Evaluating static analysis tools

点击翻译按钮获取中文摘要

Coverity's static defect defection tools can analyze software with millions of lines of code and more. Such scalable static defect detection tools typically report false positives, which are defect reports that do not describe true defects in software. In addition, such static analysis tools miss defects, referred to as false negatives. Since false positives and false negatives hurt the effectiveness of defect detection tools, it is crucial for Coverity and other companies to reduce their defect detection tools' false positives and false negatives. The goal of this project is to understand and categorize the main causes of false positives and false negatives of the Coverity static analysis tools, which can help improve the tools to reduce false positives and false negatives.