Review efforts reduction by partitioning of static analysis warnings

Muske, Tukaram; Baid, Ankit; Sanas, Tushar

doi:10.1109/scam.2013.6648191

Cited by 31 publications

(27 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We observe, the problem of large number of warnings and huge efforts incurred in their reviewing is addressed through application of various techniques like analysis precision improvement (for example, [6], and [7]), categorization and prioritization of warnings [8], identification of redundant reviews of warnings [4], and providing assistance during warnings inspection [9]. We compare our presented technique with the techniques that targeted improving the process by eliminating review redundancy.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Supporting Reviewing of Warnings in Presence of Shared Variables: Need and Effectiveness

Muske

2014

2014 IEEE International Symposium on Software Reliability Engineering Workshops

View full text Add to dashboard Cite

Clustering, breaking a large system into multiple clusters is commonly used technique to scale static analysis tools to large systems. Sound static analysis of resulted clusters requires conservative approach for the inter-cluster communication implemented through shared variables. We observe, this approach adds to the large number of warnings generated due to imprecision of static analysis. Further, manual reviewing of warnings generated due to shared variables takes much more effort as compared to effort required in reviewing of the other class of warnings. This paper aims to assist reviewing of such warnings impacted by the shared variables so that reviewing effort is reduced. This is achieved by identification and reporting of suitable information about the impacting shared variables. The reported information includes -1) marked warnings affected due to shared variables, 2) shared variables present in the code (such as warning point, and code slice) traversed while reviewing a warning, 3) intelligently selected write-points of the involved shared variables, depending on the type of warning, and 4) characteristics of the shared variables extracted from the code, that could potentially help to reduce the efforts further. Our experiments on two embedded systems indicated that the review assisting information presented to the user is quite effective to improve reviewing of warnings affected due to shared variables. The overall reduction in manual efforts varied from 45-70% depending on code size and complexity, type of warnings, reviewer skills, tool support used, etc. I. MOTIVATIONStatic analysis tools have showcased their usefulness in software quality assurance by detecting defects early in the software development life cycle [1]. However, these tools face scalability issue on many real world systems [2]. Clustering [3], breaking a large system into multiple clusters is commonly used technique to scale these tools to large systems. A cluster thus formed represents a system functionality or designated task that is implemented independently of or in communication with other system functionalities. Each generated cluster being smaller and less complex than the original system can be analyzed using the static analysis tools. The clusters of a system can be user provided entry functions, or automatically identified (uncalled functions), or mixture of the both.Sound static analysis of a cluster requires conservative approach for the inter-cluster communication implemented through shared variables, as the cluster is analyzed independently of others. This approach adds to the large number of warnings generated due to imprecision of static analysis. For example, Figure 1 represents two clusters, T ask1 and T ask2 running in parallel, with sharedV ar as the shared variable used to communicate between the two clusters. Due to the usage of sharedV ar as the index, the Array Index Out of Bound (AIOB) warning w1 gets reported for cluster T ask1, since values provided to sharedV ar by T ask2 are not known while analysis of T...

show abstract

Section: Related Workmentioning

confidence: 99%

“…For example, reviewing of warning w1 requires review information collection (values of sharedV ar) over both the clusters. Further, on many occasions, static analysis tools lack to report information about the shared variables, which is usually obtained through time-consuming manual inspection [4]. Thus, there is a need to support reviewing of such warnings.…”

mentioning

confidence: 99%

Supporting Reviewing of Warnings in Presence of Shared Variables: Need and Effectiveness

Muske

2014

2014 IEEE International Symposium on Software Reliability Engineering Workshops

View full text Add to dashboard Cite

show abstract

“…Clustering is commonly used to reduce the number of alarms reported to the user [14,26]. State-of-the-art clustering techniques [13,20,24,34] group similar alarms 1 together such that (1) there are few dominant and many dominated alarms; and (2) when the dominant alarms of a cluster are false positives, all the alarms in the cluster are also false positives. The techniques count only the dominant alarms as the alarms obtained after the clustering.…”

Section: Introductionmentioning

confidence: 99%

“…Repositioning of alarms [27] is recently proposed technique to overcome limitations of the clustering techniques [13,20,24,34]. To achieve the reduction in alarms, the technique repositions a group of similar alarms to a program point where they can be safely replaced by a fewer newly created representative alarms (called as repositioned alarms).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reducing Static Analysis Alarms Based on Non-impacting Control Dependencies

Muske¹,

Talluri²,

Serebrenik

2019

Programming Languages and Systems

View full text Add to dashboard Cite

Static analysis tools help to detect programming errors but generate a large number of alarms. Repositioning of alarms is recently proposed technique to reduce the number of alarms by replacing a group of similar alarms with a small number of newly created representative alarms. However, the technique fails to replace a group of similar alarms with a fewer representative alarms mainly when the immediately enclosing conditional statements of the alarms are different and not nested. This limitation is due to conservative assumption that a conditional statement of an alarm may prevent the alarm from being an error. To address the limitation above, we introduce the notion of non-impacting control dependencies (NCDs). An NCD of an alarm is a transitive control dependency of the alarm's program point, that does not affect whether the alarm is an error. We approximate the computation of NCDs based on the alarms that are similar, and then reposition the similar alarms by considering the effect of their NCDs. The NCD-based repositioning allows to merge more similar alarms together and represent them by a small number of representative alarms than the state-of-the-art repositioning technique. Thus, it can be expected to further reduce the number of alarms. To measure the reduction obtained, we evaluate the NCD-based repositioning using total 105,546 alarms generated on 16 open source C applications, 11 industry C applications, and 5 industry COBOL applications. The evaluation results indicate that, compared to the state-of-the-art repositioning technique, the NCD-based repositioning reduces the number of alarms respectively by up to 23.57%, 29.77%, and 36.09%. The median reductions are 9.02%, 17.18%, and 28.61%, respectively. 1 Broadly, two alarms are said to be similar if the property/condition checked in one alarm implies the property/condition checked in the other alarm (Section 2). 2 A control dependency of a program point p is a conditional edge in the control flow graph [1], that decides whether p is to be reached or not (see Section 2). 1 void HoleHMEPBCs (void){ 2 int h2d [309]; 3 4 ...

show abstract