Machine Learning-Powered Automated Software Bug Detection

今天，软件已经融入了我们社会的每一个部分。最近的研究表明，软件故障每年可能给全球经济造成超过3000亿美元的损失。构建可靠和安全的软件已经成为软件开发人员面临的日益严峻的挑战。因此，帮助软件开发人员检测软件故障、提高软件质量和可靠性的技术将比以往任何时候都更加重要。 为了帮助开发人员检测故障，在过去的几年里，提出了许多静态错误检测方法，其中一些已经在行业中采用。典型的静态错误检测器利用编程规则或模式来检测特定类型的错误。尽管静态错误检测总体上取得了成功，但它仍面临以下主要的挑战性问题。首先，当前的静态错误检测器报告了大量的误报，即报告的错误不是实际的错误。最近的研究表明，静态错误检测工具报告的错误中有30%-90%是假阳性。其次，当前的错误检测器无法检测到约95%的真实错误，这表明应该学习更多的错误模式来检测错误。第三，虽然目前的漏洞检测工具已经检测到了大量的漏洞，但开发人员仍然需要手动修复这些漏洞，这既耗时又需要非同小可的专业知识。这项提案的目的是在使用静态漏洞检测工具帮助开发人员发现漏洞并提高软件质量时，解决上述挑战。这项建议有三个研究目标(ROS)。RO1：为了帮助消除静态错误检测器生成的误报，我和我的学生将利用深度学习(DL)技术来学习更强大的分类模型，该模型可以区分假阳性和真错误之间的语义差异，该模型将进一步集成到现有的静态错误检测工具中，以帮助筛选出假阳性。RO2：为了帮助发现新的错误模式，我和我的学生将专注于现有错误检测工具无法检测到的历史错误，并创建基于机器学习的技术来捕获潜在的错误模式。为了帮助自动修复由现有静态错误检测器检测到的错误，我的学生和我将提出基于动态链接库的方法，通过从错误的模式信息、历史修复和上下文信息中学习潜在的修复来自动修复静态错误检测器检测到的错误。 这项研究的结果将提供一个可行的解决方案，以帮助开发人员使用现代软件漏洞检测工具。拟议的技术将显著提高软件质量，并降低Shopify和RIM等加拿大公司的软件调试和开发成本。拟议的研究还将培训五名高素质人员(HQP)，并允许他们为最先进的软件工程研究和实践做出贡献。

Today, software is integrated into every part of our society. Recent research shows that software faults could cost the global economy over 300 billion dollars annually. Building reliable and secure software has become an increasingly critical challenge for software developers. Thus the techniques for helping software developers detect software faults and improve software quality and reliability will be even more important than ever before. To help developers detect faults, over the last years, many static bug detection approaches have been proposed and some have been adopted in industry. A typical static bug detector leverages programming rules or patterns to detect specific types of bugs. Despite the overall success of static bug detection, it suffers from the following major challenging issues. First, current static bug detectors report a large number of false positives, i.e., reported bugs that are not actually bugs. Recent studies show that 30-90% of reported bugs by static bug detection tools are false positives. Second, current bug detectors miss detecting around 95% of real-world bugs, which suggests more bug patterns should be learned to detect bugs. Third, although a large number of bugs have been detected by current bug detection tools, developers still have to manually fix these bugs, which is time-consuming and requires nontrivial expertise. The goal of this proposal is to address the above-mentioned challenges when using static bug detection tools to help developers find bugs and improve software quality. This proposal has three research objectives (ROs). RO1: To help remove the false positives generated by static bug detectors, my students and I will leverage deep learning (DL) techniques to learn more powerful classification models that could distinguish the semantic difference between false positives and true bugs, and the model will be further integrated into existing static bug detection tools to help filter out false positives. RO2: To help find new bug patterns, my students and I will focus on history bugs that cannot be detected by existing bug detection tools and create machine learning based techniques to capture potential bug patterns. RO3: To help automatically fix bugs detected by existing static bug detectors, my students and I will propose DL based approaches to automatically repair bugs detected by static bug detectors by learning potential fixes from pattern information, historical fixes, and context information of the bugs. The outcome of this research will provide an actionable solution to assist developers with modern software bug detection tools. The proposed techniques will significantly improve software quality and reduce software debugging and development costs among Canadian companies, e.g., Shopify and RIM. The proposed research will also train five highly qualified personnel (HQP) and allow them to contribute to state-of-the-art software engineering research and practice.