was found when using the structure element "s->keepon", which had a numeric type but was compared to a boolean value TRUE.
The features of ControlFlag 1.0 include full support for typical templates in the C language and the ability to detect anomalies in conditional expressions like "if". For example, when analyzing the code fragment "if (x = 7) y = x;", the system will identify that usually, in an "if" statement for comparing numeric values, the construction "variable == number" is used. Thus, it is likely that the use of "variable = number" in the "if" expression is due to a typo. Included is a script that allows loading C repositories from GitHub and using them to build a model. Pre-built models are also available for immediate code checking.
Source: opennet.ru
