Static and Dynamic Code Analysis Framework for Early Detection of Security Weaknesses

Abstract

Software security weaknesses can remain hidden when source code and runtime behaviour are examined separately. This study presents a combined static and dynamic code analysis framework for early security weakness detection. The framework integrates static scanning, data-flow analysis, runtime instrumentation, guided test execution, and evidence correlation. It examines unsafe input handling, insecure API use, data exposure, authentication failure, memory or resource misuse, and exception behaviour. The proposed method was compared with static-only and dynamic-only analysis across successive detection stages. Results showed that the combined framework achieved a cumulative weakness detection rate of 96.4%, compared with 76.4% for staticonly analysis and 78.3% for dynamic-only analysis. Correlating source-code warnings with observed runtime events improved confidence and reduced isolated false warnings. The framework can support earlier remediation, better review prioritization, and more reliable security assessment before software release within modern software development pipelines.