Viewing Code as Property Graphs, Querying Property Graphs with Graph Databases

Can code be viewed as data, and if yes, what would it look like? What kind of data structure and database would that fit in? Why would you want to do this, and how would you query such a back-end? Hint: graph.

For our 2nd Meetup, we start by presenting how graphs can help produce better code. Fabian Yamaguchi will share the details of the ShiftLeft Code Property Graph CPG that he invented. CPG powers ShiftLeft's lightning-fast scan times & record-breaking accuracy, resulting in better code and more efficient DevOps.

After Fabian's talk, George Anadiotis will discuss the latest developments in the Graph Database world, sharing an insider view from the recent W3C Workshop on Web Standardization for Graph Data. Graphs can help with many real-world problems, but how do you choose a graph database, and what about standards for interoperability among them?

6:00 - 6:20 Doors open, meet and greet
6:20 - 7:00 Code Property Graph: A modern, queryable data storage for source code. Fabian Yamaguchi
7:00 - 7:40 Property Graphs & RDF, Graph Databases & Interoperability. George Anadiotis
7:40 - 8:00 Networking

Talk 1: Code Property Graph: A modern, queryable data storage for source code

Modern software and its development process has become tremendously complex. Systems are now built on polyglot environments with multiple dependencies & large code bases. As the code size increases & new code contributors are added, it is imperative for developers to have an in-depth understanding of code itself.

Fabian Yamaguchi offers an overview of Code Property Graph (CPG), a unique approach that presents code as a queryable collection of data developers can interact with & ask relevant questions—much like a search engine.

CPG allows the functional elements of code such as variables & methods to be represented in an interconnected graph of data & control flows. Think of it like Facebook’s graph search, but the functions & variables are now your friends. Semantic information about code can stored on distributed graph databases over the web.

The CPG-based data structure for storing code allows us to identify associations between function & data and query them to find known bugs & issues. This also allows developers to identify severe security & performance regression issues before they hit production.

It gives insight to explore & quickly find solutions that would have taken a long time. The data stored in large CPGs can be mined for automated analysis which brings out associations with different code segments.

Fabian Yamaguchi is the chief scientist at ShiftLeft. Fabian has over 10 years of experience in the security domain, where he has worked as a security consultant and researcher focusing on manual and automated vulnerability discovery.

Talk 2: Property Graphs & RDF, Graph Databases & Interoperability

Graph is a good way to model many problems in the real world. Storing these models in a graph database is a natural match. This is why graph databases have been seeing increasing popularity and adoption. One of their issues, however, has been interoperability.

The graph database landscape has been fragmented, with Property Graphs & RDF representing 2 different ways to model/store/query data, with no standard way of interoperability. While RDF is standardized, Property Graphs are not.

This has been detrimental to Graph database adoption, and experts, standards bodies, and vendors, all realized this. The W3C Workshop on Web Standardization for Graph Data brought the who is who of graph databases in Berlin in early March to address this issue.

What was discussed, and decided, in this Workshop, and how does this change things? How do you choose the right graph database for you, and what is the role of interoperability?

George has been working with graph databases since 2005, when he implemented his first graph database prototype. This includes award-winning R&D, startups, enterprise deployments, and consulting top Graph Database vendors.