Striking a balance: pruning false-positives from static call graphs
Striking a balance: pruning false-positives from static call graphs
复制标题
取得平衡：从静态调用图中修剪误报
DOI：
10.1145/3510003.3510166
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Palsberg, Jens
中科院分区：
文献类型：
--
作者：
Utture, Akshay;Liu, Shuyang;Kalhauge, Christian Gram;Palsberg, Jens
研究人员报告说，静态分析工具很少能达到对开发人员有吸引力的假阳性率。我们通过一种技术来克服这个问题，这种技术可以减少错误报告，同时也减少误报。我们的技术修剪了位于许多静态分析核心的静态调用图。具体地说，静态调用图构造像往常一样进行，之后调用图修剪器去除许多假正边，但很少去除真边。我们面临的挑战是要在积极消除假阳性边缘和不积极到没有真正的边缘之间取得平衡。我们通过自动提前学习过程自动生成调用图修剪器来实现这一目标。我们将这种调用图修剪器添加到一个用于空指针分析的软件工具中，发现假阳性率从73%下降到23%。这一改进使该工具对开发人员更有用。
Researchers have reported that static analysis tools rarely achieve a false-positive rate that would make them attractive to developers. We overcome this problem by a technique that leads to reporting fewer bugs but also much fewer false positives. Our technique prunes the static call graph that sits at the core of many static analyses. Specifically, static call-graph construction proceeds as usual, after which a call-graph pruner removes many false-positive edges but few true edges. The challenge is to strike a balance between being aggressive in removing false-positive edges but not so aggressive that no true edges remain. We achieve this goal by automatically producing a call-graph pruner through an automatic, ahead-of-time learning process. We added such a call-graph pruner to a software tool for null-pointer analysis and found that the false-positive rate decreased from 73% to 23%. This improvement makes the tool more useful to developers.