# Automated Code-Smell Detection in Microservices Through Static Analysis: A Case Study
## 4 Code Analysis and Extension for Enterprise Architectures  
Static code analysis [53] is one of the most important software development topics, primarily its role in detecting bugs in a system. However, as with most other problem domains, there exist gaps around enterprise architectures. The two static code analysis processes, source code and bytecode analysis, ultimately create a representation of the application. This is done through several processes, including recognizing components, classes, methods, fields, or annotations, tokenization, and parsing, which produce graph representations of the code. These include Abstract Syntax Trees (AST), Control-Flow Graphs (CFG) [54; 55; 56], or Program Dependency Graphs (PDG) [57; 58].  
_Bytecode analysis_[59] uses the application's compiled code and is useful in uncovering endpoints, components, authorization policy enforcements, classes, and methods. It can augment or derive CFG or AST [60; 61; 62]. However, the disadvantage is that not all languages have a bytecode.  
In _source code analysis_[63], we parse through the source code of the application without having to compile it into an immediate representation. Many approaches exist to do this; however, most tools tokenize the code and construct trees, including AST [57; 58], CFG [54; 55; 56], or PDG [64; 65].  
However, limits exist with these representations in encapsulating the complexity of enterprise systems. To mitigate the shortcomings of existing static code analysis techniques on enterprise systems, we augment the current techniques to recognize enterprise standards [6; 66]. A more realistic representation of the enterprise application can be constructed with aid from either source code analysis or bytecode analysis. This includes a tree representation, detection of the system's endpoints, and a communication map's construction. These augmented representations along with metadata have been successful in other problem domains including security [67], networking [68] and semantic clone detection [69].  
The following section shows how we can use these representations and metadata for a more thorough analysis of code smells in microservice applications.  
\begin{table}
\begin{tabular}{l c c c c c c c c c c c} \hline \hline
**Tools / Smell** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **10** & **11** \\
**EU** & **MS** & **WC** & **NAG** & **HCE** & **AV** & **MG** & **SP** & **ISI** & **SL** & **CD** \\ \hline \hline AI Reviewer [45] & & & & & & & & & & & & X \\ \hline ARCADE [46] & & & & & & & & & & & & X \\ \hline Arcan [44] & & & & & X & & & & X & & & X \\ \hline Designite [47] & & & & & & & & & & & & X \\ \hline Hotspot Detector [48] & & & & & & & & & & & & X \\ \hline Massey Architecture Explorer [49] & & & & & & & & & & & & & X \\ \hline MSA Nose & X & X & X & X & X & X & X & X & X & X & X \\ \hline Sonagraph [50] & & & & & & & & & & & & X \\ \hline STAN [51] & & & & & & & & & & & & X \\ \hline Structure 101 [52] & & & & & & & & & & & & X \\ \hline \hline \end{tabular} (EU), ESB Usage; (MS), Too Many Standards; (WC), Wrong Cuts; (NAG), Not Having an API Gateway; (HCE), Hard-Coded Endpoints; (AV), API Versioning; (MG), Microservice Greedy; (SP), Shared Persistency; (ISI), Inappropriate Service Intimacy; (SL), Shared Libraries; (CD), Cyclic Dependency.  
\end{table}
Table 1: Comparison of architectural code smell detection tools.