No abstract

No abstract

No abstract

Original scientific paper Traditional static defect detection tools can detect software defects and report alarms, but the correlations among alarms are not identified and massive independent alarms are against the understanding. Helping users in the alarm verification task is a major challenge for current static defect detection tools. In this paper, we formally introduce alarm correlations. If the occurrence of one alarm causes another alarm, we say that they are correlated. If one dominant alarm is uniquely correlated with another, we know verifying the first will also verify the others. Guided by the correlation, we can reduce the number of alarms required for verification. Our algorithms are inter-procedural, path-sensitive, and scalable. We present a correlation procedure summary model for inter-procedural alarm correlation calculation. The underlying algorithms are implemented inside our defect detection tools. We chose one common semantic fault as a case study and proved that our method has the effect of reducing 34,23 % of workload. Using correlation information, we are able to automate the alarm verification that previously had to be done manually. Keywords: abstract interpretation; alarm correlations; alarm verification; correlation summary; state slicing Istraživanje korelacija alarma na temelju detekcije statičkog kvaraIzvorni znanstveni članak Tradicionalni alati za detekciju statičkog kvara mogu detektirati kvarove softvera i objaviti alarm, ali korelacije između alarma nisu identificirane i masivni nezavisni alarmi protivni su razumijevanju. Pomaganje korisnicima u verifikaciji alarma predstavlja veliki izazov postojećim alatima za detekciju statičke greške. U ovom radu mi formalno uvodimo korelacije alarma. Ako postojanje jednog alarma uzrokuje drugi, kažemo da su u korelaciji. Ako je jedan dominantni alarm jedinstveno povezan s drugim, znamo da će se verifikacijom jednoga također verificirati drugi. Na osnovu korelacije možemo reducirati broj alarma potrebnih za verifikaciju. Naši su algoritmi inter-proceduralni, osjetljivi na putanju i podesivi (scalable). Mi prikazujemo sumarni model postupka korelacije za računanje inter-proceduralne korelacije alarma. Osnovni algoritmi su implementirani u naše alate za detekciju kvara. Izabrali smo jednu uobičajenu semantičku pogrešku za analizu slučaja i dokazali da naša metoda rezultira smanjenjem radnog opterećenja za 34,23 %. Primjenom korelacijeske informacije možemo automatizirati verifikaciju alarma, što se ranije moralo raditi ručno.

No abstract

Static analysis tools, automatically detecting potential source code defects at an early phase during the software development process, are diffusely applied in safety-critical software fields. However, alarms reported by the tools need to be inspected manually by developers, which is inevitable and costly, whereas a large proportion of them are found to be false positives. Aiming at automatically classifying the reported alarms into true defects and false positives, we propose a defect identification model based on machine learning. We design a set of novel features at variable level, called variable characteristics, for building the classification model, which is more fine-grained than the existing traditional features. We select 13 base classifiers and two ensemble learning methods for model building based on our proposed approach, and the reported alarms classified as unactionable (false positives) are pruned for the purpose of mitigating the effort of manual inspection. In this paper, we firstly evaluate the approach on four open-source C projects, and the classification results show that the proposed model achieves high performance and reliability in practice. Then, we conduct a baseline experiment to evaluate the effectiveness of our proposed model in contrast to traditional features, indicating that features at variable level improve the performance significantly in defect identification. Additionally, we use machine learning techniques to rank the variable characteristics in order to identify the contribution of each feature to our proposed model.

No abstract

No abstract