Improving Static Code Analysis Using Machine Learning Methods

点击翻译按钮获取中文摘要

Verifying computer programs is expensive and difficult. The available empirical tests are oftentime-consuming and ad-hoc providing only a fragmented understanding of the program being analyzed. Staticcode analysis, which performs computer program debugging by examining the source code without explicitlyexecuting the program, is an invaluable asset for evaluating programs. However, most existing static analysistools have major drawback of producing unmanageable number of false positives, while requiring significantcostly manual interventions. This research project addresses this problem by developing machine learningapproaches that increase the agent's ability to detect false vulnerabilities and induce more reliable staticanalyzers. The project will provide a tangible benefit to the development of Software Secured's flagshipproduct Omega and their clients who will save countless man-hours currently spent triaging false positives.It also will have a significant impact on improving the quality of complex softwares in general.