SHF: Medium: How Do Static Analysis Tools Affect End-User Quality

SHF：中：静态分析工具如何影响最终用户质量

• 批准号: 0964703
• 负责人: Premkumar Devanbu
• 金额: $ 70.01万
• 依托单位: University of California-Davis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-06-01 至 2015-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0964703&HistoricalAwards=false
• 关键词: SHF; Medium; How; Do; Static

The perceived quality of a software product depends strongly on field failures viz., defects experienced by users after the software is released to the field. Software managers work to constantly improve quality control processes, seeking to reduce the number of field failures. Static analysis is a powerful and elegant technique that finds defects without running code, by reasoning about what the program does when executed. It has been incubating in academia and is now emerging in industry. This research asks this question: How can the performance and practical use of static analysis tools be improved ? The goal of the research is to find ways to improve the performance of static analysis tools, as well as the quality-control processes that use them. This will help commercial and open-source organizations make more effective use static analysis tools, and substantially reduce field failures.Using historical data from several open-source and commercial exemplars, the research will retrospectively evaluate the association of field failures with static analysis warnings. The research will evaluate the impact of factors such as experience of the developer, the complexity of the code, and the type of static analysis warning on failure properties such criticality, and defect latency (time until a defect becomes a failure). A wide variety of projects will be studied, including both commercial and open-source. The resulting data will be analyzed using statistical modeling to determine the factors that influence the success of static analysis tools in preventing field failures. Some field failures may have no associated static analysis warnings. This research will identify and characterize these failures, paving the way for new static analysis research. An integrated educational initiative in this proposal is the training of undergraduates by using bug fixes as pedagogical material; undergraduates will also help annotate the corpus of field failures with information relevant to our analysis. An important byproduct of this research, is a large, diverse, annotated corpus of field failures of use to other educators and researchers in empirical software engineering, testing, and static analysis.

软件产品的感知质量在很大程度上取决于现场故障，即，软件发布到现场后用户遇到的缺陷。软件管理人员致力于不断改进质量控制过程，寻求减少现场故障的数量。静态分析是一种强大而优雅的技术，它通过推理程序在执行时的行为，在不运行代码的情况下发现缺陷。它一直在学术界孵化，现在正在工业界出现。本研究提出了这样一个问题：如何提高静态分析工具的性能和实际使用？该研究的目标是找到提高静态分析工具性能的方法，以及使用它们的质量控制过程。这将有助于商业和开源组织更有效地使用静态分析工具，并大大减少现场故障。使用来自几个开源和商业范例的历史数据，研究将回顾性地评估现场故障与静态分析警告的关联。该研究将评估因素的影响，如开发人员的经验，代码的复杂性，以及静态分析警告对故障属性的类型，如关键性和缺陷延迟（直到缺陷成为故障的时间）。将研究各种各样的项目，包括商业和开源项目。将使用统计建模分析所得数据，以确定影响静态分析工具成功预防现场故障的因素。某些字段故障可能没有相关的静态分析警告。这项研究将识别和描述这些故障，为新的静态分析研究铺平道路。在这个建议中，一个综合的教育举措是通过使用错误修复作为教学材料来培训本科生;本科生还将帮助注释与我们的分析相关的信息的领域失败的语料库。这项研究的一个重要副产品，是一个大型的，多样化的，注释的语料库使用的领域失败的其他教育工作者和研究人员在实证软件工程，测试和静态分析。