Static analysis is the examination of computer source code without executing it. Most commonly static analysis is used to find bugs or ensure conformance to coding guidelines. The classic example is a compiler which finds lexical, syntactic and even some semantic mistakes. A source code security analyzer examines source code to detect and report weaknesses that can lead to security vulnerabilities.
Static analysis is the process of detecting errors and defects in software's source code. Although manual code review is technically static analysis, the term is most commonly used to refer to an automated code review process. Static code analysis (aka static analysis security testing or SAST) inputs source texts of programs and give recommendations to the programmer on what code fragments he/she should consider. Although an automated tool can not completely replace manual review, SAST is seen as by many organizations to be a cost effective supplement.
The tasks solved by static code analysis software can be divided into 3 categories:
- Detecting errors in programs.
- Recommendations on code formatting. Some static analyzers check if the source code corresponds to code formatting standards of practice such as the number of indents in various constructs, use of spaces/tabs, etc.
- Metrics computation. Static code analyzers can generate numerical values for properties of software or its specifications.
http://stackoverflow.com/questions/49716/what-is-static-code-analysis
SAST tools can employ model checking, data-flow analysis, abstract interpretation, and heuristic analysis. See Brian Chess, Jacob West (Fortify Software) (2007). Secure Programming with Static Analysis. Addison-Wesley. ISBN 978-0-321-42477-8, and the National Institute of Standards and Technology (NIST) Software Assurance Metrics and Tool Evaluation (SAMATE) Project
