{"id":106618,"date":"2026-09-17T19:56:39","date_gmt":"2026-09-17T11:56:39","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/106618.html"},"modified":"2026-09-17T19:56:39","modified_gmt":"2026-09-17T11:56:39","slug":"call-graph-dfg-%e4%b8%8d%e5%ae%8c%e6%95%b4%e6%88%96%e5%ad%98%e5%9c%a8%e5%8a%a8%e6%80%81%e5%88%86%e6%b4%be%e6%97%b6%ef%bc%8c%e7%bb%93%e6%9e%84%e6%a3%80%e7%b4%a2%e4%bc%9a%e6%80%8e%e6%a0%b7%e5%a4%b1","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/106618.html","title":{"rendered":"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f"},"content":{"rendered":"

\u7b2c122\u9898：Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6，\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25？<\/h2>\n

\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

1. \u6838\u5fc3\u56de\u7b54<\/h3>\n

\u5982\u679c\u7ed3\u6784\u68c0\u7d22\u4f9d\u8d56 Call Graph \u6216 Data-Flow Graph，\u90a3\u4e48\u5b83\u7684\u6027\u80fd\u4e0a\u9650\u9996\u5148\u53d7\u7ed3\u6784\u56fe\u8d28\u91cf\u7ea6\u675f\u3002<\/p>\n

\u6211\u4f1a\u628a\u56fe\u9519\u8bef\u5206\u6210\u4e24\u4e2a\u65b9\u5411：<\/p>\n

  • Missing Edge \/ False Negative Edge：\u771f\u5b9e\u8c03\u7528\u6216\u6570\u636e\u6d41\u8fb9\u6ca1\u6709\u88ab\u9759\u6001\u5206\u6790\u6062\u590d；<\/li>\n
  • Spurious Edge \/ False Positive Edge：\u9759\u6001\u5206\u6790\u4e3a\u4e86\u4fdd\u5b88\u8fd1\u4f3c\u52a0\u5165\u4e86\u5b9e\u9645\u4e0d\u4f1a\u53d1\u751f\u7684\u8fb9\u3002<\/li>\n

    \u4e24\u8005\u5bf9\u7ed3\u6784\u68c0\u7d22\u7684\u5f71\u54cd\u6b63\u597d\u76f8\u53cd：<\/p>\n

    Missing Edge
    \n\u2192 \u771f\u6b63\u76f8\u5173\u8282\u70b9\u4e0d\u53ef\u8fbe
    \n\u2192 Retrieval Recall\u4e0b\u964d
    \n\u2192 \u5173\u952e\u8bc1\u636e\u7f3a\u5931<\/p>\n

    Spurious Edge
    \n\u2192 \u5927\u91cf\u65e0\u5173\u8282\u70b9\u88ab\u6269\u5c55
    \n\u2192 Retrieval Precision\u4e0b\u964d
    \n\u2192 Context Noise\u548cToken Cost\u589e\u52a0<\/p>\n

    \u52a8\u6001\u5206\u6d3e\u3001Reflection\u3001Callback\u3001Function Pointer\u3001Dependency Injection\u3001RPC \u7b49\u673a\u5236\u4f1a\u8fdb\u4e00\u6b65\u653e\u5927\u8fd9\u4e2a\u95ee\u9898\u3002<\/p>\n

    \u6240\u4ee5\u6211\u7684\u8bbe\u8ba1\u4e0d\u4f1a\u662f：<\/p>\n

    \u53ea\u5141\u8bb8\u4ece\u7ed3\u6784\u56fe\u90bb\u5c45\u4e2d\u68c0\u7d22<\/p>\n

    \u800c\u4f1a\u91c7\u7528：<\/p>\n

    Lexical \/ Dense Recall
    \n+
    \nStructural Expansion
    \n+
    \nReranking<\/p>\n

    \u628a\u7ed3\u6784\u4fe1\u606f\u4f5c\u4e3a\u91cd\u8981\u4fe1\u53f7，\u4f46\u4e0d\u662f\u552f\u4e00\u5165\u53e3\u3002<\/p>\n

    \u540c\u65f6\u7528 Oracle Graph\u3001Edge Deletion\u3001Edge Injection \u548c\u52a8\u6001\u7279\u5f81\u5207\u7247\u5b9e\u9a8c，\u91cf\u5316\u56fe\u9519\u8bef\u5bf9 Retrieval Recall \u548c\u6700\u7ec8\u6f0f\u6d1e\u68c0\u6d4b\u7ed3\u679c\u7684\u5f71\u54cd\u3002<\/p>\n

    \n

    2. \u4ec0\u4e48\u53eb\u7ed3\u6784\u68c0\u7d22<\/h3>\n

    \u5047\u8bbe\u4ee3\u7801\u5e93\u88ab\u8868\u793a\u6210\u56fe：<\/p>\n

    G=(V,E)
    \nG=(V,E)
    \n<\/span><\/span>G<\/span><\/span>=<\/span><\/span><\/span><\/span>(<\/span>V<\/span>,<\/span><\/span>E<\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

    \u8282\u70b9 VV<\/span><\/span>V<\/span><\/span><\/span><\/span><\/span> \u53ef\u4ee5\u5305\u62ec：<\/p>\n

      \n
    • Function；<\/li>\n
    • Method；<\/li>\n
    • Statement；<\/li>\n
    • Variable；<\/li>\n
    • API；<\/li>\n
    • Code Chunk\u3002<\/li>\n<\/ul>\n

      \u8fb9 EE<\/span><\/span>E<\/span><\/span><\/span><\/span><\/span> \u53ef\u4ee5\u5305\u62ec：<\/p>\n

        \n
      • Call Edge；<\/li>\n
      • Data-Flow Edge；<\/li>\n
      • Control-Flow Edge；<\/li>\n
      • Def-Use Edge；<\/li>\n
      • Source\u2013Sink Relation\u3002<\/li>\n<\/ul>\n

        \u5bf9\u4e8e Query \u51fd\u6570：<\/p>\n

        q
        \nq
        \n<\/span><\/span>q<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

        \u7ed3\u6784\u68c0\u7d22\u53ef\u80fd\u4ece：<\/p>\n

        Nk(q)
        \nN_k(q)
        \n<\/span><\/span>N<\/span><\/span>k<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>(<\/span>q<\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

        \u5373 kk<\/span><\/span>k<\/span><\/span><\/span><\/span><\/span> \u8df3\u90bb\u57df\u4e2d\u9009\u62e9\u4e0a\u4e0b\u6587\u3002<\/p>\n

        \u4f8b\u5982：<\/p>\n

        Query Function
        \n\u2193
        \nCaller
        \n\u2193
        \nCallee
        \n\u2193
        \nSource\/Sink
        \n\u2193
        \n\u76f8\u5173\u4ee3\u7801Chunk<\/p>\n

        \u76f8\u6bd4\u7eaf\u6587\u672c Embedding，\u5b83\u5e0c\u671b\u5229\u7528\u771f\u5b9e\u7a0b\u5e8f\u7ed3\u6784\u8fc7\u6ee4\u65e0\u5173\u4ee3\u7801\u3002<\/p>\n

        \u4f46\u524d\u63d0\u662f：<\/p>\n

        Gestimated
        \nG_{\\\\text{estimated}}
        \n<\/span><\/span>G<\/span><\/span>estimated<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

        \u8db3\u591f\u63a5\u8fd1\u771f\u5b9e\u7a0b\u5e8f\u884c\u4e3a：<\/p>\n

        Gtrue
        \nG_{\\\\text{true}}
        \n<\/span><\/span>G<\/span><\/span>true<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

        \n

        3. Call Graph \u4e0d\u5b8c\u6574\u65f6\u6700\u76f4\u63a5\u7684\u5931\u8d25：\u6f0f\u53ec\u56de<\/h3>\n

        \u5047\u8bbe\u771f\u5b9e\u8c03\u7528\u94fe：<\/p>\n

        handleRequest()
        \n\u2193
        \nparse()
        \n\u2193
        \nvalidate()
        \n\u2193
        \nexecuteQuery()<\/p>\n

        \u4f46\u9759\u6001 Call Graph \u6f0f\u6389：<\/p>\n

        parse()
        \n\u2192
        \nvalidate()<\/p>\n

        \u4e8e\u662f\u4f30\u8ba1\u56fe\u53d8\u6210：<\/p>\n

        handleRequest()
        \n\u2193
        \nparse()<\/p>\n

        validate()
        \n\u2193
        \nexecuteQuery()<\/p>\n

        \u5982\u679c\u7ed3\u6784\u68c0\u7d22\u53ea\u6267\u884c：<\/p>\n

        \u4ecehandleRequest\u5411\u5916\u6269\u5c553\u8df3<\/p>\n

        \u5219：<\/p>\n

        validate()
        \nexecuteQuery()<\/p>\n

        \u53ef\u80fd\u6c38\u8fdc\u4e0d\u4f1a\u8fdb\u5165\u5019\u9009\u96c6\u5408\u3002<\/p>\n

        \u5373：<\/p>\n

        RelevantEvidence\u2209Candidates
        \nRelevantEvidence
        \n\\\\notin
        \nCandidates
        \n<\/span><\/span>R<\/span>e<\/span>l<\/span>e<\/span>v<\/span>an<\/span>tE<\/span>v<\/span>i<\/span>d<\/span>e<\/span>n<\/span>ce<\/span><\/span>\u2208<\/span><\/span><\/span>\/<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>C<\/span>an<\/span>d<\/span>i<\/span>d<\/span>a<\/span>t<\/span>es<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

        \u540e\u9762\u7684：<\/p>\n

          \n
        • Embedding；<\/li>\n
        • Reranker；<\/li>\n
        • LLM；<\/li>\n<\/ul>\n

          \u518d\u5f3a\u4e5f\u65e0\u6cd5\u628a\u5b83\u627e\u56de\u6765\u3002<\/p>\n

          \u56e0\u6b64\u7ed3\u6784\u68c0\u7d22\u4e2d\u7684\u7b2c\u4e00\u539f\u5219\u662f：<\/p>\n

          \u5019\u9009\u751f\u6210\u9636\u6bb5\u53d1\u751f\u7684 False Negative \u901a\u5e38\u65e0\u6cd5\u88ab\u540e\u7eed Reranking \u4fee\u590d\u3002<\/p>\n

          \n

          4. Missing Edge \u4e3a\u4ec0\u4e48\u5bf9\u5b89\u5168\u4efb\u52a1\u7279\u522b\u5371\u9669<\/h3>\n

          \u5f88\u591a\u6f0f\u6d1e\u672c\u8eab\u5c31\u662f\u8de8\u51fd\u6570\u5f62\u6210\u7684\u3002<\/p>\n

          \u4f8b\u5982：<\/p>\n

          HTTP Input
          \n\u2193
          \ncontroller()
          \n\u2193
          \nservice()
          \n\u2193
          \ndecode()
          \n\u2193
          \nshell()<\/p>\n

          \u771f\u6b63\u7684\u6f0f\u6d1e\u5173\u7cfb\u662f：<\/p>\n

          Source\u21ddSink
          \nSource
          \n\\\\leadsto
          \nSink
          \n<\/span><\/span>S<\/span>o<\/span>u<\/span>r<\/span>ce<\/span><\/span>\u21dd<\/span><\/span><\/span><\/span>S<\/span>ink<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

          \u5982\u679c Call Graph \u4e2d\u6f0f\u6389：<\/p>\n

          service()
          \n\u2192
          \ndecode()<\/p>\n

          \u90a3\u4e48\u6574\u4e2a\u653b\u51fb\u8def\u5f84\u53ef\u80fd\u88ab\u5207\u65ad\u3002<\/p>\n

          \u6700\u7ec8 Retriever \u53ef\u80fd\u53ea\u80fd\u770b\u5230：<\/p>\n

          HTTP Input<\/p>\n

          \u5374\u770b\u4e0d\u5230：<\/p>\n

          shell()<\/p>\n

          \u4e8e\u662f\u6a21\u578b\u5224\u65ad：<\/p>\n

          \u6ca1\u6709\u5371\u9669Sink<\/p>\n

          \u4ea7\u751f False Negative\u3002<\/p>\n

          \u5bf9\u4e8e：<\/p>\n

            \n
          • SQL Injection；<\/li>\n
          • Command Injection；<\/li>\n
          • Path Traversal；<\/li>\n
          • Sensitive Data Flow；<\/li>\n<\/ul>\n

            \u8fd9\u7c7b\u8de8\u8fc7\u7a0b\u6f0f\u6d1e\u5f71\u54cd\u5c24\u5176\u660e\u663e\u3002<\/p>\n

            \n

            5. DFG \u4e0d\u5b8c\u6574\u4f1a\u76f4\u63a5\u622a\u65ad Source\u2013Sink Path<\/h3>\n

            Data-Flow Graph \u53ef\u4ee5\u8868\u793a：<\/p>\n

            vi\u2192vj
            \nv_i\\\\rightarrow v_j
            \n<\/span><\/span>v<\/span><\/span>i<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2192<\/span><\/span><\/span><\/span>v<\/span><\/span>j<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u8868\u793a\u503c\u6216\u6c61\u70b9\u53ef\u80fd\u4ece：<\/p>\n

            vi
            \nv_i
            \n<\/span><\/span>v<\/span><\/span>i<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u4f20\u64ad\u5230：<\/p>\n

            vj
            \nv_j
            \n<\/span><\/span>v<\/span><\/span>j<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u5047\u8bbe\u771f\u5b9e\u8def\u5f84：<\/p>\n

            request.input
            \n\u2193
            \ndecode()
            \n\u2193
            \nnormalize()
            \n\u2193
            \nquery
            \n\u2193
            \ndb.execute()<\/p>\n

            \u771f\u5b9e DFG：<\/p>\n

            Source\u2192v1\u2192v2\u2192Sink
            \nSource
            \n\\\\rightarrow
            \nv_1
            \n\\\\rightarrow
            \nv_2
            \n\\\\rightarrow
            \nSink
            \n<\/span><\/span>S<\/span>o<\/span>u<\/span>r<\/span>ce<\/span><\/span>\u2192<\/span><\/span><\/span><\/span>v<\/span><\/span>1<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2192<\/span><\/span><\/span><\/span>v<\/span><\/span>2<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2192<\/span><\/span><\/span><\/span>S<\/span>ink<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u5982\u679c：<\/p>\n

            (v1,v2)
            \n(v_1,v_2)
            \n<\/span><\/span>(<\/span>v<\/span><\/span>1<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>,<\/span><\/span>v<\/span><\/span>2<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u7f3a\u5931，\u5219\u7ed3\u6784\u7cfb\u7edf\u770b\u5230：<\/p>\n

            Source\u219bSink
            \nSource
            \n\\\\nrightarrow
            \nSink
            \n<\/span><\/span>S<\/span>o<\/span>u<\/span>r<\/span>ce<\/span><\/span>\u219b<\/span><\/span><\/span><\/span>S<\/span>ink<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

            \u4e8e\u662f：<\/p>\n

            Source-Sink Retrieval<\/p>\n

            \u4f1a\u76f4\u63a5\u5931\u8d25\u3002<\/p>\n

            CodeQL \u7684 Path Query \u4e5f\u662f\u5efa\u7acb\u5728 source\u3001sink \u548c\u8fde\u63a5\u5b83\u4eec\u7684\u6570\u636e\u6d41 edge \u4e0a；\u5982\u679c\u5173\u952e flow step \u6ca1\u6709\u88ab\u6a21\u578b\u8986\u76d6，\u5c31\u65e0\u6cd5\u5f97\u5230\u5b8c\u6574\u8def\u5f84\u3002<\/p>\n

            \n

            6. \u4e3a\u4ec0\u4e48 DFG \u5f88\u96be\u505a\u5230\u7edd\u5bf9\u5b8c\u6574<\/h3>\n

            \u8de8\u8fc7\u7a0b\u6570\u636e\u6d41\u53ef\u80fd\u6d89\u53ca：<\/p>\n

              \n
            • Pointer；<\/li>\n
            • Alias；<\/li>\n
            • Object Field；<\/li>\n
            • Heap；<\/li>\n
            • Global Variable；<\/li>\n
            • Callback；<\/li>\n
            • Container；<\/li>\n
            • Framework；<\/li>\n
            • Serialization；<\/li>\n
            • Native Code；<\/li>\n
            • Database；<\/li>\n
            • RPC\u3002<\/li>\n<\/ul>\n

              \u4f8b\u5982：<\/p>\n

              obj.<\/span>setInput<\/span>(<\/span>userInput)<\/span>;<\/span>
              \n.<\/span>.<\/span>.<\/span>
              \nsink<\/span>(<\/span>obj.<\/span>getInput<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

              \u9700\u8981\u5206\u6790：<\/p>\n

              setInput
              \n\u2193
              \nHeap Field
              \n\u2193
              \ngetInput<\/p>\n

              \u624d\u80fd\u6062\u590d\u4f20\u64ad\u5173\u7cfb\u3002<\/p>\n

              \u5982\u679c Alias \/ Points-to Analysis \u4e0d\u591f\u51c6\u786e，DFG \u5c31\u53ef\u80fd\u6f0f\u6389\u6216\u8fc7\u5ea6\u52a0\u5165\u4f20\u64ad\u8def\u5f84\u3002<\/p>\n

              \u56e0\u6b64\u7ed3\u6784\u68c0\u7d22\u7cfb\u7edf\u5fc5\u987b\u627f\u8ba4：<\/p>\n

              DFGstatic\u2260DFGruntime
              \nDFG_{\\\\text{static}}
              \n\\\\neq
              \nDFG_{\\\\text{runtime}}
              \n<\/span><\/span>D<\/span>F<\/span>G<\/span><\/span>static<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\ue020<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>=<\/span><\/span><\/span><\/span><\/span>D<\/span>F<\/span>G<\/span><\/span>runtime<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

              \u901a\u5e38\u53ea\u80fd\u5f97\u5230\u8fd1\u4f3c\u3002<\/p>\n

              \n

              7. \u53e6\u4e00\u4e2a\u65b9\u5411：Spurious Edge<\/h3>\n

              \u4e3a\u4e86\u964d\u4f4e\u6f0f\u62a5，\u9759\u6001\u5206\u6790\u6709\u65f6\u91c7\u7528 Conservative Over-Approximation\u3002<\/p>\n

              \u4f8b\u5982：<\/p>\n

              interface<\/span> Handler<\/span> {<\/span>
              \n void<\/span> handle<\/span>(<\/span>Input<\/span> x)<\/span>;<\/span>
              \n}<\/span><\/p>\n

              \u5b58\u5728：<\/p>\n

              SafeHandler
              \nFileHandler
              \nDatabaseHandler
              \nShellHandler<\/p>\n

              \u9759\u6001\u5206\u6790\u4e0d\u80fd\u786e\u5b9a：<\/p>\n

              handler.<\/span>handle<\/span>(<\/span>x)<\/span><\/p>\n

              \u8fd0\u884c\u65f6\u7a76\u7adf\u662f\u54ea\u4e00\u4e2a\u5bf9\u8c61\u3002<\/p>\n

              \u4e8e\u662f\u53ef\u80fd\u52a0\u5165：<\/p>\n

              caller \u2192 SafeHandler.handle
              \ncaller \u2192 FileHandler.handle
              \ncaller \u2192 DatabaseHandler.handle
              \ncaller \u2192 ShellHandler.handle<\/p>\n

              \u5b9e\u9645\u4e0a\u8fd0\u884c\u65f6\u53ea\u6709：<\/p>\n

              SafeHandler.handle<\/p>\n

              \u88ab\u8c03\u7528\u3002<\/p>\n

              \u5176\u4f59\u90fd\u662f Spurious Edges\u3002<\/p>\n

              \n

              8. Spurious Edge \u4f1a\u600e\u6837\u7834\u574f\u7ed3\u6784\u68c0\u7d22<\/h3>\n

              \u5047\u8bbe\u672c\u6765\u7ed3\u6784\u90bb\u57df\u53ea\u6709：<\/p>\n

              20
              \n20
              \n<\/span><\/span>20<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

              \u4e2a\u771f\u6b63\u76f8\u5173\u51fd\u6570\u3002<\/p>\n

              \u56e0\u4e3a Call Graph Over-Approximation，\u53d8\u6210：<\/p>\n

              300
              \n300
              \n<\/span><\/span>300<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

              \u4e2a\u5019\u9009\u51fd\u6570\u3002<\/p>\n

              \u7ed3\u6784\u68c0\u7d22\u7684 Search Space \u4ece：<\/p>\n

              20
              \n20
              \n<\/span><\/span>20<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

              \u6269\u5927\u5230：<\/p>\n

              300
              \n300
              \n<\/span><\/span>300<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

              \u540e\u679c\u5305\u62ec：<\/p>\n

                \n
              • \u65e0\u5173 Code Chunk \u589e\u52a0；<\/li>\n
              • Reranker \u96be\u5ea6\u589e\u52a0；<\/li>\n
              • Top-K \u88ab\u9519\u8bef\u5019\u9009\u5360\u7528；<\/li>\n
              • Prompt Token \u589e\u52a0；<\/li>\n
              • LLM \u6ce8\u610f\u529b\u88ab\u7a00\u91ca；<\/li>\n
              • \u5ef6\u8fdf\u4e0a\u5347\u3002<\/li>\n<\/ul>\n

                \u4e5f\u5c31\u662f\u8bf4：<\/p>\n

                Graph\u00a0Recall\u2191
                \nGraph\\\\ Recall\\\\uparrow
                \n<\/span><\/span>G<\/span>r<\/span>a<\/span>p<\/span>h<\/span>\u00a0<\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span><\/span>\u2191<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u4e0d\u4e00\u5b9a\u610f\u5473\u7740：<\/p>\n

                EndToEnd\u00a0Quality\u2191
                \nEndToEnd\\\\ Quality\\\\uparrow
                \n<\/span><\/span>E<\/span>n<\/span>d<\/span>T<\/span>o<\/span>E<\/span>n<\/span>d<\/span>\u00a0<\/span>Q<\/span>u<\/span>a<\/span>l<\/span>i<\/span>t<\/span>y<\/span><\/span>\u2191<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u56e0\u4e3a\u8fc7\u5ea6\u4fdd\u5b88\u7684\u56fe\u53ef\u80fd\u4e25\u91cd\u635f\u5bb3 Precision\u3002<\/p>\n

                \n

                9. Call Graph \u672c\u8eab\u5c31\u5b58\u5728 Soundness\u2013Precision Trade-off<\/h3>\n

                \u5b9a\u4e49\u771f\u5b9e Call Edge \u96c6：<\/p>\n

                E\u2217
                \nE^*
                \n<\/span><\/span>E<\/span><\/span>\u2217<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u9759\u6001\u5206\u6790\u5f97\u5230：<\/p>\n

                E^
                \n\\\\hat E
                \n<\/span><\/span><\/span>E<\/span><\/span><\/span>^<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u53ef\u4ee5\u5b9a\u4e49 Edge Recall：<\/p>\n

                $$
                \nRecall_{CG}<\/h2>\n

                \\\\frac{|\\\\hat E\\\\cap E^|}
                \n{|E^|}
                \n$$<\/p>\n

                \u4ee5\u53ca Edge Precision：<\/p>\n

                $$
                \nPrecision_{CG}<\/h2>\n

                \\\\frac{|\\\\hat E\\\\cap E^*|}
                \n{|\\\\hat E|}
                \n$$<\/p>\n

                \u5982\u679c\u8ffd\u6c42\u66f4\u9ad8 Soundness，\u901a\u5e38\u4f1a\u589e\u52a0\u53ef\u80fd\u7684 Call Target：<\/p>\n

                \u2223E^\u2223\u2191
                \n|\\\\hat E|\\\\uparrow
                \n<\/span><\/span>\u2223<\/span><\/span>E<\/span><\/span><\/span>^<\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2223<\/span><\/span>\u2191<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u4f46\u53ef\u80fd\u4f7f：<\/p>\n

                PrecisionCG\u2193
                \nPrecision_{CG}\\\\downarrow
                \n<\/span><\/span>P<\/span>r<\/span>ec<\/span>i<\/span>s<\/span>i<\/span>o<\/span>n<\/span><\/span>C<\/span>G<\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2193<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u53cd\u8fc7\u6765，\u5982\u679c\u4e3a\u4e86 Precision \u8fc7\u5ea6\u88c1\u526a\u5019\u9009：<\/p>\n

                \u2223E^\u2223\u2193
                \n|\\\\hat E|\\\\downarrow
                \n<\/span><\/span>\u2223<\/span><\/span>E<\/span><\/span><\/span>^<\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2223<\/span><\/span>\u2193<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u53c8\u53ef\u80fd\u4ea7\u751f：<\/p>\n

                RecallCG\u2193
                \nRecall_{CG}\\\\downarrow
                \n<\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span><\/span>C<\/span>G<\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2193<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                \u6240\u4ee5\u7ed3\u6784\u68c0\u7d22\u4e0d\u80fd\u5047\u8bbe Call Graph \u662f\u7edd\u5bf9\u771f\u503c\u3002<\/p>\n

                \n

                10. Dynamic Dispatch \u4e3a\u4ec0\u4e48\u662f\u6838\u5fc3\u56f0\u96be<\/h3>\n

                \u8003\u8651：<\/p>\n

                Base<\/span> x =<\/span> factory<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                x.<\/span>process<\/span>(<\/span>input)<\/span>;<\/span><\/p>\n

                \u9759\u6001\u4ee3\u7801\u53ea\u544a\u8bc9\u6211\u4eec：<\/p>\n

                declared type = Base<\/p>\n

                \u5b9e\u9645\u8fd0\u884c\u5bf9\u8c61\u53ef\u80fd\u662f：<\/p>\n

                A
                \nB
                \nC<\/p>\n

                \u4e8e\u662f：<\/p>\n

                Base.process()<\/p>\n

                \u7684\u771f\u5b9e\u8c03\u7528\u76ee\u6807\u9700\u8981\u6839\u636e\u8fd0\u884c\u65f6\u5bf9\u8c61\u7c7b\u578b\u786e\u5b9a\u3002<\/p>\n

                \u5373：<\/p>\n

                $$
                \nTarget(call)<\/h2>\n

                f(RuntimeType(x))
                \n$$<\/p>\n

                \u9759\u6001\u5206\u6790\u6ca1\u6709\u76f4\u63a5\u7684 RuntimeType\u3002<\/p>\n

                \u6240\u4ee5\u9700\u8981\u4f7f\u7528：<\/p>\n

                  \n
                • Class Hierarchy Analysis；<\/li>\n
                • Rapid Type Analysis；<\/li>\n
                • Points-to Analysis；<\/li>\n
                • Context-Sensitive Analysis；<\/li>\n<\/ul>\n

                  \u63a8\u65ad\u53ef\u80fd Call Target\u3002<\/p>\n

                  \n

                  11. CodeQL \u4e3a\u4ec0\u4e48\u533a\u5206 calls \u548c polyCalls<\/h3>\n

                  CodeQL \u5b98\u65b9 Java Call Graph \u63a5\u53e3\u4e2d\u533a\u5206：<\/p>\n

                  calls(target)<\/p>\n

                  \u548c：<\/p>\n

                  polyCalls(target)<\/p>\n

                  \u524d\u8005\u5bf9\u5e94\u76f4\u63a5\u89e3\u6790\u7684\u8c03\u7528\u3002<\/p>\n

                  \u540e\u8005\u8003\u8651：<\/p>\n

                  runtime polymorphic dispatch<\/p>\n

                  \u5373\u4e00\u4e2a\u8c03\u7528\u53ef\u80fd\u771f\u6b63\u843d\u5230：<\/p>\n

                  override method<\/p>\n

                  \u4e0a\u3002<\/p>\n

                  \u8fd9\u8bf4\u660e\u5728\u9762\u5411\u5bf9\u8c61\u8bed\u8a00\u4e2d：<\/p>\n

                  syntactic callee<\/p>\n

                  \u548c：<\/p>\n

                  runtime callee<\/p>\n

                  \u672c\u8eab\u5c31\u662f\u4e24\u4e2a\u4e0d\u540c\u6982\u5ff5\u3002<\/p>\n

                  \u7ed3\u6784\u68c0\u7d22\u5982\u679c\u53ea\u4f7f\u7528\u9759\u6001\u58f0\u660e\u65b9\u6cd5，\u4f1a\u6f0f\u6389\u771f\u6b63\u5b9e\u73b0\u3002<\/p>\n

                  \n

                  12. Points-to Analysis \u4e3a\u4ec0\u4e48\u80fd\u6539\u5584\u52a8\u6001\u8c03\u7528\u89e3\u6790<\/h3>\n

                  \u4f8b\u5982：<\/p>\n

                  Base<\/span> x;<\/span><\/p>\n

                  if<\/span> (<\/span>flag)<\/span>
                  \n x =<\/span> new<\/span> A<\/span>(<\/span>)<\/span>;<\/span>
                  \nelse<\/span>
                  \n x =<\/span> new<\/span> B<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                  x.<\/span>run<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                  \u5982\u679c\u5206\u6790\u5f97\u5230：<\/p>\n

                  PointsTo(x)={A,B}
                  \nPointsTo(x)=\\\\{A,B\\\\}
                  \n<\/span><\/span>P<\/span>o<\/span>in<\/span>t<\/span>s<\/span>T<\/span>o<\/span>(<\/span>x<\/span>)<\/span><\/span>=<\/span><\/span><\/span><\/span>{<\/span>A<\/span>,<\/span><\/span>B<\/span>}<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                  \u5219 Call Target \u53ef\u4ee5\u7f29\u5c0f\u6210：<\/p>\n

                  Targets(x.run)={A.run,B.run}
                  \nTargets(x.run)=
                  \n\\\\{A.run,B.run\\\\}
                  \n<\/span><\/span>T<\/span>a<\/span>r<\/span>g<\/span>e<\/span>t<\/span>s<\/span>(<\/span>x<\/span>.<\/span>r<\/span>u<\/span>n<\/span>)<\/span><\/span>=<\/span><\/span><\/span><\/span>{<\/span>A<\/span>.<\/span>r<\/span>u<\/span>n<\/span>,<\/span><\/span>B<\/span>.<\/span>r<\/span>u<\/span>n<\/span>}<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                  \u800c\u4e0d\u662f Class Hierarchy \u4e2d\u6240\u6709：<\/p>\n

                  Base subclass<\/p>\n

                  \u7684 run()\u3002<\/p>\n

                  Soot\/SootUp \u7684 Spark \u5c31\u7ed3\u5408：<\/p>\n

                    \n
                  • Points-to Analysis；<\/li>\n
                  • Pointer Assignment Graph；<\/li>\n
                  • Call Graph；<\/li>\n<\/ul>\n

                    \u63a8\u5bfc\u8c03\u7528\u5173\u7cfb\u3002<\/p>\n

                    \u8fd9\u53ef\u4ee5\u6539\u5584 Precision\u3002<\/p>\n

                    \u4f46\u4ecd\u7136\u53d6\u51b3\u4e8e\u7a0b\u5e8f\u52a8\u6001\u7279\u5f81\u662f\u5426\u88ab\u6b63\u786e\u5efa\u6a21\u3002<\/p>\n

                    \n

                    13. Reflection \u4e3a\u4ec0\u4e48\u66f4\u56f0\u96be<\/h3>\n

                    \u4f8b\u5982：<\/p>\n

                    String<\/span> name =<\/span> config.<\/span>get<\/span>(<\/span>"handler"<\/span>)<\/span>;<\/span><\/p>\n

                    Class<\/span><<\/span>?<\/span>><\/span><\/span> c =<\/span> Class<\/span>.<\/span>forName<\/span>(<\/span>name)<\/span>;<\/span><\/p>\n

                    Handler<\/span> h =<\/span> (<\/span>Handler<\/span>)<\/span>c.<\/span>newInstance<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                    h.<\/span>run<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                    \u76ee\u6807\u7c7b\u578b\u6765\u81ea：<\/p>\n

                    Runtime Configuration<\/p>\n

                    \u4ec5\u4ece\u666e\u901a AST \u548c\u7c7b\u578b\u5c42\u6b21\u53ef\u80fd\u65e0\u6cd5\u786e\u5b9a：<\/p>\n

                    name<\/p>\n

                    \u5230\u5e95\u662f\u4ec0\u4e48\u3002<\/p>\n

                    \u5982\u679c\u9759\u6001\u5206\u6790\u6ca1\u6709\u4e13\u95e8 Reflection Modeling：<\/p>\n

                    run()<\/p>\n

                    \u7684\u771f\u5b9e\u76ee\u6807\u53ef\u80fd\u6d88\u5931\u3002<\/p>\n

                    \u4e8e\u662f：<\/p>\n

                    Call Graph Missing Edge
                    \n\u2193
                    \nStructural Retrieval Missing Evidence<\/p>\n

                    \u5b9e\u8bc1\u7814\u7a76\u4e5f\u663e\u793a Reflection \u7b49\u52a8\u6001\u673a\u5236\u662f\u9759\u6001 Call Graph \u5b8c\u6574\u6027\u7684\u91cd\u8981\u6311\u6218\u3002<\/p>\n

                    \n

                    14. Framework Callback \u540c\u6837\u4f1a\u5bfc\u81f4\u9690\u85cf\u8c03\u7528\u8fb9<\/h3>\n

                    \u4f8b\u5982 Web Framework：<\/p>\n

                    @GetMapping<\/span>(<\/span>"\/login"<\/span>)<\/span>
                    \npublic<\/span> Response<\/span> login<\/span>(<\/span>.<\/span>.<\/span>.<\/span>)<\/span> {<\/span>
                    \n .<\/span>.<\/span>.<\/span>
                    \n}<\/span><\/p>\n

                    \u4ee3\u7801\u4e2d\u53ef\u80fd\u6839\u672c\u6ca1\u6709\u663e\u5f0f：<\/p>\n

                    main<\/span>(<\/span>)<\/span> \u2192 login<\/span>(<\/span>)<\/span><\/p>\n

                    \u771f\u5b9e\u8c03\u7528\u7531 Framework Runtime \u5b8c\u6210\u3002<\/p>\n

                    \u7c7b\u4f3c\u60c5\u51b5\u5305\u62ec：<\/p>\n

                      \n
                    • Spring Dependency Injection；<\/li>\n
                    • Android Lifecycle；<\/li>\n
                    • Event Listener；<\/li>\n
                    • Servlet；<\/li>\n
                    • ORM Callback；<\/li>\n
                    • Annotation-driven Framework\u3002<\/li>\n<\/ul>\n

                      \u5982\u679c\u9759\u6001\u5206\u6790\u4e0d\u77e5\u9053 Framework Semantics，\u5c31\u53ef\u80fd\u770b\u4e0d\u5230：<\/p>\n

                      Framework
                      \n\u2192
                      \nApplication Callback<\/p>\n

                      \u8fd9\u79cd Hidden Edge\u3002<\/p>\n

                      \u5df2\u6709\u9488\u5bf9 Spring Framework \u7684\u9759\u6001\u5206\u6790\u7814\u7a76\u4e13\u95e8\u901a\u8fc7\u989d\u5916\u5efa\u6a21\u63d0\u9ad8 Call Graph Completeness\u3002<\/p>\n

                      \n

                      15. Function Pointer \u4e5f\u5b58\u5728\u540c\u6837\u95ee\u9898<\/h3>\n

                      C\/C++：<\/p>\n

                      void<\/span> (<\/span>*<\/span>handler)<\/span>(<\/span>char<\/span> *<\/span>)<\/span>;<\/span><\/p>\n

                      handler<\/span>(<\/span>input)<\/span>;<\/span><\/p>\n

                      \u771f\u5b9e\u8c03\u7528\u76ee\u6807\u53d6\u51b3\u4e8e：<\/p>\n

                      handler<\/p>\n

                      \u6307\u5411\u54ea\u91cc\u3002<\/p>\n

                      \u9700\u8981 Pointer Analysis \u624d\u80fd\u786e\u5b9a\u5019\u9009\u96c6\u5408\u3002<\/p>\n

                      \u5982\u679c Points-to Set \u592a\u7a84：<\/p>\n

                      \u6f0f\u8fb9<\/p>\n

                      \u5982\u679c\u592a\u5bbd：<\/p>\n

                      \u4f2a\u8fb9<\/p>\n

                      \u56e0\u6b64：<\/p>\n

                      Dynamic Dispatch
                      \nVirtual Call
                      \nFunction Pointer<\/p>\n

                      \u672c\u8d28\u4e0a\u90fd\u4f53\u73b0\u4e86：<\/p>\n

                      \u8fd0\u884c\u65f6\u8c03\u7528\u76ee\u6807\u65e0\u6cd5\u5b8c\u5168\u7531\u5c40\u90e8\u8bed\u6cd5\u76f4\u63a5\u786e\u5b9a\u3002<\/p>\n

                      \n

                      16. RPC \/ IPC \u4f1a\u5f62\u6210\u66f4\u9690\u853d\u7684\u8de8\u8fb9\u754c\u8c03\u7528<\/h3>\n

                      \u4f8b\u5982：<\/p>\n

                      Client.foo()
                      \n\u2193
                      \nRPC Framework
                      \n\u2193
                      \nNetwork
                      \n\u2193
                      \nServer.foo()<\/p>\n

                      \u6e90\u7801\u4e2d\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u7aef\u4e4b\u95f4\u53ef\u80fd\u6ca1\u6709\u666e\u901a\u51fd\u6570\u8c03\u7528 Edge\u3002<\/p>\n

                      \u4f20\u7edf Call Graph \u53ef\u80fd\u5f97\u5230：<\/p>\n

                      Client.foo()<\/p>\n

                      \u548c：<\/p>\n

                      Server.foo()<\/p>\n

                      \u4e24\u4e2a\u72ec\u7acb\u5b50\u56fe\u3002<\/p>\n

                      \u4e8e\u662f\u7ed3\u6784\u68c0\u7d22\u5728 Client \u4e0a\u67e5\u8be2\u65f6\u6c38\u8fdc\u5230\u4e0d\u4e86 Server \u7aef\u5b9e\u73b0\u3002<\/p>\n

                      2025 \u5e74 ICSE \u7684 RPCBridge \u5de5\u4f5c\u4e13\u95e8\u7814\u7a76\u4e86\u8fd9\u4e00\u95ee\u9898：\u901a\u8fc7\u5efa\u6a21 Java RPC \u8bed\u4e49\u8865\u5145\u8de8 Client\/Server \u7684\u8c03\u7528\u5173\u7cfb，\u5e76\u53d1\u73b0\u8865\u5168\u8fd9\u4e9b\u8fb9\u80fd\u591f\u8fdb\u4e00\u6b65\u6062\u590d\u539f\u5206\u6790\u9057\u6f0f\u7684\u6570\u636e\u6cc4\u6f0f\u8def\u5f84\u3002<\/p>\n

                      \u6240\u4ee5\u5bf9\u4e8e\u73b0\u4ee3\u5fae\u670d\u52a1\u4ee3\u7801：<\/p>\n

                      Repository \u5185 Call Graph \u5b8c\u6574\u4e0d\u7b49\u4e8e\u7cfb\u7edf\u7ea7\u8c03\u7528\u56fe\u5b8c\u6574\u3002<\/p>\n

                      \n

                      17. \u7ed3\u6784\u68c0\u7d22\u6700\u5371\u9669\u7684\u8bbe\u8ba1：\u628a Graph \u5f53 Hard Filter<\/h3>\n

                      \u4f8b\u5982：<\/p>\n

                      candidates =<\/span> all_chunks<\/p>\n

                      candidates =<\/span> [<\/span>
                      \n x for<\/span> x in<\/span> candidates
                      \n if<\/span> graph_distance(<\/span>query,<\/span> x)<\/span> <=<\/span> 2<\/span>
                      \n]<\/span><\/p>\n

                      \u8fd9\u79cd\u8bbe\u8ba1\u610f\u5473\u7740：<\/p>\n

                      x\u2209G\u21d2x\u6c38\u8fdc\u65e0\u6cd5\u88ab\u53ec\u56de
                      \nx\\\\notin G
                      \n\\\\Rightarrow
                      \nx\\\\text{\u6c38\u8fdc\u65e0\u6cd5\u88ab\u53ec\u56de}
                      \n<\/span><\/span>x<\/span><\/span>\u2208<\/span><\/span><\/span>\/<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>G<\/span><\/span>\u21d2<\/span><\/span><\/span><\/span>x<\/span>\u6c38\u8fdc\u65e0\u6cd5\u88ab\u53ec\u56de<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                      \u5982\u679c Graph Missing Edge：<\/p>\n

                      Recall\u4e0d\u53ef\u6062\u590d<\/p>\n

                      \u65e0\u8bba Embedding \u6216 Reranker \u591a\u5f3a\u3002<\/p>\n

                      \u56e0\u6b64\u6211\u4e0d\u4f1a\u628a\u4e0d\u53ef\u9760\u7684\u9759\u6001\u56fe\u76f4\u63a5\u5f53\u6210\u552f\u4e00 Hard Constraint\u3002<\/p>\n

                      \n

                      18. \u66f4\u7a33\u5065\u7684\u65b9\u6cd5：Hybrid Candidate Generation<\/h3>\n

                      \u66f4\u5408\u7406\u7684\u662f\u540c\u65f6\u5efa\u7acb\u591a\u4e2a\u53ec\u56de\u901a\u9053：<\/p>\n

                      Query
                      \n\u251c\u2500\u2500 Lexical Retrieval
                      \n\u251c\u2500\u2500 Dense Retrieval
                      \n\u251c\u2500\u2500 Call-Graph Retrieval
                      \n\u251c\u2500\u2500 DFG Retrieval
                      \n\u2514\u2500\u2500 Metadata Retrieval<\/p>\n

                      \u5f97\u5230：<\/p>\n

                      $$
                      \nC<\/h2>\n

                      C_{\\\\text{lex}}
                      \n\\\\cup
                      \nC_{\\\\text{dense}}
                      \n\\\\cup
                      \nC_{\\\\text{CG}}
                      \n\\\\cup
                      \nC_{\\\\text{DFG}}
                      \n$$<\/p>\n

                      \u7136\u540e：<\/p>\n

                      Dedup
                      \n\u2193
                      \nFeature Fusion
                      \n\u2193
                      \nReranker<\/p>\n

                      \u5982\u679c Call Graph \u6f0f\u8fb9：<\/p>\n

                      Dense Retrieval<\/p>\n

                      \u4ecd\u7136\u53ef\u80fd\u628a\u5173\u952e\u51fd\u6570\u53ec\u56de\u3002<\/p>\n

                      \u5982\u679c Dense Retrieval \u53ea\u770b\u5230\u8868\u9762\u8bed\u4e49：<\/p>\n

                      Structural Retrieval<\/p>\n

                      \u5219\u80fd\u591f\u63d0\u4f9b\u8de8\u51fd\u6570\u7a0b\u5e8f\u5173\u7cfb\u3002<\/p>\n

                      \u4e8c\u8005\u4e92\u8865\u3002<\/p>\n

                      \n

                      19. \u7ed3\u6784\u7279\u5f81\u6700\u597d\u4f5c\u4e3a Ranking Feature，\u800c\u975e\u7edd\u5bf9\u771f\u503c<\/h3>\n

                      \u4f8b\u5982 Reranker Score：<\/p>\n

                      $$
                      \nS(q,d)<\/h2>\n

                      w_1S_{\\\\text{dense}}
                      \n+
                      \nw_2S_{\\\\text{lexical}}
                      \n+
                      \nw_3S_{\\\\text{call}}
                      \n+
                      \nw_4S_{\\\\text{dataflow}}
                      \n$$<\/p>\n

                      \u5176\u4e2d：<\/p>\n

                      Scall
                      \nS_{\\\\text{call}}
                      \n<\/span><\/span>S<\/span><\/span>call<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                      \u53ef\u4ee5\u8003\u8651：<\/p>\n

                        \n
                      • Call Distance；<\/li>\n
                      • Same SCC；<\/li>\n
                      • Caller \/ Callee；<\/li>\n
                      • Points-to Confidence\u3002<\/li>\n<\/ul>\n

                        Sdataflow
                        \nS_{\\\\text{dataflow}}
                        \n<\/span><\/span>S<\/span><\/span>dataflow<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                        \u53ef\u4ee5\u8003\u8651：<\/p>\n

                          \n
                        • \u662f\u5426\u4f4d\u4e8e\u540c\u4e00 Source\u2013Sink Path；<\/li>\n
                        • DFG Distance；<\/li>\n
                        • Taint Reachability\u3002<\/li>\n<\/ul>\n

                          \u8fd9\u6837：<\/p>\n

                          Graph edge\u5b58\u5728<\/p>\n

                          \u53ef\u4ee5\u63d0\u9ad8\u5019\u9009\u5206\u6570\u3002<\/p>\n

                          \u4f46：<\/p>\n

                          Graph edge\u4e0d\u5b58\u5728<\/p>\n

                          \u4e0d\u4f1a\u81ea\u52a8\u628a\u5019\u9009\u5220\u9664\u3002<\/p>\n

                          \u5bf9\u4e0d\u5b8c\u7f8e\u9759\u6001\u56fe\u66f4\u52a0\u9c81\u68d2\u3002<\/p>\n

                          \n

                          20. \u8fd8\u5e94\u8be5\u7ed9 Structure Edge \u4e00\u4e2a Confidence<\/h3>\n

                          \u4e0d\u540c\u7ed3\u6784\u8fb9\u7684\u53ef\u4fe1\u5ea6\u4e0d\u540c\u3002<\/p>\n

                          \u4f8b\u5982：<\/p>\n

                          Direct Static Call<\/p>\n

                          \u7f6e\u4fe1\u5ea6\u901a\u5e38\u8f83\u9ad8\u3002<\/p>\n

                          CHA \u63a8\u6d4b Virtual Target<\/p>\n

                          \u53ef\u80fd\u8f83\u4f4e\u3002<\/p>\n

                          Reflection Approximation<\/p>\n

                          \u66f4\u4e0d\u786e\u5b9a\u3002<\/p>\n

                          \u53ef\u4ee5\u4fdd\u5b58：<\/p>\n

                          edge_type
                          \nanalysis_method
                          \nconfidence
                          \nprovenance<\/p>\n

                          \u4f8b\u5982：<\/p>\n

                          CALL_DIRECT 1.0
                          \nPOINTS_TO 0.9
                          \nCHA 0.6
                          \nREFLECTION_HINT 0.4
                          \nDYNAMIC_TRACE 1.0<\/p>\n

                          \u8fd9\u4e9b\u6570\u5b57\u4e0d\u80fd\u51ed\u7ecf\u9a8c\u76f4\u63a5\u5f53\u771f\u5b9e\u6982\u7387，\u9700\u8981\u5728\u9a8c\u8bc1\u96c6\u6821\u51c6\u3002<\/p>\n

                          \u6838\u5fc3\u601d\u60f3\u662f：<\/p>\n

                          \u533a\u5206\u4e0d\u540c\u6765\u6e90\u7684\u7ed3\u6784\u8bc1\u636e，\u800c\u4e0d\u662f\u628a\u6240\u6709 Edge \u5f53\u6210\u7b49\u4ef7\u4e8b\u5b9e\u3002<\/p>\n

                          \n

                          21. \u56fe\u4e0d\u786e\u5b9a\u65f6\u5e94\u8be5\u4e3b\u52a8\u6269\u5927\u641c\u7d22\u8303\u56f4<\/h3>\n

                          \u4f8b\u5982\u521d\u59cb\u7ed3\u6784\u68c0\u7d22：<\/p>\n

                          N2(q)
                          \nN_2(q)
                          \n<\/span><\/span>N<\/span><\/span>2<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>(<\/span>q<\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                          \u53ea\u5f97\u5230\u5f88\u5c11\u5019\u9009\u3002<\/p>\n

                          \u540c\u65f6 Call Graph Confidence \u5f88\u4f4e\u3002<\/p>\n

                          \u7cfb\u7edf\u53ef\u4ee5\u6267\u884c：<\/p>\n

                          Structural Confidence Low
                          \n\u2193
                          \nFallback
                          \n\u2193
                          \nDense \/ Lexical Candidate Expansion<\/p>\n

                          \u800c\u4e0d\u662f\u7acb\u5373\u5f97\u51fa：<\/p>\n

                          \u6ca1\u6709\u76f8\u5173\u4ee3\u7801<\/p>\n

                          \u8fd9\u79cd\u7b56\u7565\u53ef\u4ee5\u79f0\u4e3a：<\/p>\n

                          Uncertainty-Aware Retrieval<\/p>\n

                          \n

                          22. Runtime Trace \u53ef\u4ee5\u7528\u6765\u8865\u7ed3\u6784，\u4f46\u4e0d\u80fd\u5f53\u5b8c\u6574\u771f\u503c<\/h3>\n

                          \u52a8\u6001\u5206\u6790\u53ef\u4ee5\u5b9e\u9645\u89c2\u5bdf：<\/p>\n

                          \u8fd9\u4e00\u6b21\u8fd0\u884c<\/p>\n

                          \u53d1\u751f\u4e86\u54ea\u4e9b\u8c03\u7528\u3002<\/p>\n

                          \u56e0\u6b64\u53ef\u4ee5\u8865\u5145 Static Call Graph：<\/p>\n

                          $$
                          \nG_{\\\\text{hybrid}}<\/h2>\n

                          G_{\\\\text{static}}
                          \n\\\\cup
                          \nG_{\\\\text{dynamic}}
                          \n$$<\/p>\n

                          \u4f18\u70b9：<\/p>\n

                            \n
                          • \u80fd\u770b\u5230\u771f\u5b9e Reflection；<\/li>\n
                          • \u80fd\u770b\u5230\u771f\u5b9e Callback；<\/li>\n
                          • \u80fd\u770b\u5230\u771f\u5b9e Runtime Dispatch\u3002<\/li>\n<\/ul>\n

                            \u4f46\u5b83\u4e5f\u5b58\u5728 Coverage \u95ee\u9898\u3002<\/p>\n

                            \u5982\u679c\u6d4b\u8bd5\u6ca1\u6709\u89e6\u53d1：<\/p>\n

                            \u67d0\u4e2a\u6f0f\u6d1e\u8def\u5f84<\/p>\n

                            Dynamic Trace \u5c31\u4e0d\u4f1a\u5305\u542b\u5b83\u3002<\/p>\n

                            \u56e0\u6b64：<\/p>\n

                            Dynamic Edge\u4e0d\u5b58\u5728<\/p>\n

                            \u4e0d\u80fd\u8bc1\u660e：<\/p>\n

                            Runtime\u6c38\u8fdc\u4e0d\u53ef\u80fd\u53d1\u751f<\/p>\n

                            \u66f4\u5408\u7406\u7684\u662f\u9759\u6001\u548c\u52a8\u6001\u8bc1\u636e\u4e92\u8865\u3002<\/p>\n

                            \n

                            23. \u5982\u4f55\u5224\u65ad Call Graph \u662f\u5426\u771f\u7684\u662f\u7cfb\u7edf\u74f6\u9888<\/h3>\n

                            \u5fc5\u987b\u505a Oracle Graph \u5b9e\u9a8c\u3002<\/p>\n

                            \u6784\u5efa\u4e00\u4e2a\u66f4\u9ad8\u8d28\u91cf\u7684：<\/p>\n

                            Goracle
                            \nG_{\\\\text{oracle}}
                            \n<\/span><\/span>G<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                            \u4f8b\u5982\u6765\u81ea：<\/p>\n

                              \n
                            • \u4eba\u5de5\u6807\u6ce8；<\/li>\n
                            • \u52a8\u6001 Trace；<\/li>\n
                            • \u4e13\u7528 Framework Model；<\/li>\n
                            • Ground Truth Benchmark\u3002<\/li>\n<\/ul>\n

                              \u7136\u540e\u56fa\u5b9a：<\/p>\n

                                \n
                              • Embedding；<\/li>\n
                              • Retriever；<\/li>\n
                              • Reranker；<\/li>\n
                              • Generator；<\/li>\n
                              • Token Budget；<\/li>\n<\/ul>\n

                                \u53ea\u66ff\u6362：<\/p>\n

                                Gnormal
                                \nG_{\\\\text{normal}}
                                \n<\/span><\/span>G<\/span><\/span>normal<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \u4e3a：<\/p>\n

                                Goracle
                                \nG_{\\\\text{oracle}}
                                \n<\/span><\/span>G<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \u6bd4\u8f83：<\/p>\n

                                M(Gnormal)
                                \nM(G_{\\\\text{normal}})
                                \n<\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>normal<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \u548c：<\/p>\n

                                M(Goracle)
                                \nM(G_{\\\\text{oracle}})
                                \n<\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \n

                                24. Oracle Graph \u7684\u7ed3\u679c\u600e\u4e48\u89e3\u91ca<\/h3>\n

                                \u5982\u679c：<\/p>\n

                                M(Goracle)\u226bM(Gnormal)
                                \nM(G_{\\\\text{oracle}})
                                \n\\\\gg
                                \nM(G_{\\\\text{normal}})
                                \n<\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span>\u226b<\/span><\/span><\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>normal<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \u8bf4\u660e：<\/p>\n

                                Graph Quality \u662f\u4e3b\u8981\u74f6\u9888\u3002<\/p>\n

                                \u5982\u679c：<\/p>\n

                                M(Goracle)\u2248M(Gnormal)
                                \nM(G_{\\\\text{oracle}})
                                \n\\\\approx
                                \nM(G_{\\\\text{normal}})
                                \n<\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span>\u2248<\/span><\/span><\/span><\/span>M<\/span>(<\/span>G<\/span><\/span>normal<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                \u5219\u7ee7\u7eed\u4f18\u5316 Call Graph \u7684\u6536\u76ca\u53ef\u80fd\u6709\u9650\u3002<\/p>\n

                                \u74f6\u9888\u53ef\u80fd\u5728：<\/p>\n

                                  \n
                                • Embedding；<\/li>\n
                                • Relevant Evidence Definition；<\/li>\n
                                • Reranker；<\/li>\n
                                • Context Assembly；<\/li>\n
                                • Generator\u3002<\/li>\n<\/ul>\n

                                  \u8fd9\u6b63\u662f\u4e3a\u4ec0\u4e48\u4e0d\u80fd\u4ec5\u51ed：<\/p>\n

                                  \u9759\u6001\u5206\u6790\u53ef\u80fd\u4e0d\u5b8c\u6574<\/p>\n

                                  \u5c31\u628a\u6240\u6709\u5931\u8d25\u90fd\u5f52\u56e0\u4e8e Graph\u3002<\/p>\n

                                  \n

                                  25. \u8fd8\u5e94\u8be5\u4e3b\u52a8\u505a Edge Deletion \u5b9e\u9a8c<\/h3>\n

                                  \u4ece\u9ad8\u8d28\u91cf\u56fe：<\/p>\n

                                  G\u2217
                                  \nG^*
                                  \n<\/span><\/span>G<\/span><\/span>\u2217<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u968f\u673a\u6216\u6309\u7c7b\u578b\u5220\u9664：<\/p>\n

                                  p%
                                  \np\\\\%
                                  \n<\/span><\/span>p<\/span>%<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u7684\u771f\u5b9e Edge\u3002<\/p>\n

                                  \u5f97\u5230：<\/p>\n

                                  Gp\u2212
                                  \nG^-_p
                                  \n<\/span><\/span>G<\/span><\/span>p<\/span><\/span><\/span><\/span>\u2212<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u4f8b\u5982：<\/p>\n

                                  p\u2208{5%,10%,20%,40%}
                                  \np\\\\in\\\\{5\\\\%,10\\\\%,20\\\\%,40\\\\%\\\\}
                                  \n<\/span><\/span>p<\/span><\/span>\u2208<\/span><\/span><\/span><\/span>{<\/span>5%<\/span>,<\/span><\/span>10%<\/span>,<\/span><\/span>20%<\/span>,<\/span><\/span>40%<\/span>}<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u7136\u540e\u6d4b：<\/p>\n

                                  Recall@K(Gp\u2212)
                                  \nRecall@K(G^-_p)
                                  \n<\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span>@<\/span>K<\/span>(<\/span>G<\/span><\/span>p<\/span><\/span><\/span><\/span>\u2212<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u4ee5\u53ca：<\/p>\n

                                  F1(Gp\u2212)
                                  \nF1(G^-_p)
                                  \n<\/span><\/span>F<\/span>1<\/span>(<\/span>G<\/span><\/span>p<\/span><\/span><\/span><\/span>\u2212<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>)<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u5f97\u5230\u9c81\u68d2\u6027\u66f2\u7ebf：<\/p>\n

                                  $$
                                  \nMetric<\/h2>\n

                                  f(MissingEdgeRate)
                                  \n$$<\/p>\n

                                  \u8fd9\u53ef\u4ee5\u76f4\u63a5\u56de\u7b54：<\/p>\n

                                  Call Graph \u6f0f\u6389\u591a\u5c11\u8fb9\u4ee5\u540e\u7ed3\u6784\u68c0\u7d22\u5f00\u59cb\u4e0d\u53ef\u63a5\u53d7？<\/p>\n

                                  \n

                                  26. Spurious Edge \u4e5f\u9700\u8981\u5355\u72ec\u6d4b\u8bd5<\/h3>\n

                                  \u5411 Oracle Graph \u4e2d\u52a0\u5165：<\/p>\n

                                  q%
                                  \nq\\\\%
                                  \n<\/span><\/span>q<\/span>%<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u968f\u673a\u6216\u5177\u6709\u8ff7\u60d1\u6027\u7684\u9519\u8bef Edge：<\/p>\n

                                  Gq+
                                  \nG^+_q
                                  \n<\/span><\/span>G<\/span><\/span>q<\/span><\/span><\/span><\/span>+<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u4f8b\u5982\u4f18\u5148\u52a0\u5165：<\/p>\n

                                  \u540cAPI\u4f46\u5b89\u5168\u7ed3\u8bba\u4e0d\u540c<\/p>\n

                                  \u7684 Hard Spurious Edge\u3002<\/p>\n

                                  \u7136\u540e\u89c2\u5bdf：<\/p>\n

                                  Precision@K
                                  \nPrecision@K
                                  \n<\/span><\/span>P<\/span>r<\/span>ec<\/span>i<\/span>s<\/span>i<\/span>o<\/span>n<\/span>@<\/span>K<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  NDCG@K
                                  \nNDCG@K
                                  \n<\/span><\/span>N<\/span>D<\/span>C<\/span>G<\/span>@<\/span>K<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  TokenCost
                                  \nTokenCost
                                  \n<\/span><\/span>T<\/span>o<\/span>k<\/span>e<\/span>n<\/span>C<\/span>os<\/span>t<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  EndToEndF1
                                  \nEndToEndF1
                                  \n<\/span><\/span>E<\/span>n<\/span>d<\/span>T<\/span>o<\/span>E<\/span>n<\/span>d<\/span>F<\/span>1<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u7684\u53d8\u5316\u3002<\/p>\n

                                  \u8fd9\u6837\u53ef\u4ee5\u533a\u5206：<\/p>\n

                                  \u7cfb\u7edf\u66f4\u6015\u6f0f\u8fb9<\/p>\n

                                  \u8fd8\u662f：<\/p>\n

                                  \u7cfb\u7edf\u66f4\u6015\u9519\u8bef\u6269\u5f20<\/p>\n

                                  \n

                                  27. \u52a8\u6001\u5206\u6d3e\u5fc5\u987b\u5355\u72ec\u505a Error Slice<\/h3>\n

                                  \u603b\u4f53\u5e73\u5747\u503c\u4f1a\u63a9\u76d6\u95ee\u9898\u3002<\/p>\n

                                  \u6211\u4f1a\u628a\u6d4b\u8bd5\u6837\u672c\u5207\u6210：<\/p>\n

                                  Direct Call
                                  \nVirtual Dispatch
                                  \nReflection
                                  \nCallback
                                  \nFunction Pointer
                                  \nDependency Injection
                                  \nRPC
                                  \nNative Boundary<\/p>\n

                                  \u7136\u540e\u5206\u522b\u62a5\u544a：<\/p>\n

                                  Recall@Kc
                                  \nRecall@K_c
                                  \n<\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span>@<\/span>K<\/span><\/span>c<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  F1c
                                  \nF1_c
                                  \n<\/span><\/span>F<\/span>1<\/span><\/span>c<\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u5176\u4e2d：<\/p>\n

                                  c
                                  \nc
                                  \n<\/span><\/span>c<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u8868\u793a\u4e0d\u540c\u52a8\u6001\u7279\u5f81\u3002<\/p>\n

                                  \u5982\u679c：<\/p>\n

                                  Direct Call F1 = \u5f88\u9ad8
                                  \nReflection F1 = \u5f88\u4f4e<\/p>\n

                                  \u5c31\u80fd\u660e\u786e\u8bf4\u660e：<\/p>\n

                                  \u7ed3\u6784\u68c0\u7d22\u7684\u4e3b\u8981\u8fb9\u754c\u6765\u81ea\u52a8\u6001\u5efa\u6a21，\u800c\u4e0d\u662f\u4e00\u822c Retrieval \u80fd\u529b\u3002<\/p>\n

                                  \n

                                  28. \u8fd8\u53ef\u4ee5\u76f4\u63a5\u8bc4\u6d4b Graph Edge Quality<\/h3>\n

                                  \u5982\u679c\u80fd\u591f\u83b7\u5f97\u90e8\u5206 Ground Truth Call Edge：<\/p>\n

                                  E\u2217
                                  \nE^*
                                  \n<\/span><\/span>E<\/span><\/span>\u2217<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u62a5\u544a：<\/p>\n

                                  Precisionedge
                                  \nPrecision_{edge}
                                  \n<\/span><\/span>P<\/span>r<\/span>ec<\/span>i<\/span>s<\/span>i<\/span>o<\/span>n<\/span><\/span>e<\/span>d<\/span>g<\/span>e<\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  Recalledge
                                  \nRecall_{edge}
                                  \n<\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span><\/span>e<\/span>d<\/span>g<\/span>e<\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u7136\u540e\u5206\u6790：<\/p>\n

                                  Recalledge\u2192Recall@K\u2192TaskF1
                                  \nRecall_{edge}
                                  \n\\\\rightarrow
                                  \nRecall@K
                                  \n\\\\rightarrow
                                  \nTaskF1
                                  \n<\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span><\/span>e<\/span>d<\/span>g<\/span>e<\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2192<\/span><\/span><\/span><\/span>R<\/span>ec<\/span>a<\/span>l<\/span>l<\/span>@<\/span>K<\/span><\/span>\u2192<\/span><\/span><\/span><\/span>T<\/span>a<\/span>s<\/span>k<\/span>F<\/span>1<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                  \u4e09\u8005\u5173\u7cfb\u3002<\/p>\n

                                  \u771f\u6b63\u5e0c\u671b\u8bc1\u660e\u7684\u662f：<\/p>\n

                                  Graph Quality Improvement
                                  \n\u2193
                                  \nRelevant Evidence Recall Improvement
                                  \n\u2193
                                  \nVulnerability Detection Improvement<\/p>\n

                                  \u800c\u4e0d\u662f\u53ea\u62a5\u544a：<\/p>\n

                                  Call Graph\u591a\u627e\u5230\u4e861000\u6761\u8fb9<\/p>\n

                                  \u56e0\u4e3a\u66f4\u591a Edge \u53ef\u80fd\u5168\u90e8\u662f Noise\u3002<\/p>\n

                                  \n

                                  29. \u4e00\u4e2a\u5b8c\u6574\u7684\u8bca\u65ad\u77e9\u9635<\/h3>\n

                                  \u6211\u4f1a\u81f3\u5c11\u6bd4\u8f83：<\/p>\n\n\u65b9\u6cd5\u7528\u9014<\/tr>\n\n\n\n\n\n\n\n\n\n\n\n
                                  Dense-only<\/td>\n\u4e0d\u4f7f\u7528\u7ed3\u6784\u7684\u5f3a\u57fa\u7ebf<\/td>\n<\/tr>\n
                                  Lexical + Dense<\/td>\n\u975e\u7ed3\u6784 Hybrid Baseline<\/td>\n<\/tr>\n
                                  CG-only<\/td>\n\u68c0\u9a8c Call Graph \u5355\u72ec\u4ef7\u503c<\/td>\n<\/tr>\n
                                  DFG-only<\/td>\n\u68c0\u9a8c Data Flow \u5355\u72ec\u4ef7\u503c<\/td>\n<\/tr>\n
                                  Dense + CG<\/td>\n\u6d4b Call Graph \u589e\u91cf<\/td>\n<\/tr>\n
                                  Dense + DFG<\/td>\n\u6d4b DFG \u589e\u91cf<\/td>\n<\/tr>\n
                                  Dense + CG + DFG<\/td>\n\u5b8c\u6574\u7ed3\u6784\u7cfb\u7edf<\/td>\n<\/tr>\n
                                  Oracle CG\/DFG<\/td>\n\u4f30\u8ba1\u7ed3\u6784\u4e0a\u9650<\/td>\n<\/tr>\n
                                  Missing-Edge Graph<\/td>\n\u6d4b\u6f0f\u8fb9\u9c81\u68d2\u6027<\/td>\n<\/tr>\n
                                  Spurious-Edge Graph<\/td>\n\u6d4b\u4f2a\u8fb9\u9c81\u68d2\u6027<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                                  \u540c\u65f6\u56fa\u5b9a：<\/p>\n

                                    \n
                                  • Dataset；<\/li>\n
                                  • Query；<\/li>\n
                                  • Evidence Corpus；<\/li>\n
                                  • Embedding；<\/li>\n
                                  • Reranker；<\/li>\n
                                  • Generator；<\/li>\n
                                  • Top-K；<\/li>\n
                                  • Context Budget\u3002<\/li>\n<\/ul>\n

                                    \u8fd9\u6837\u624d\u80fd\u9694\u79bb\u7ed3\u6784\u4fe1\u606f\u7684\u771f\u6b63\u8d21\u732e\u3002<\/p>\n

                                    \n

                                    30. \u4ec0\u4e48\u7ed3\u679c\u4f1a\u63a8\u7ffb\u201c\u7ed3\u6784\u68c0\u7d22\u6709\u6548\u201d\u7684\u4e3b\u5f20<\/h3>\n

                                    \u5982\u679c\u6211\u8981\u58f0\u79f0：<\/p>\n

                                    Call Graph \/ DFG \u7ed3\u6784\u4fe1\u606f\u63d0\u9ad8\u4e86\u6f0f\u6d1e\u68c0\u7d22\u80fd\u529b\u3002<\/p>\n

                                    \u90a3\u4e48\u5fc5\u987b\u63a5\u53d7\u4e0b\u9762\u8fd9\u4e9b\u53cd\u8bc1\u3002<\/p>\n

                                    30.1 Dense-only \u8fbe\u5230\u76f8\u540c\u7ed3\u679c<\/h4>\n

                                    \u5982\u679c：<\/p>\n

                                    Mdense\u2248Mstructure
                                    \nM_{\\\\text{dense}}
                                    \n\\\\approx
                                    \nM_{\\\\text{structure}}
                                    \n<\/span><\/span>M<\/span><\/span>dense<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2248<\/span><\/span><\/span><\/span>M<\/span><\/span>structure<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                    \u5219\u7ed3\u6784\u4fe1\u606f\u6ca1\u6709\u8bc1\u660e\u72ec\u7acb\u589e\u91cf\u3002<\/p>\n

                                    30.2 Oracle Graph \u4e5f\u6ca1\u6709\u63d0\u5347<\/h4>\n

                                    \u5982\u679c：<\/p>\n

                                    Moracle\u2248Mno-graph
                                    \nM_{\\\\text{oracle}}
                                    \n\\\\approx
                                    \nM_{\\\\text{no-graph}}
                                    \n<\/span><\/span>M<\/span><\/span>oracle<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u2248<\/span><\/span><\/span><\/span>M<\/span><\/span>no-graph<\/span><\/span><\/span><\/span><\/span><\/span>\u200b<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n

                                    \u8bf4\u660e\u5f53\u524d\u4efb\u52a1\u53ef\u80fd\u6839\u672c\u4e0d\u4f9d\u8d56\u7ed3\u6784\u5173\u7cfb\u3002<\/p>\n

                                    30.3 \u52a8\u6001\u8c03\u7528\u6837\u672c\u6027\u80fd\u4e25\u91cd\u5d29\u6e83<\/h4>\n

                                    \u8bf4\u660e\u65b9\u6cd5\u9002\u7528\u8303\u56f4\u53ea\u80fd\u9650\u5b9a\u4e8e：<\/p>\n

                                    \u9759\u6001\u8c03\u7528\u5173\u7cfb\u8f83\u660e\u786e\u7684\u4ee3\u7801<\/p>\n

                                    \u4e0d\u80fd\u58f0\u79f0\u666e\u904d\u4ee3\u7801\u5e93\u6cdb\u5316\u3002<\/p>\n

                                    30.4 \u5c11\u91cf Missing Edge \u5c31\u5bfc\u81f4\u6027\u80fd\u5d29\u6e83<\/h4>\n

                                    \u8bf4\u660e\u7cfb\u7edf\u5bf9\u9759\u6001\u5206\u6790\u8bef\u5dee\u8fc7\u5ea6\u654f\u611f，\u4e0d\u9002\u5408\u771f\u5b9e\u5de5\u7a0b\u73af\u5883\u3002<\/p>\n

                                    30.5 Spurious Edge \u589e\u52a0\u540e LLM \u88ab\u4e25\u91cd\u5e26\u504f<\/h4>\n

                                    \u8bf4\u660e\u7ed3\u6784 Over-Approximation \u4f1a\u4ea7\u751f\u4e0d\u53ef\u63a5\u53d7\u566a\u58f0\u3002<\/p>\n

                                    \u8fd9\u65f6\u9700\u8981 Hybrid Retrieval \u6216\u66f4\u4e25\u683c\u7684 Reranking\u3002<\/p>\n

                                    \n

                                    31. \u5f53\u524d\u8d44\u6599\u80fd\u591f\u8bc1\u660e\u5230\u4ec0\u4e48\u7a0b\u5ea6<\/h3>\n

                                    \u6839\u636e\u539f\u8868，\u76ee\u524d\u53ea\u80fd\u786e\u5b9a：<\/p>\n

                                  • \u8fd9\u4e2a\u95ee\u9898\u5fc5\u987b\u901a\u8fc7\u7ed3\u6784\u68c0\u7d22\u7684\u5206\u5c42\u5b9e\u9a8c\u56de\u7b54；<\/li>\n
                                  • \u5e94\u4f7f\u7528 Exact \/ Oracle\u3001\u9519\u8bef\u5207\u7247\u548c End-to-End Intervention \u533a\u5206\u74f6\u9888；<\/li>\n
                                  • \u4e0d\u80fd\u628a\u7ed3\u6784\u68c0\u7d22\u6709\u6548\u6027\u4f5c\u4e3a\u5148\u9a8c\u7ed3\u8bba\u3002<\/li>\n

                                    \u5f53\u524d\u8d44\u6599\u6ca1\u6709\u63d0\u4f9b：<\/p>\n

                                      \n
                                    • Call Graph Edge Recall；<\/li>\n
                                    • DFG Recall；<\/li>\n
                                    • Dynamic Dispatch Slice；<\/li>\n
                                    • Oracle Graph Result；<\/li>\n
                                    • Missing-Edge Ablation；<\/li>\n
                                    • Spurious-Edge Ablation；<\/li>\n
                                    • \u7ed3\u6784\u68c0\u7d22\u76f8\u5bf9 Dense Baseline \u7684\u771f\u5b9e\u63d0\u5347\u3002<\/li>\n<\/ul>\n

                                      \u56e0\u6b64\u8fd9\u4e9b\u5b9e\u9a8c\u5982\u679c\u5c1a\u672a\u5b8c\u6210，\u90fd\u5e94\u8be5\u660e\u786e\u6807\u4e3a：<\/p>\n

                                      \u5f85\u8865\u5b9e\u9a8c\u3002<\/p>\n

                                      \u4e0d\u80fd\u865a\u6784\u5df2\u7ecf\u83b7\u5f97\u7684\u6570\u503c\u7ed3\u679c\u3002<\/p>\n

                                      \n

                                      32. \u9762\u8bd5\u65f6\u53ef\u4ee5\u538b\u7f29\u6210\u4e0b\u9762\u8fd9\u6bb5<\/h3>\n

                                      Call Graph \u548c DFG \u672c\u8d28\u4e0a\u90fd\u662f\u9759\u6001\u8fd1\u4f3c，\u6240\u4ee5\u7ed3\u6784\u68c0\u7d22\u9996\u5148\u53d7\u5230\u56fe\u8d28\u91cf\u9650\u5236\u3002<\/p>\n

                                      \u5982\u679c\u56fe\u6f0f\u6389\u771f\u5b9e Call Edge \u6216 Data-Flow Edge，\u5173\u952e\u51fd\u6570\u6216 source-sink \u8def\u5f84\u53ef\u80fd\u5728\u7ed3\u6784\u56fe\u4e0a\u4e0d\u53ef\u8fbe，\u5019\u9009\u751f\u6210\u9636\u6bb5\u5c31\u4f1a\u6f0f\u6389\u8bc1\u636e，\u540e\u9762\u7684 Reranker \u548c LLM \u65e0\u6cd5\u6062\u590d；\u53cd\u8fc7\u6765，\u5982\u679c\u4e3a\u4e86 Soundness \u52a0\u5165\u592a\u591a\u53ef\u80fd\u8c03\u7528\u8fb9，\u53c8\u4f1a\u628a\u5927\u91cf\u65e0\u5173\u51fd\u6570\u5e26\u5165\u5019\u9009\u96c6，\u4f7f Precision \u4e0b\u964d\u3001\u4e0a\u4e0b\u6587\u53d8\u566a\u3001Token \u548c\u5ef6\u8fdf\u589e\u52a0\u3002<\/p>\n

                                      \u52a8\u6001\u5206\u6d3e\u662f\u5178\u578b\u56f0\u96be\u3002\u4f8b\u5982 Java virtual call \u7684\u771f\u5b9e\u76ee\u6807\u53d6\u51b3\u4e8e runtime type，\u56e0\u6b64\u9700\u8981 CHA\u3001RTA \u6216 points-to analysis \u63a8\u65ad；Reflection\u3001Framework Callback\u3001Dependency Injection\u3001Function Pointer\u3001RPC \u7b49\u673a\u5236\u4f1a\u8fdb\u4e00\u6b65\u4ea7\u751f\u666e\u901a\u8bed\u6cd5 Call Graph \u770b\u4e0d\u5230\u7684\u9690\u5f0f Edge\u3002<\/p>\n

                                      \u6240\u4ee5\u6211\u4e0d\u4f1a\u628a\u7ed3\u6784\u56fe\u4f5c\u4e3a Hard Filter，\u800c\u4f1a\u7528 lexical\u3001dense \u548c structural \u4e09\u8def\u53ec\u56de\u3002\u7ed3\u6784\u5173\u7cfb\u4f5c\u4e3a Reranking Feature；\u56fe\u7684\u7f6e\u4fe1\u5ea6\u8f83\u4f4e\u65f6\u56de\u9000\u5230 dense\/lexical \u641c\u7d22，\u907f\u514d Missing Edge \u9020\u6210\u4e0d\u53ef\u6062\u590d\u7684\u6f0f\u53ec\u56de\u3002<\/p>\n

                                      \u9a8c\u8bc1\u4e0a，\u6211\u4f1a\u5148\u7528 Oracle Call Graph\/DFG \u6d4b\u7ed3\u6784\u4fe1\u606f\u7684\u7406\u8bba\u4e0a\u9650，\u7136\u540e\u5206\u522b\u505a Edge Deletion \u548c Edge Injection，\u6a21\u62df Missing Edge \u4e0e Spurious Edge，\u518d\u5bf9 Virtual Dispatch\u3001Reflection\u3001Callback\u3001Function Pointer\u3001RPC \u7b49\u52a8\u6001\u7279\u5f81\u5355\u72ec\u5207\u7247\u3002<\/p>\n

                                      \u6700\u7ec8\u540c\u65f6\u62a5\u544a Graph Edge Precision\/Recall\u3001Retrieval Recall@K\/NDCG \u548c End-to-End Vulnerability F1\u3002\u5982\u679c Oracle Graph \u660e\u663e\u63d0\u5347\u7ed3\u679c，\u8bf4\u660e\u56fe\u8d28\u91cf\u662f\u74f6\u9888；\u5982\u679c Oracle Graph \u4e5f\u6ca1\u6709\u6536\u76ca，\u5219\u95ee\u9898\u66f4\u53ef\u80fd\u5728 Embedding\u3001Reranker \u6216 Generator\u3002\u8fd9\u6837\u624d\u80fd\u771f\u6b63\u8bc1\u660e\u7ed3\u6784\u68c0\u7d22\u7684\u8d21\u732e\u548c\u9002\u7528\u8fb9\u754c\u3002<\/p>\n

                                      \n

                                      33. \u6765\u6e90<\/h3>\n
                                    • GitHub CodeQL Documentation, Navigating the Call Graph：\u533a\u5206 calls \u4e0e\u8003\u8651\u8fd0\u884c\u65f6\u591a\u6001\u76ee\u6807\u7684 polyCalls，\u8bf4\u660e virtual dispatch \u4e0b\u9759\u6001 callee \u4e0e\u53ef\u80fd runtime callee \u5e76\u4e0d\u76f8\u540c\u3002<\/li>\n
                                    • GitHub CodeQL Documentation, Analyzing Data Flow in C\/C++ \/ JavaScript \/ Python：\u8bf4\u660e Global Data Flow \u80fd\u8de8\u8fc7\u7a0b\u5206\u6790，\u4f46\u901a\u5e38\u6bd4 Local Data Flow \u66f4\u4e0d\u7cbe\u786e，\u53ef\u80fd\u4ea7\u751f\u5b9e\u9645\u4e0d\u4f1a\u53d1\u751f\u7684 spurious flows，\u4e14\u9700\u8981\u56f4\u7ed5\u7279\u5b9a source\/sink \u5efa\u6a21\u3002<\/li>\n
                                    • GitHub CodeQL Documentation, Creating Path Queries：Path Query \u9700\u8981\u660e\u786e source\u3001sink \u4ee5\u53ca\u8fde\u63a5\u4e24\u8005\u7684\u6570\u636e\u6d41 edge，\u56e0\u6b64\u5173\u952e flow edge \u7f3a\u5931\u4f1a\u4f7f\u5b8c\u6574\u8def\u5f84\u65e0\u6cd5\u6062\u590d\u3002<\/li>\n
                                    • Soot\/SootUp Documentation, Spark \/ PointsToAnalysis \/ Call Graph：Spark \u5c06 Points-to Analysis \u4e0e Call Graph Construction \u7ed3\u5408，\u5e76\u652f\u6301\u57fa\u4e8e points-to information \u7684 on-the-fly call graph\u3002<\/li>\n
                                    • Samhi et al., Call Graph Soundness in Android Static Analysis, 2024：\u5b9e\u8bc1\u7814\u7a76\u663e\u793a\u5b9e\u9645\u9759\u6001\u5206\u6790\u5668\u53ef\u80fd\u6f0f\u6389\u5927\u91cf\u8fd0\u884c\u65f6\u5b9e\u9645\u6267\u884c\u7684\u65b9\u6cd5，Framework\u3001Reflection \u4e0e\u5165\u53e3\u70b9\u5efa\u6a21\u662f\u91cd\u8981\u56f0\u96be\u6765\u6e90\u3002<\/li>\n
                                    • Bodden et al., Jasmine: A Static Analysis Framework for Spring Core Technologies, ASE 2022：Spring \u7684 Dependency Injection\u3001AOP \u7b49\u52a8\u6001\u673a\u5236\u4f1a\u6311\u6218\u4f20\u7edf\u9759\u6001 Call Graph，\u4e13\u95e8 Framework Modeling \u80fd\u63d0\u9ad8\u8c03\u7528\u56fe\u5b8c\u6574\u6027\u3002<\/li>\n
                                    • Static Analysis of Remote Procedure Call in Java Programs \/ RPCBridge, ICSE 2025：\u8bf4\u660e RPC \u4f1a\u5f62\u6210\u666e\u901a\u9759\u6001\u5206\u6790\u65e0\u6cd5\u76f4\u63a5\u7a7f\u900f\u7684\u8de8\u8fdb\u7a0b\u8c03\u7528\u5173\u7cfb；\u8865\u5145 RPC Edge \u540e\u53ef\u4ee5\u6062\u590d\u66f4\u591a\u8de8\u6a21\u5757\u6570\u636e\u6d41\u3002<\/li>\n","protected":false},"excerpt":{"rendered":"

                                      \u7b2c122\u9898：Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6，\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25？1. \u6838\u5fc3\u56de\u7b54
                                      \n\u5982\u679c\u7ed3\u6784\u68c0\u7d22\u4f9d\u8d56 Call Graph \u6216 Data-Flow Graph，\u90a3\u4e48\u5b83\u7684\u6027\u80fd\u4e0a\u9650\u9996\u5148\u53d7\u7ed3\u6784\u56fe\u8d28\u91cf\u7ea6\u675f\u3002
                                      \n\u6211\u4f1a\u628a\u56fe\u9519\u8bef\u5206\u6210\u4e24\u4e2a\u65b9\u5411：
                                      \nMissing Edge \/ False Negative Edge：\u771f\u5b9e\u8c03\u7528\u6216\u6570\u636e\u6d41\u8fb9\u6ca1\u6709\u88ab\u9759\u6001\u5206\u6790\u6062\u590d；Spurious Edg<\/p>\n","protected":false},"author":2,"featured_media":106617,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[11820,346,4119,275,61,78],"topic":[],"class_list":["post-106618","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-atomgit","tag-embedding","tag-rag","tag-web","tag-61","tag-78"],"yoast_head":"\nCall Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/106618.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u7b2c122\u9898：Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6，\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25？1. \u6838\u5fc3\u56de\u7b54 \u5982\u679c\u7ed3\u6784\u68c0\u7d22\u4f9d\u8d56 Call Graph \u6216 Data-Flow Graph，\u90a3\u4e48\u5b83\u7684\u6027\u80fd\u4e0a\u9650\u9996\u5148\u53d7\u7ed3\u6784\u56fe\u8d28\u91cf\u7ea6\u675f\u3002 \u6211\u4f1a\u628a\u56fe\u9519\u8bef\u5206\u6210\u4e24\u4e2a\u65b9\u5411： Missing Edge \/ False Negative Edge：\u771f\u5b9e\u8c03\u7528\u6216\u6570\u636e\u6d41\u8fb9\u6ca1\u6709\u88ab\u9759\u6001\u5206\u6790\u6062\u590d；Spurious Edg\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/106618.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T11:56:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260917115637-6aabd575ba59d.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/106618.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/106618.html\",\"name\":\"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-17T11:56:39+00:00\",\"dateModified\":\"2026-09-17T11:56:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/106618.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/106618.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/106618.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/106618.html","og_locale":"zh_CN","og_type":"article","og_title":"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u7b2c122\u9898：Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6，\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25？1. \u6838\u5fc3\u56de\u7b54 \u5982\u679c\u7ed3\u6784\u68c0\u7d22\u4f9d\u8d56 Call Graph \u6216 Data-Flow Graph，\u90a3\u4e48\u5b83\u7684\u6027\u80fd\u4e0a\u9650\u9996\u5148\u53d7\u7ed3\u6784\u56fe\u8d28\u91cf\u7ea6\u675f\u3002 \u6211\u4f1a\u628a\u56fe\u9519\u8bef\u5206\u6210\u4e24\u4e2a\u65b9\u5411： Missing Edge \/ False Negative Edge：\u771f\u5b9e\u8c03\u7528\u6216\u6570\u636e\u6d41\u8fb9\u6ca1\u6709\u88ab\u9759\u6001\u5206\u6790\u6062\u590d；Spurious Edg","og_url":"https:\/\/www.wsisp.com\/helps\/106618.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-17T11:56:39+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260917115637-6aabd575ba59d.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"10 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/106618.html","url":"https:\/\/www.wsisp.com\/helps\/106618.html","name":"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-17T11:56:39+00:00","dateModified":"2026-09-17T11:56:39+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/106618.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/106618.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/106618.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Call Graph \/ DFG \u4e0d\u5b8c\u6574\u6216\u5b58\u5728\u52a8\u6001\u5206\u6d3e\u65f6\uff0c\u7ed3\u6784\u68c0\u7d22\u4f1a\u600e\u6837\u5931\u8d25\uff1f"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/106618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=106618"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/106618\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/106617"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=106618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=106618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=106618"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=106618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}