Question

What is Dynamic Code Analysis?

How is it different from Static Code Analysis (ie, what can it catch that can’t be caught in static)?

I’ve heard of bounds checking and memory analysis – what are these?

What other things are checked using dynamic analysis?

-Adam

Answer 1

Simply put, static analysis collect information based on source code and dynamic analysis is based on the system execution, often using instrumentation.

Advantages of dynamic analysis

• Is able to detect dependencies that are not possible to detect in static analysis. Ex.: dynamic dependencies using reflection, dependency injection, polymorphism.
• Can collect temporal information.
• Deals with real input data. During the static analysis it is difficult to impossible to know what files will be passed as input, what WEB requests will come, what user will click, etc.

Disadvantages of dynamic analysis

• May negatively impact the performance of the application.
• Cannot guarantee the full coverage of the source code, as it’s runs are based on user interaction or automatic tests.

Resources

There’s many dynamic analysis tools in the market, being debuggers the most notorious one. On the other hand, it’s still an academic research field. There’s many researchers studying how to use dynamic analysis for better understanding of software systems. There’s an annual workshop dedicated to dependency analysis.