Repositioning of static analysis alarms

Muske, Tukaram; Talluri, Rohith; Serebrenik, Alexander

doi:10.1145/3213846.3213850

Cited by 20 publications

(22 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Clustering Static analysis alarms are clustered by the dependence among them. Since the grouped alarms are dominated by the alarm on which they are depending, not only the number of alarms that need to be inspected is reduced, but also the superfluous inspection effort is eliminated (Le and Soffa 2010;Lee et al 2012;Zhang et al 2013;Podelski et al 2016;Muske et al 2018). Podelski et al (2016) proposed a set of semantic-based features for each alarm, and the alarms of the same feature values were grouped.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A variable-level automated defect identification model based on machine learning

et al. 2019

View full text Add to dashboard Cite

Static analysis tools, automatically detecting potential source code defects at an early phase during the software development process, are diffusely applied in safety-critical software fields. However, alarms reported by the tools need to be inspected manually by developers, which is inevitable and costly, whereas a large proportion of them are found to be false positives. Aiming at automatically classifying the reported alarms into true defects and false positives, we propose a defect identification model based on machine learning. We design a set of novel features at variable level, called variable characteristics, for building the classification model, which is more fine-grained than the existing traditional features. We select 13 base classifiers and two ensemble learning methods for model building based on our proposed approach, and the reported alarms classified as unactionable (false positives) are pruned for the purpose of mitigating the effort of manual inspection. In this paper, we firstly evaluate the approach on four open-source C projects, and the classification results show that the proposed model achieves high performance and reliability in practice. Then, we conduct a baseline experiment to evaluate the effectiveness of our proposed model in contrast to traditional features, indicating that features at variable level improve the performance significantly in defect identification. Additionally, we use machine learning techniques to rank the variable characteristics in order to identify the contribution of each feature to our proposed model.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Zhang et al (2013) presented a sound alarm correlation algorithm based on trace semantic to automate alarm identification. Muske et al (2018) described a novel technique that reduces alarms by repositioning, which uses the information of control flow to group the related alarms.…”

Section: Related Workmentioning

confidence: 99%

A variable-level automated defect identification model based on machine learning

et al. 2019

View full text Add to dashboard Cite

show abstract

“…As a sanity check we performed a study to measure (1) what percentage of alarms resulting after the state-of-the-art repositioning [27] are similar; and 2what percentage of these similar alarms appear in the repositioning limitation scenarios (Section 1). The similar alarms appearing in those limitation scenarios are candidates for reducing their number through NCD-based repositioning.…”

Section: Pilot Studymentioning

confidence: 99%

“…Repositioning of alarms [27] is recently proposed technique to overcome limitations of the clustering techniques [13,20,24,34]. To achieve the reduction in alarms, the technique repositions a group of similar alarms to a program point where they can be safely replaced by a fewer newly created representative alarms (called as repositioned alarms).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reducing Static Analysis Alarms Based on Non-impacting Control Dependencies

Muske¹,

Talluri²,

Serebrenik

2019

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

Static analysis tools help to detect programming errors but generate a large number of alarms. Repositioning of alarms is recently proposed technique to reduce the number of alarms by replacing a group of similar alarms with a small number of newly created representative alarms. However, the technique fails to replace a group of similar alarms with a fewer representative alarms mainly when the immediately enclosing conditional statements of the alarms are different and not nested. This limitation is due to conservative assumption that a conditional statement of an alarm may prevent the alarm from being an error. To address the limitation above, we introduce the notion of non-impacting control dependencies (NCDs). An NCD of an alarm is a transitive control dependency of the alarm's program point, that does not affect whether the alarm is an error. We approximate the computation of NCDs based on the alarms that are similar, and then reposition the similar alarms by considering the effect of their NCDs. The NCD-based repositioning allows to merge more similar alarms together and represent them by a small number of representative alarms than the state-of-the-art repositioning technique. Thus, it can be expected to further reduce the number of alarms. To measure the reduction obtained, we evaluate the NCD-based repositioning using total 105,546 alarms generated on 16 open source C applications, 11 industry C applications, and 5 industry COBOL applications. The evaluation results indicate that, compared to the state-of-the-art repositioning technique, the NCD-based repositioning reduces the number of alarms respectively by up to 23.57%, 29.77%, and 36.09%. The median reductions are 9.02%, 17.18%, and 28.61%, respectively. 1 Broadly, two alarms are said to be similar if the property/condition checked in one alarm implies the property/condition checked in the other alarm (Section 2). 2 A control dependency of a program point p is a conditional edge in the control flow graph [1], that decides whether p is to be reached or not (see Section 2). 1 void HoleHMEPBCs (void){ 2 int h2d [309]; 3 4 ...

show abstract

How developers engage with static analysis tools in different contexts

et al. 2019

View full text Add to dashboard Cite

Automatic static analysis tools (ASATs) are instruments that support code quality assessment by automatically detecting defects and design issues. Despite their popularity, they are characterized by (i) a high false positive rate and (ii) the low comprehensibility of the generated warnings. However, no prior studies have investigated the usage of ASATs in different development contexts (e.g., code reviews, regular development), nor how open source projects integrate ASATs into their workflows. These perspectives are paramount to improve the prioritization of the identified warnings. To shed light on the actual ASATs usage practices, in this paper we first survey 56 developers (66% from industry and 34% from open source projects) and interview 11 industrial experts leveraging ASATs in their workflow with the aim of understanding how they use ASATs in different contexts. Furthermore, to investigate how ASATs are being used in the workflows of open source projects, we manually inspect the contribution guidelines of 176 open-source systems and extract the ASATs' configuration and build files from their corresponding GitHub repositories. Our study highlights that (i) 71% of developers do pay attention to different warning categories depending on the development context; (ii) 63% of our respondents rely on specific factors (e.g., team policies and composition) when prioritizing warnings to fix during their programming; and (iii) 66% of the projects define how to use specific ASATs, but only 37% enforce their usage for new contributions. The perceived relevance of ASATs varies between different projects and domains, which is a sign that ASATs use is still not a common practice. In conclusion, this study confirms previous findings on the unwillingness of developers to configure ASATs and it emphasizes the necessity to improve existing strategies for the selection and prioritization of ASATs warnings that are shown to developers.

show abstract

Repositioning of static analysis alarms

Cited by 20 publications

References 26 publications

A variable-level automated defect identification model based on machine learning

A variable-level automated defect identification model based on machine learning

Reducing Static Analysis Alarms Based on Non-impacting Control Dependencies

How developers engage with static analysis tools in different contexts

Contact Info

Product

Resources

About