🛡️ StaticGuard

Intelligent Static Analysis Meets Machine Learning.

StaticGuard is an advanced code analysis engine that bridges the gap between traditional lexical auditing and predictive AI. By combining deep-code structural analysis with trained ML models, it predicts bug probabilities, audits algorithmic complexity, and enforces architectural standards — all before a single line of code is pushed to production.

💡 Built as a personal project to explore how static analysis and machine learning can work together to improve real-world code quality.

---

🔥 StaticGuard in Action

<<<<<<< HEAD

=======

eca22fb321506319eb5be87a0cf3fb7ce4aa3bdf

• Predictive Risk Scoring: Get a real-time "Bug Probability" powered by a trained RandomForest model and heuristic adjustments.
• Worst-Case Complexity: Automatically identifies O(n²), O(2ⁿ), and exponential recursion bottlenecks.
• Architectural Guards: Real-time detection of OOP violations (LSP/ISP) and logical stability risks.
• Premium Visual Reporting: Generates a sleek, dark-modae HTML dashboard for stakeholder reviews.

---

📸 Output Showcase

Dashboard Metrics

Time/Space complexity, bug probability, quality score — all at a glance.

Comprehensive Findings

Structured analysis report categorizing issues into Critical Fixes and Stability Risks.

Deep Analysis Details

OOP violations, interface mapping, memory allocation tracking, and knowledge base.

Console Output (Sample)

STATICGUARD ANALYSIS REPORT
--------------------------------

CRITICAL FIXES (Program won't run correctly):
Line 8  → Missing semicolon
Line 29 → Missing semicolon
Line 106 → Math risk: Possible division by zero.

STABILITY RISKS (Program might freeze or crash):
Line 42  → Infinite loop detected.
Line 192 → Infinite loop detected.
Unreachable code detected at line 199.

Time Complexity Estimate (Worst-case):
Code Pattern → O(n^5)

Space Complexity Estimate (Worst-case):
Memory Pattern → O(n²)

OOP Issues:
DerivedSystem.execute() incorrectly overrides parent method

Bug Risk Probability: High
Quality Score: 0/100

---

🧠 Feature Engineering (ML Input)

StaticGuard extracts structural features from source code to feed into the ML model:

• Lines of Code (LOC)
• Number of loops and nesting depth
• Variable and method count
• Conditional statements
• Recursive calls
• Exception handling patterns

---

📈 Complexity Analysis Approach

Complexity is estimated using pattern-based structural analysis:

• Nested loops → O(n²), O(n³)
• Loop patterns → O(n), O(log n), O(n log n)
• Recursion detection → exponential complexity

Space complexity is inferred from array/matrix allocations, object creation patterns, and memory-heavy structures.

---

⚙️ Static Analysis Engine

The system uses a modular architecture with specialized detectors:

• Syntax Detector → identifies missing tokens and invalid constructs
• Logical Detector → detects infinite loops and unreachable code
• OOP Detector → checks method overriding and interface violations
• Performance Detector → identifies inefficient patterns

Each module contributes to a unified analysis report.

---

🤖 Machine Learning Model

• Model: RandomForest Classifier
• Input: Extracted code features (13+ metrics)
• Output: Bug probability (0–100%)

The model identifies patterns associated with unstable or error-prone code.

---

📊 Quality Scoring Logic

Code quality score is calculated using weighted penalties:

• 🔴 Critical issues (syntax errors) → High penalty (-10 per issue)
• 🟠 Logical risks (infinite loops) → Medium penalty (-8 per issue)
• 🟡 OOP violations → Moderate penalty (-5 per issue)
• 🟢 Code smells → Low penalty (-2 per issue)

---

🧠 How StaticGuard Differs from a Compiler

Compilers typically stop at the first syntax error. StaticGuard improves on this by:

• Continuing analysis even after detecting errors
• Reporting all issues in a single run
• Providing a complete overview of code quality, not just syntax

This allows developers to fix all problems at once instead of debugging step-by-step.

---

🚩 The Problem

Modern software development often relies on reactive debugging and manual peer reviews, which are error-prone and fail to scale. Critical architectural flaws like deeply nested loops, silent exception swallowing, and brittle OOP structures often go unnoticed until they cause production outages.

StaticGuard provides a proactive, automated layer of intelligence to catch these risks at the source.

---

💡 Real-World Use Cases

• Automated code review before deployment
• Detecting performance bottlenecks in large codebases
• Educational tool for learning clean coding practices
• Pre-commit code quality validation

---

🚀 Key Features

Category	What It Does
🧠 ML Bug Prediction	Uses a trained RandomForest model and heuristic adjustments to quantify risk from 13+ code metrics
📊 Complexity Auditing	Detects time (O(n²), O(n log n)) and space complexity via structural analysis
⚠️ Issue Detection	Catches syntax errors, infinite loops, unreachable code, division by zero
🏗️ OOP Enforcement	Flags incorrect method overrides, partial interface implementations
🛡️ Clean Code	Identifies magic numbers, unused variables, empty catch blocks
📄 HTML Dashboard	Generates a professional dark-mode report with Chart.js visualizations

---

⚙️ How It Works

┌─────────────────┐
│  Java Source     │
│  Code Input      │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Lexical Analyzer│ ──→ Tokenization
│  & Parser        │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Feature         │ ──→ LOC, Nesting, Loops, Variables
│  Extractor       │
└────────┬────────┘
         ▼
   ┌─────┴─────┐
   ▼           ▼
┌────────┐ ┌────────┐
│ Static │ │  ML    │ ──→ RandomForest Bug Prediction
│Analysis│ │ Bridge │
└───┬────┘ └───┬────┘
    └─────┬────┘
          ▼
┌─────────────────┐
│ Report Generator │ ──→ HTML Dashboard + Console
└─────────────────┘

---

🛠️ Tech Stack

• Core Logic: Java 17 (Parallel Analysis Orchestration)
• Intelligence: Python (Scikit-Learn, RandomForest, Pandas)
• Reporting: HTML5, Chart.js, Vanilla CSS
• Data Layer: Google Gson

---

📂 Project Structure

StaticGuard/
├── src/main/java/com/staticguard/
│   ├── analysis/      # Detectors, complexity analyzers, suggestion engine
│   ├── core/          # Lexer, tokenizer, interfaces, exceptions
│   ├── ml/            # Feature extraction & Python ML bridge
│   ├── orchestrator/  # Parallel analysis task management
│   └── output/        # Console & HTML report generators
├── ml_module/         # Python ML model (predict.py, model.pkl)
├── lib/               # Required JAR dependencies
├── sample/            # Diverse test cases for validation
└── results/           # Output directory for HTML Dashboards

---

⚡ Setup & Usage

Prerequisites

• JDK 17+ (Ensure java and javac are in your PATH)
• Python 3.10+ (Required for ML inference)

1. Install ML Dependencies

pip install pandas scikit-learn

2. Build the Project (Windows/PowerShell)

# Generate a quoted file list (handles spaces in paths)
$files = Get-ChildItem -Path "src/main/java" -Recurse -Filter "*.java" | ForEach-Object { '"{0}"' -f ($_.FullName -replace '\\', '/') }

# Compile
javac -cp "lib/*" -d target/classes $files

3. Run Analysis

Via Python Wrapper:

python run_analysis.py sample/ChaosTestFile.java

Via Direct Java:

java -cp "target/classes;lib/*" com.staticguard.Main sample/ChaosTestFile.java

4. View Results

start results/report.html

---

🔮 Future Roadmap

• IDE Plugins: Real-time feedback within VS Code and IntelliJ.
• CI/CD Integration: Automatically block PRs that exceed a defined risk threshold.
• Multi-Language Support: Expanding analysis to C++ and Python.
• RCA with SHAP: Explainable AI to show exactly why a file was flagged as risky.

---

⚠️ Limitations

• Complexity estimation is approximate (pattern-based, not formal proof)
• ML accuracy depends on training data quality
• Not a full compiler replacement — focuses on quality insights

---

📌 Conclusion

StaticGuard is designed to improve code quality by combining static analysis with intelligent predictions. It goes beyond traditional compilers by providing a holistic view of code health.

💡 Built to make code safer, cleaner, and more efficient.