Static analysis is the process of detecting errors and defects in software's source code. Although manual code review is technically static analysis, the term is most commonly used to refer to an automated code review process.
Static analysis is the process of detecting errors and defects in software's source code. Although manual code review is technically static analysis, the term is most commonly used to refer to an automated code review process. Static code analysis (aka static analysis security testing or SAST) inputs source texts of programs and give recommendations to the programmer on what code fragments he/she should consider. Although an automated tool can not completely replace manual review, SAST is seen as by many organizations to be a cost effective supplement.
https://security.stackexchange.com/tags/static-analysis/info
The tasks solved by static code analysis software can be divided into 3 categories:
Detecting errors in programs. Recommendations on code formatting. Some static analyzers check if the source code corresponds to code formatting standards of practice such as the number of indents in various constructs, use of spaces/tabs, etc. Metrics computation. Static code analyzers can generate numerical values for properties of software or its specifications. http://stackoverflow.com/questions/49716/what-is-static-code-analysis
SAST tools can employ model checking, data-flow analysis, abstract interpretation, and heuristic analysis. See Brian Chess, Jacob West (Fortify Software) (2007). Secure Programming with Static Analysis. Addison-Wesley. ISBN 978-0-321-42477-8, and the National Institute of Standards and Technology (NIST) Software Assurance Metrics and Tool Evaluation (SAMATE) Project
