Predicting accurate and actionable static analysis warnings

Abstract

Static analysis tools report software defects that may or may not be detected by other verification methods. Two challenges complicating the adoption of these tools are spurious false positive warnings and legitimate warnings that are not acted on. This paper reports automated support to help address these challenges using logistic regression models that predict the foregoing types of warnings from signals in the warnings and implicated code. Because examining many potential signaling factors in large software development settings can be expensive, we use a screening methodology to quickly discard factors with low predictive power and cost-effectively build predictive models. Our empirical evaluation indicates that these models can achieve high accuracy in predicting accurate and actionable static analysis warnings, and suggests that the models are competitive with alternative models built without screening.

On the "naturalness" of buggy code

“…Future research could evaluate how our approaches can complement the work above. Ruthruff et al propose a filtering approach to detecting accurate and actionable SBF warnings [49]. They use priority of warnings, defined by the SBF , type of error detected, and features of the affected file (e.g., size and warning depth) to do the filtering.…”

Survey on static program analysis results refinement approaches

“…Также стоит отметить работу Муске и др. [32], в которой авторы применяют логистическую регрессию для определения вероятности каждого предупреждения быть ложным или нет с точки зрения необходимости исправления ошибки в коде. Авторы выделили несколько групп факторов, влияющих на вероятность отнесения предупреждения к истинно-положительному или ложноположительному, а также на вероятность того, что обнаруженная ситуация в коде должна быть исправлена.…”

Pre-Silicon Bug Forecast

“…In our study, code characteristics are chosen independent of specific hardware description languages, which is listed in Table I. 2) History Characteristics: History information, such as past changes, fixes, bugs, and so on, may also have significant impacts on bug occurrence. In the domain of software engineering, history information has already been demonstrated to be helpful in predicting software defects [20]- [22], [26], [31], [42]. Hence, the proposed pre-silicon bug forecast framework also utilizes history information.…”

“…In the field of software engineering, many studies have been dedicated to characterize the relationship between the software characteristics and fault-proneness to assess the design quality [5], [19]- [22], [26], [27], [30], [31], [42], which mainly focused on selecting characteristics that have most impacts on the fault-proneness of software.…”