Understanding Why and Predicting When Developers Adhere to Code-Quality Standards
Understanding Why and Predicting When Developers Adhere to Code-Quality Standards
复制标题
DOI：
10.1109/icse-seip58684.2023.00045
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Manish Motwani;Yuriy Brun
中科院分区：
文献类型：
--
作者：
Manish Motwani;Yuriy Brun
静态分析工具在软件开发中有着广泛的应用。虽然研究的重点是提高工具的准确性，但微软的证据表明，开发人员经常认为一些准确检测到的警告不值得修复：这些工具和开发人员认为真正的积极因素是不同的。因此，提高工具利用率需要了解开发人员何时以及为什么修复静态分析警告。我们对公司内部使用的Microsoft禁用API标准进行了案例研究，该标准描述了195个可能导致漏洞的API和142个推荐的替代品。我们发现开发人员经常（84%的时间）有意识地偏离这个标准，详细说明他们的理由，使我们能够研究开发人员为什么以及何时偏离标准。然后，我们确定了与开发人员使用首选API相关的23个因素，并建立了一个模型，预测开发人员在不同情况下是否会使用首选或不鼓励的API，准确率为92%。我们还训练了一个模型，根据开发人员过去的开发活动来预测他们将来会使用的API类型，准确率为86%。我们概述了一系列具体的建议，静态分析开发人员可以使用这些建议来确定输出的优先级和自定义输出，从而潜在地增加他们的工具的有用性。
Static analysis tools are widely used in software development. While research has focused on improving tool accuracy, evidence at Microsoft suggests that developers often consider some accurately detected warnings not worth fixing: what these tools and developers consider to be true positives differs. Thus, improving tool utilization requires understanding when and why developers fix static-analysis warnings.We conduct a case study of Microsoft’s Banned API Standard used within the company, which describes 195 APIs that can potentially cause vulnerabilities and 142 recommended replacements. We find that developers often (84% of the time) consciously deviate from this standard, specifying their rationale, allowing us to study why and when developers deviate from standards. We then identify 23 factors that correlate with developers using the preferred APIs and build a model that predicts whether the developers would use the preferred or discouraged APIs under different circumstances with 92% accuracy. We also train a model to predict the kind of APIs developers would use in the future based on their past development activity, with 86% accuracy. We outline a series of concrete suggestions static analysis developers can use to prioritize and customize their output, potentially increasing their tools’ usefulness.