Reducing Static Analysis Alarms Based on Non-impacting Control Dependencies

Abstract

Static analysis tools help to detect programming errors but generate a large number of alarms. Repositioning of alarms is recently proposed technique to reduce the number of alarms by replacing a group of similar alarms with a small number of newly created representative alarms. However, the technique fails to replace a group of similar alarms with a fewer representative alarms mainly when the immediately enclosing conditional statements of the alarms are different and not nested. This limitation is due to conservative assumption that a conditional statement of an alarm may prevent the alarm from being an error. To address the limitation above, we introduce the notion of non-impacting control dependencies (NCDs). An NCD of an alarm is a transitive control dependency of the alarm's program point, that does not affect whether the alarm is an error. We approximate the computation of NCDs based on the alarms that are similar, and then reposition the similar alarms by considering the effect of their NCDs. The NCD-based repositioning allows to merge more similar alarms together and represent them by a small number of representative alarms than the state-of-the-art repositioning technique. Thus, it can be expected to further reduce the number of alarms. To measure the reduction obtained, we evaluate the NCD-based repositioning using total 105,546 alarms generated on 16 open source C applications, 11 industry C applications, and 5 industry COBOL applications. The evaluation results indicate that, compared to the state-of-the-art repositioning technique, the NCD-based repositioning reduces the number of alarms respectively by up to 23.57%, 29.77%, and 36.09%. The median reductions are 9.02%, 17.18%, and 28.61%, respectively. 1 Broadly, two alarms are said to be similar if the property/condition checked in one alarm implies the property/condition checked in the other alarm (Section 2). 2 A control dependency of a program point p is a conditional edge in the control flow graph [1], that decides whether p is to be reached or not (see Section 2). 1 void HoleHMEPBCs (void){ 2 int h2d [309]; 3 4 ...

Survey of Approaches for Postprocessing of Static Analysis Alarms

“…Among those 21 studies, 10 studies propose classification of alarms into actionable or non-actionable classes, while the other 11 studies propose ranking of alarms. Compared to this review, our literature survey is more comprehensive as it includes more studies (130) that propose a variety of approaches for alarms postprocessing. For example, due to inclusion of those additional studies, we could identify new categories like clustering, automated false positives elimination, and simplification of manual inspection.…”

“…Clustering. The approaches in this sub-category cluster alarms such that when one or more representative alarms of a cluster are false positives, all the other alarms in the same cluster are also false positives [99,100,123,129,130,187]. The representative alarms of a cluster are called dominant alarms of the cluster.…”

“…From the evaluations of the postprocessing approaches, e.g., clustering approaches [99,100,123,129,130,187], we find that the postprocessing results on applications vary considerably even if the applications are written in the same programming language and belong to the same domain. For example, the number of alarms that are similar to and get identified by sound clustering techniques as followers of other alarms is found to vary considerably among the C applications.…”