Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: A large number of tools that automate the process of finding errors in programs has recently emerged in the software development community. Many of them use static analysis as the main method for analyzing and capturing faults in the source code. Static analysis is deployed as an approximation of the programs’ runtime behavior with inherent limitations regarding its ability to detect actual code errors. It belongs to the class of computational problems which are undecidable [2]. For any such analysis, the major issues are: (1) the programming language of the source code where the analysis is applied (2) the type of errors to be detected (3) the effectiveness of the analysis and (4) the efficiency of the analysis. In order to incorporate a static analysis tool for detecting potential code defects in the software development cycle, significant costs are required. Thus, it is important to know if such a tool is effective in finding all types of errors and especially the critical ones for ensuring product quality. It is also a matter of major importance to know how efficient a tool is with respect to the size of the code bases being analyzed. When two or more static analysis tools are compared based on code bases from existing software projects the results are biased: they actually refer to the tools’ capability to detect only the defects within the tested code bases, which are characterized by a specific degree of program complexity and size.  believe that empirical studies on open source programs should be completed with evaluation results, which cover systematically the most frequent code defects in a specific software context. The main focus of our work [1] is on software security and reliability.  have created a versatile test suite, which implements code defects for the C programming language. Our test suite is based on those errors which are more often reported in public catalogs.  have identified major defect categories, such that all examined defects are classified in one of them. Category General includes three types of flaws, namely division by zero, use of uninitialized variables and null pointer dereference. The second category, Integers, includes integer overflows, sign and truncations errors. Direct overflows, off-by-one errors and unbounded copies appear in categories Arrays and Strings along with the format string vulnerabilities [8], string truncation and null termination errors.
['George Chatzieleftheriou', 'Apostolos Chatzopoulos', 'Panagiotis Katsaros']
I am writing a research paper on a idea Test-Driving Static Analysis Tools in Search of C Code Vulnerabilities II - (Extended Abstract).
[{"from": "human", "value": "I am writing a research paper on a idea Test-Driving Static Analysis Tools in Search of C Code Vulnerabilities II - (Extended Abstract)."}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: A large number of tools that automate the process of finding errors in programs has recently emerged in the software development community. Many of them use static analysis as the main method for analyzing and capturing faults in the source code. Static analysis is deployed as an approximation of the programs\u2019 runtime behavior with inherent limitations regarding its ability to detect actual code errors. It belongs to the class of computational problems which are undecidable [2]. For any such analysis, the major issues are: (1) the programming language of the source code where the analysis is applied (2) the type of errors to be detected (3) the effectiveness of the analysis and (4) the efficiency of the analysis. In order to incorporate a static analysis tool for detecting potential code defects in the software development cycle, significant costs are required. Thus, it is important to know if such a tool is effective in finding all types of errors and especially the critical ones for ensuring product quality. It is also a matter of major importance to know how efficient a tool is with respect to the size of the code bases being analyzed. When two or more static analysis tools are compared based on code bases from existing software projects the results are biased: they actually refer to the tools\u2019 capability to detect only the defects within the tested code bases, which are characterized by a specific degree of program complexity and size.  believe that empirical studies on open source programs should be completed with evaluation results, which cover systematically the most frequent code defects in a specific software context. The main focus of our work [1] is on software security and reliability.  have created a versatile test suite, which implements code defects for the C programming language. Our test suite is based on those errors which are more often reported in public catalogs.  have identified major defect categories, such that all examined defects are classified in one of them. Category General includes three types of flaws, namely division by zero, use of uninitialized variables and null pointer dereference. The second category, Integers, includes integer overflows, sign and truncations errors. Direct overflows, off-by-one errors and unbounded copies appear in categories Arrays and Strings along with the format string vulnerabilities [8], string truncation and null termination errors."}]