Machine Learning-Powered Automated Software Bug Detection

今天，软件已经融入了我们社会的方方面面。最近的研究表明，软件故障每年可能给全球经济造成超过3000亿美元的损失。构建可靠和安全的软件已成为软件开发人员面临的日益严峻的挑战。因此，帮助软件开发人员检测软件故障并提高软件质量和可靠性的技术将比以往任何时候都更加重要。为了帮助开发人员检测错误，在过去的几年中，提出了许多静态错误检测方法，其中一些已被业界采用。典型的静态bug检测器利用编程规则或模式来检测特定类型的bug。尽管静态错误检测总体上取得了成功，但它仍然面临以下主要的挑战问题。首先，当前的静态bug检测器报告了大量误报，也就是说，报告的bug实际上并不是bug。最近的研究表明，静态bug检测工具报告的bug中有30-90%是误报。其次，目前的bug检测器无法检测到大约95%的真实bug，这表明应该学习更多的bug模式来检测bug。第三，尽管目前的bug检测工具已经检测到大量的bug，但是开发人员仍然需要手动修复这些bug，这是非常耗时的，并且需要非常专业的知识。本提案的目标是在使用静态错误检测工具帮助开发人员发现错误并提高软件质量时解决上述挑战。本提案有三个研究目标（ROs）。RO1：为了帮助消除静态bug检测器产生的假阳性，我和我的学生将利用深度学习（DL）技术来学习更强大的分类模型，这些模型可以区分假阳性和真bug之间的语义差异，并且该模型将进一步集成到现有的静态bug检测工具中，以帮助过滤掉假阳性。RO2：为了帮助发现新的错误模式，我和我的学生将专注于现有错误检测工具无法检测到的历史错误，并创建基于机器学习的技术来捕获潜在的错误模式。RO3：为了帮助自动修复现有静态错误检测器检测到的错误，我和我的学生将提出基于深度学习的方法，通过从错误的模式信息、历史修复和上下文信息中学习潜在的修复，来自动修复静态错误检测器检测到的错误。这项研究的结果将提供一个可操作的解决方案，以帮助开发人员使用现代软件缺陷检测工具。所提出的技术将显著提高加拿大公司的软件质量，降低软件调试和开发成本，例如Shopify和RIM。拟议的研究还将培训五名高素质人员（HQP），并使他们能够为最先进的软件工程研究和实践做出贡献。

Today, software is integrated into every part of our society. Recent research shows that software faults could cost the global economy over 300 billion dollars annually. Building reliable and secure software has become an increasingly critical challenge for software developers. Thus the techniques for helping software developers detect software faults and improve software quality and reliability will be even more important than ever before. To help developers detect faults, over the last years, many static bug detection approaches have been proposed and some have been adopted in industry. A typical static bug detector leverages programming rules or patterns to detect specific types of bugs. Despite the overall success of static bug detection, it suffers from the following major challenging issues. First, current static bug detectors report a large number of false positives, i.e., reported bugs that are not actually bugs. Recent studies show that 30-90% of reported bugs by static bug detection tools are false positives. Second, current bug detectors miss detecting around 95% of real-world bugs, which suggests more bug patterns should be learned to detect bugs. Third, although a large number of bugs have been detected by current bug detection tools, developers still have to manually fix these bugs, which is time-consuming and requires nontrivial expertise. The goal of this proposal is to address the above-mentioned challenges when using static bug detection tools to help developers find bugs and improve software quality. This proposal has three research objectives (ROs). RO1: To help remove the false positives generated by static bug detectors, my students and I will leverage deep learning (DL) techniques to learn more powerful classification models that could distinguish the semantic difference between false positives and true bugs, and the model will be further integrated into existing static bug detection tools to help filter out false positives. RO2: To help find new bug patterns, my students and I will focus on history bugs that cannot be detected by existing bug detection tools and create machine learning based techniques to capture potential bug patterns. RO3: To help automatically fix bugs detected by existing static bug detectors, my students and I will propose DL based approaches to automatically repair bugs detected by static bug detectors by learning potential fixes from pattern information, historical fixes, and context information of the bugs. The outcome of this research will provide an actionable solution to assist developers with modern software bug detection tools. The proposed techniques will significantly improve software quality and reduce software debugging and development costs among Canadian companies, e.g., Shopify and RIM. The proposed research will also train five highly qualified personnel (HQP) and allow them to contribute to state-of-the-art software engineering research and practice.