System and methods for model-based analysis of software

1. A computer-implemented method for performing static analysis and checking a property to detect security vulnerabilities in a software application developed using a software framework, comprising:

identifying, by at least one computer processor, a framework model representing the software framework, wherein the framework model comprises a plurality of discovery queries written in a query language;

constructing, by the at least one computer processor, a plurality of component models;

reducing, by the at least one computer processor, the plurality of component models, based on whether any component model is mapped to the framework model or based on whether any component model is relevant to the property to be checked, wherein the reducing comprises removing information;

generating, by the at least one computer processor, an application architecture model for the software application, by applying, to the reduced plurality of component models, a discovery query of the plurality of discovery queries; and

analyzing, by the at least one computer processor, the application architecture model to determine whether the property is satisfied, via applying, by the at least one computer processor, a property query,

wherein the property query and the discovery query comprise executable program code, and

wherein the applying the property query and the applying discovery query comprise executing, by the at least one computer processor, the discovery query.

2. The method of claim 1 , further comprising:

generating, by the at least one computer processor, a representation of code of the software application, wherein the application architecture model is generated based on the representation of the code of the software application.

3. The method of claim 2 , wherein the representation of the code of the software application comprises an abstract syntax tree.

4. The method of claim 1 , wherein the plurality of discovery queries program an analysis engine to:

extract, by the at least one computer processor, from the software application, at least one property relevant for analysis of security vulnerabilities; and

store, by the at least one computer processor, the at least one property extracted in the application architecture model.

5. The method of claim 1 , wherein:

the plurality of discovery queries are configured to program an analysis engine to store, in each component model, information relating to a corresponding component in the software framework.

6. A system comprising:

a memory; and

at least one processor coupled to the memory and at least one computer-readable storage medium having stored thereon instructions which, when executed, program the at least one processor configured to perform operations comprising:

for a software application developed using a software framework:

identifying a framework model representing the software framework, wherein the framework model comprises a plurality of discovery queries written in a query language;

constructing a plurality of component models;

reducing the plurality of component models, based on whether any component model is mapped to the framework model or based on whether any component model is relevant to a property to be checked, wherein the reducing comprises removing information;

generating an application architecture model for the software application, by applying, to the reduced plurality of component models, a discovery query of the plurality of discovery queries; and

analyzing the application architecture model to determine whether the property is satisfied, via applying a property query,

wherein the discovery query comprises executable program code, and

wherein the applying the property query and the applying the discovery query comprise executing the discovery query.

7. The system of claim 6 , the operations further comprising:

generating a representation of code of the software application, wherein the application architecture model is generated based on the representation of the code of the software application.

8. The system of claim 7 , wherein the representation of the code of the software application comprises an abstract syntax tree.

9. The system of claim 6 , wherein the plurality of discovery queries program an analysis engine to:

extract, from the software application, at least one property relevant for analysis of security vulnerabilities; and

store the at least one property extracted in the application architecture model.

10. The system of claim 6 , wherein:

the plurality of discovery queries are configured to program an analysis engine to store, in each component model, information relating to a corresponding component in the software framework.

11. At least one non-transitory computer-readable storage medium having stored thereon instructions which, when executed, program at least one processor to perform operations comprising:

identifying a framework model representing a software framework, wherein the framework model comprises a plurality of discovery queries written in a query language;

constructing a plurality of component models;

reducing the plurality of component models, based on whether any component model is mapped to the framework model or based on whether any component model is relevant to a property to be checked, wherein the reducing comprises removing information;

generating an application architecture model, for a software application developed using the framework, by applying, to the reduced plurality of component models, a discovery query of the plurality of discovery queries; and

analyzing the application architecture model to determine whether the property is satisfied, via applying a property query,

wherein the discovery query comprises executable program code, and

wherein the applying the property query and the applying the discovery query comprise executing the discovery query.

12. The at least one non-transitory computer-readable storage medium of claim 11 , the operations further comprising:

generating a representation of code of the software application, wherein the application architecture model is generated based on the representation of the code of the software application.

13. The at least one non-transitory computer-readable storage medium of claim 12 , wherein the representation of the code of the software application comprises an abstract syntax tree.

14. The at least one non-transitory computer-readable storage medium of claim 11 , wherein the plurality of discovery queries program an analysis engine to:

extract, from the software application, at least one property relevant for analysis of security vulnerabilities; and

store the at least one property extracted in the application architecture model.

15. The at least one non-transitory computer-readable storage medium of claim 11 , wherein:

the plurality of discovery queries are configured to program an analysis engine to store, in each component model, information relating to a corresponding component in the software framework.

16. The method of claim 2 , the method further comprising:

delivering, by the at least one computer processor, results of the static analysis in real time when the code of the software application is added or modified.

17. The system of claim 7 , the operations further comprising:

delivering results of the operation of analyzing in real time when the code of the software application is added or modified.

18. The at least one non-transitory computer-readable storage medium of claim 12 , the operations further comprising:

delivering results of the operation of analyzing in real time when the code of the software application is added or modified.