Self-adaptive static analysis

Static code analysis is a powerful approach to detect quality de ciencies such as performance bottlenecks, safety violations or security vulnerabilities already during a software system’s implementation. Yet, as current software systems continue to grow, current staticanalysis systems more frequently face the problem of insu cient scalability. We argue that this is mainly due to the fact that current static analyses are implemented fully manually, often in generalpurpose programming languages such as Java or C, or in declarative languages such as Datalog. This design choice prede nes the way in which the static analysis evaluates, and limits the optimizations and extensions static-analysis designers can apply. To boost scalability to a new level, we propose to fuse staticanalysis with just-in-time-optimization technology, introducing for the rst time static analyses that are managed and inherently self-adaptive. Those analyses automatically adapt themselves to yield a performance/precision tradeo that is optimal with respect to the analyzed software system and to the analysis itself. Self-adaptivity is enabled by the novel idea of designing a dedicated intermediate representation, not for the analyzed program but for the analysis itself. This representation allows for an automatic optimization and adaptation of the analysis code, both ahead-of-time (through static analysis of the static analysis) as well as just-in-time during the analysis’ execution, similar to just-in-time compilers.