Research Of Lexical Analysis In Source Code Analysis

With the rise of the Internet, the attacks using vulnerabilities to network security occurr frequently, and become more serious with the time. It has become one of the main factors that are harm to the Internet.The most direct way of excavating vulnerabilities is to communicate with developers in the stage of "coded" .In this way,we can find and amend the vulnerabilities in time. In this paper, we has studied the lexical analysis of the source code analysis in depth.And we developed a new lexical analysis tool named SSCAN on the basis of comparision of the main open source lexical analysis tools. The main works of this paper are as follow:1. It has analyzed the principles and processes of the lexical analysis of the source code analysis in detail. And we compared the main open source lexical analysis softwares such as Flawfinder, Its4, Rats and so on.2. It has improved the database of dangerous function on the basis of comparision of the main open source lexical analysis tools such as Flawfinder, ITS4, Rats.3. It has optimized the way of analysis and introduced one model which combinated the preliminary analysis with the classification features analysis.The results showed that this model can improved the efficiency of analysis greatly.4. It has applied bayesian theory to lexical analysis successfully.In this way,we could determine the risk use of unknown function on the basis of the risk use of the known function.5. It has tested the performance of SSCAN precisely in this article. The results showed that the integrity and accuracy of SSCAN were much better than Flawfinder, ITS4 and Rats.The innovation of this article is as follows.It has analyzed the source code analysis technoligy and the current open source lexical analysis softwares in detail.It has improved the database of risk function and presented one new model which combinated the preliminary analysis with the classification features analysis.Then,it has designed and completed one fast lexical analysis software with high accuracy and integrity.