SHF: Medium: How Do Static Analysis Tools Affect End-User Quality

软件产品的感知质量在很大程度上取决于现场故障，即用户在软件发布到现场后经历的缺陷。软件经理不断改进质量控制过程，寻求减少现场故障的数量。静态分析是一种强大而优雅的技术，它可以在不运行代码的情况下，通过推理程序在执行时所做的事情来发现缺陷。它一直在学术界酝酿，现在正在工业界崭露头角。本研究提出了这样一个问题：如何改进静态分析工具的性能和实际使用？研究的目标是找到改进静态分析工具性能的方法，以及使用它们的质量控制过程。这将有助于商业和开源组织更有效地使用静态分析工具，并大大减少现场故障。利用来自几个开源和商业范例的历史数据，该研究将回顾性地评估现场故障与静态分析警告的关联。该研究将评估诸如开发人员的经验、代码的复杂性、对故障属性（如临界性）的静态分析警告类型和缺陷延迟（直到缺陷变成故障的时间）等因素的影响。将研究各种各样的项目，包括商业项目和开源项目。结果数据将使用统计建模进行分析，以确定影响静态分析工具成功防止现场故障的因素。一些现场故障可能没有相关的静态分析警告。这项研究将识别和描述这些故障，为新的静态分析研究铺平道路。本文提出的一项综合教育举措是：利用bug修复作为教学材料对大学生进行培训；本科生也将帮助用与我们分析相关的信息注释现场故障的语料库。这项研究的一个重要副产品是一个大型的、多样化的、带注释的领域故障语料库，可供其他教育工作者和研究人员在经验软件工程、测试和静态分析中使用。

The perceived quality of a software product depends strongly on field failures viz., defects experienced by users after the software is released to the field. Software managers work to constantly improve quality control processes, seeking to reduce the number of field failures. Static analysis is a powerful and elegant technique that finds defects without running code, by reasoning about what the program does when executed. It has been incubating in academia and is now emerging in industry. This research asks this question: How can the performance and practical use of static analysis tools be improved ? The goal of the research is to find ways to improve the performance of static analysis tools, as well as the quality-control processes that use them. This will help commercial and open-source organizations make more effective use static analysis tools, and substantially reduce field failures.Using historical data from several open-source and commercial exemplars, the research will retrospectively evaluate the association of field failures with static analysis warnings. The research will evaluate the impact of factors such as experience of the developer, the complexity of the code, and the type of static analysis warning on failure properties such criticality, and defect latency (time until a defect becomes a failure). A wide variety of projects will be studied, including both commercial and open-source. The resulting data will be analyzed using statistical modeling to determine the factors that influence the success of static analysis tools in preventing field failures. Some field failures may have no associated static analysis warnings. This research will identify and characterize these failures, paving the way for new static analysis research. An integrated educational initiative in this proposal is the training of undergraduates by using bug fixes as pedagogical material; undergraduates will also help annotate the corpus of field failures with information relevant to our analysis. An important byproduct of this research, is a large, diverse, annotated corpus of field failures of use to other educators and researchers in empirical software engineering, testing, and static analysis.