Collaborative Research: SHF: Small: An Automated Full-Lifecycle Approach for Improving the Development and Use of Static Analysis

因为软件故障可能并且确实会导致严重的，甚至危及生命的损失，所以有效的质量保证仍然是软件开发人员经常关心的问题。事实上，在过去的几十年里，已经开发了许多软件分析技术来解决这个问题。这些技术是检测错误或证明错误不存在的强大手段。尽管静态程序分析工具在理论上具有优势，但其在行业中的应用相对有限。以实际解决方案为目标的静态分析工具被迫进行近似，在精度（例如，更好的建模以确保正确性）和性能（例如，更快的分析）之间进行权衡。在开发和使用静态分析工具时，在性能和精度之间找到适当的平衡是极具挑战性的。本项目旨在减少克服这种权衡的实际障碍。这个项目的成功结果可能会提高静态分析工具的采用率，从而提高社会所依赖的关键软件的安全性、安全性和功能性。这个项目的目标是通过内聚开发和使用生命周期来实现更有效的静态分析设计和使用，这些开发和使用生命周期得到了自动化支持的有力增强。这种自动化支持包括系统评估和生成静态分析工具的基准，定位不精确和性能瓶颈的来源，配置可能产生正确和及时结果的工具设置，使用机器学习方法识别和过滤误报，并将这些改进集成到一个演示系统中，该系统利用来自工具开发人员和工具用户的信息和经验。这种增强的和自动化的生命周期将识别频繁出现的代码模式，这些模式会显著影响特定工具的性能/精度权衡，从而允许工具开发人员快速改进他们的工具。它还将使工具能够针对特定目标程序定制其行为和分析方法。同时，这将为静态分析工具用户提供自动调优工具配置的支持，以快速获得更有效的结果。这是由工具错误报告的自动分类支持的，减少了调查误报所浪费的精力。这些改进相互配合使用将大大改进静态分析工具，并大大增加这些工具在分析实际软件中的使用。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Because software failures can and do cause severe, even life-threatening losses, effective quality assurance remains a constant concern for software developers. In fact, over the past decades, numerous software analysis techniques have been developed to address this concern. These techniques represent a powerful means of detecting bugs or proving their absence. Despite their theoretical superiority, static program analysis tools have had relatively limited industry adoption. Static analysis tools aiming for practical solutions are forced to approximate, trading off precision (i.e., better modeling to ensure correctness) against performance (i.e., faster analysis). Finding the right balance of the complex tradeoffs between performance and precision when developing and using static analysis tools is extremely challenging. This project seeks to reduce practical barriers to conquering this tradeoff. Successful outcomes of this project are likely to improve static analysis tool adoption rates, and thereby improve the safety, security and functionality of critical software that society depends upon. This project aims to achieve more effective static analysis design and usage through cohesive development and usage lifecycle that is powerfully augmented with automated support. This automated support includes systematic evaluation and generation of benchmarks for static analysis tools, localizing sources of imprecision and performance bottlenecks, configuring tool settings that are likely to produce correct and timely results, using machine learning approaches to identify and filter false positives, and integrating these improvements into a demonstration system that leverages information and experiences coming from both tool developers and tool users. This augmented and automated lifecycle will identify frequently occurring code patterns that significantly affect performance/precision tradeoffs in specific tools, allowing tool developers to quickly improve their tools. It will also enable tools designed to customize their behavior and analysis approaches to specific target programs. At the same time, this will provide static analysis tool users with automated support for tuning tool configurations to quickly get more effective results. This is supported by automated classification of tool error reports, reducing effort wasted investigating false positives. These improvements used in concert with each other will result in greatly improved static analysis tools, and much-increased use of these tools in analyzing real-world software.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.