Improving Static Code Analysis Using Machine Learning Methods

使用机器学习方法改进静态代码分析

• 批准号: 515798-2017
• 负责人: Guo, Yuhong
• 金额: $ 1.82万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2017
• 资助国家: 加拿大
• 起止时间: 2017-01-01 至 2018-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=640127
• 关键词: Improving; Static; Code; Analysis; Using

Verifying computer programs is expensive and difficult. The available empirical tests are oftentime-consuming and ad-hoc providing only a fragmented understanding of the program being analyzed. Staticcode analysis, which performs computer program debugging by examining the source code without explicitlyexecuting the program, is an invaluable asset for evaluating programs. However, most existing static analysistools have major drawback of producing unmanageable number of false positives, while requiring significantcostly manual interventions. This research project addresses this problem by developing machine learningapproaches that increase the agent's ability to detect false vulnerabilities and induce more reliable staticanalyzers. The project will provide a tangible benefit to the development of Software Secured's flagshipproduct Omega and their clients who will save countless man-hours currently spent triaging false positives.It also will have a significant impact on improving the quality of complex softwares in general.

编写计算机程序既昂贵又困难。现有的实证测试往往是耗时和特设提供的程序分析只有一个支离破碎的理解。静态代码分析通过检查源代码而不显式执行程序来执行计算机程序调试，是评估程序的宝贵资产。然而，大多数现有的静态分析工具具有产生难以管理的假阳性数量的主要缺点，同时需要显著昂贵的人工干预。本研究项目通过开发机器学习方法来解决这个问题，这些方法可以提高代理检测虚假漏洞的能力，并诱导更可靠的静态分析器。该项目将为Software Secured的旗舰产品Omega及其客户的开发带来切实的好处，这些客户将节省目前用于分类误报的无数工时，还将对提高复杂软件的总体质量产生重大影响。