UAV: Warnings from multiple Automated Static Analysis Tools at a glance

Buckers, Tim; Cao, Clinton; Doesburg, Michiel; Gong, Boning; Wang, Sunwei; Beller, Moritz; Zaidman, Andy

doi:10.1109/saner.2017.7884656

Cited by 12 publications

(6 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To gain further insights into the adoption of ASATs in various contexts, we asked the participants for the reasons of using ASATs individually or in combination (Q1.4). An important reason to combine several ASATs seems to be that they "cover different areas", i.e., different rulesets [39]. For instance "Checkstyle helps to detect general coding style issues, while with PMD we can detect error-prone coding practices (including custom rules).…”

Section: Adoption Of Asatsmentioning

confidence: 99%

How developers engage with static analysis tools in different contexts

et al. 2019

Self Cite

View full text Add to dashboard Cite

Automatic static analysis tools (ASATs) are instruments that support code quality assessment by automatically detecting defects and design issues. Despite their popularity, they are characterized by (i) a high false positive rate and (ii) the low comprehensibility of the generated warnings. However, no prior studies have investigated the usage of ASATs in different development contexts (e.g., code reviews, regular development), nor how open source projects integrate ASATs into their workflows. These perspectives are paramount to improve the prioritization of the identified warnings. To shed light on the actual ASATs usage practices, in this paper we first survey 56 developers (66% from industry and 34% from open source projects) and interview 11 industrial experts leveraging ASATs in their workflow with the aim of understanding how they use ASATs in different contexts. Furthermore, to investigate how ASATs are being used in the workflows of open source projects, we manually inspect the contribution guidelines of 176 open-source systems and extract the ASATs' configuration and build files from their corresponding GitHub repositories. Our study highlights that (i) 71% of developers do pay attention to different warning categories depending on the development context; (ii) 63% of our respondents rely on specific factors (e.g., team policies and composition) when prioritizing warnings to fix during their programming; and (iii) 66% of the projects define how to use specific ASATs, but only 37% enforce their usage for new contributions. The perceived relevance of ASATs varies between different projects and domains, which is a sign that ASATs use is still not a common practice. In conclusion, this study confirms previous findings on the unwillingness of developers to configure ASATs and it emphasizes the necessity to improve existing strategies for the selection and prioritization of ASATs warnings that are shown to developers.

show abstract

Section: Adoption Of Asatsmentioning

confidence: 99%

How developers engage with static analysis tools in different contexts

et al. 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…Semi-automic diagnosis [14,54,148,149,189,193] Feedback-based [114,153] Checklists [8,140] UI & navigation tools [5,21,33,70,79,138] Alarm-relevant queries [42,80,127,190] Automated repair [12,15,115,116,179] Others [6,112,119,121,133,136,144] Fig. 1.…”

Section: Overview Of the Extracted Datamentioning

confidence: 99%

“…In their study, a simple light-weight visualization is designed for each alarm. Buckers et al [21] have proposed UAV (Unified ASAT Visualizer) that provides an intuitive visualization, enabling developers, researchers, and tool creators to compare the complementary strengths and overlaps of different static analysis tools applicable for Java programs. The UAV's enriched treemap and source code views provide its users with a seamless exploration of the alarm distribution from a high-level overview down to the source code.…”

Section: Alarms-relevantmentioning

confidence: 99%

Survey of Approaches for Postprocessing of Static Analysis Alarms

Muske

Serebrenik

2022

ACM Comput. Surv.

View full text Add to dashboard Cite

Static analysis tools have showcased their importance and usefulness in automated detection of defects. However, the tools are known to generate a large number of alarms which are warning messages to the user. The large number of alarms and cost incurred by their manual inspection have been identified as two major reasons for underuse of the tools in practice. To address these concerns plentitude of studies propose postprocessing of alarms: processing the alarms after they are generated. These studies differ greatly in their approaches to postprocess alarms. A comprehensive overview of the postprocessing approaches is, however, missing. In this article, we review 130 primary studies that propose postprocessing of alarms. The studies are collected by combining keywords-based database search and snowballing. We categorize approaches proposed by the collected studies into six main categories: clustering, ranking, pruning, automated elimination of false positives, combination of static and dynamic analyses, and simplification of manual inspection. We provide overview of the categories and sub-categories identified for them, their merits and shortcomings, and different techniques used to implement the approaches. Furthermore, we provide (1) guidelines for selection of the postprocessing techniques by the users/designers of static analysis tools; and (2) directions that can be explored by the researchers.

show abstract

“…Using this information it is established if a student committed a violation and, if so, to what extent it has been committed. Moreover, looking to the teacher's perspective, these approaches are not useful for preparing new teaching strategies since they are not based on an intuitive supporting environment to compare the results of student's code analyses [30]. In this paper, we present an approach to the student's code analysis able to detect their code violations.…”

Section: Related Workmentioning

confidence: 99%

Software Analytics to Support Students in Object-Oriented Programming Tasks: An Empirical Study

2020

View full text Add to dashboard Cite

The computing education community has shown a long-time interest in how to analyze the Object-Oriented (OO) source code developed by students to provide them with useful formative tips. Instructors need to understand the student's difficulties to provide precise feedback on most frequent mistakes and to shape, design and effectively drive the course. This paper proposes and evaluates an approach allowing to analyze student's source code and to automatically generate feedback about the more common violations of the produced code. The approach is implemented through a cloud-based tool allowing to monitor how students use language constructs based on the analysis of the most common violations of the Object-Oriented paradigm in the student source code. Moreover, the tool supports the generation of reports about student's mistakes and misconceptions that can be used to improve the students' education. The paper reports the results of a quasi-experiment performed in a class of a CS1 course to investigate the effects of the provided reports in terms of coding ability (concerning the correctness and the quality of the produced source code). Results show that after the course the treatment group obtained higher scores and produced better source code than the control group following the feedback provided by the teachers.

show abstract

UAV: Warnings from multiple Automated Static Analysis Tools at a glance

Cited by 12 publications

References 8 publications

How developers engage with static analysis tools in different contexts

How developers engage with static analysis tools in different contexts

Survey of Approaches for Postprocessing of Static Analysis Alarms

Software Analytics to Support Students in Object-Oriented Programming Tasks: An Empirical Study

Contact Info

Product

Resources

About