SHF: Medium: How Do Static Analysis Tools Affect End-User Quality

软件产品的感知质量很大程度上依赖于现场故障，即用户在软件发布到现场后所经历的缺陷。软件经理致力于不断改进质量控制流程，寻求减少现场故障的数量。静态分析是一种强大而优雅的技术，它通过推理程序在执行时所做的事情，在不运行代码的情况下找到缺陷。它一直在学术界孵化，现在正在工业界崭露头角。这项研究提出了这样一个问题：如何提高静态分析工具的性能和实用价值？这项研究的目标是找到改进静态分析工具性能的方法，以及使用它们的质量控制过程。这将帮助商业和开源组织更有效地使用静态分析工具，并大幅减少现场故障。研究将使用几个开源和商业样本的历史数据，回顾评估现场故障与静态分析警告的关联。研究将评估诸如开发人员的经验、代码的复杂性和静态分析警告的类型等因素对故障属性的影响，例如关键程度和缺陷延迟(缺陷成为故障的时间)。我们将研究各种各样的项目，包括商业项目和开源项目。将使用统计建模对所产生的数据进行分析，以确定影响静态分析工具在预防实地故障方面成功的因素。某些现场故障可能没有关联的静态分析警告。这项研究将识别和表征这些故障，为新的静态分析研究铺平道路。这项提议中的一个综合教育倡议是通过使用错误修复作为教学材料来培训本科生；本科生还将帮助使用与我们的分析相关的信息来注释领域失败的语料库。这项研究的一个重要副产品是一个大型的、多样化的、带注释的领域语料库，这些语料库对其他教育工作者和研究人员在经验性软件工程、测试和静态分析中的使用失败。

The perceived quality of a software product depends strongly on field failures viz., defects experienced by users after the software is released to the field. Software managers work to constantly improve quality control processes, seeking to reduce the number of field failures. Static analysis is a powerful and elegant technique that finds defects without running code, by reasoning about what the program does when executed. It has been incubating in academia and is now emerging in industry. This research asks this question: How can the performance and practical use of static analysis tools be improved ? The goal of the research is to find ways to improve the performance of static analysis tools, as well as the quality-control processes that use them. This will help commercial and open-source organizations make more effective use static analysis tools, and substantially reduce field failures.Using historical data from several open-source and commercial exemplars, the research will retrospectively evaluate the association of field failures with static analysis warnings. The research will evaluate the impact of factors such as experience of the developer, the complexity of the code, and the type of static analysis warning on failure properties such criticality, and defect latency (time until a defect becomes a failure). A wide variety of projects will be studied, including both commercial and open-source. The resulting data will be analyzed using statistical modeling to determine the factors that influence the success of static analysis tools in preventing field failures. Some field failures may have no associated static analysis warnings. This research will identify and characterize these failures, paving the way for new static analysis research. An integrated educational initiative in this proposal is the training of undergraduates by using bug fixes as pedagogical material; undergraduates will also help annotate the corpus of field failures with information relevant to our analysis. An important byproduct of this research, is a large, diverse, annotated corpus of field failures of use to other educators and researchers in empirical software engineering, testing, and static analysis.