Improving Static Code Analysis Using Machine Learning Methods

验证计算机程序既昂贵又困难。可用的经验测试通常是耗时的和特别的，只提供了对正在分析的程序的零碎理解。静态代码分析是评估程序的无价资产，它通过检查源代码来执行计算机程序调试，而不是明确地执行程序。然而，大多数现有的静态分析工具的主要缺点是产生无法管理的假阳性，同时需要大量昂贵的人工干预。这个研究项目通过开发机器学习方法来解决这个问题，这些方法可以提高代理检测虚假漏洞的能力，并诱导更可靠的静态分析器。该项目将为Software Secure的旗舰产品Omega及其客户的开发带来实实在在的好处，他们将节省目前花费在错误检测上的无数工时，并将对提高复杂软件的总体质量产生重大影响。

Verifying computer programs is expensive and difficult. The available empirical tests are oftentime-consuming and ad-hoc providing only a fragmented understanding of the program being analyzed. Staticcode analysis, which performs computer program debugging by examining the source code without explicitlyexecuting the program, is an invaluable asset for evaluating programs. However, most existing static analysistools have major drawback of producing unmanageable number of false positives, while requiring significantcostly manual interventions. This research project addresses this problem by developing machine learningapproaches that increase the agent's ability to detect false vulnerabilities and induce more reliable staticanalyzers. The project will provide a tangible benefit to the development of Software Secured's flagshipproduct Omega and their clients who will save countless man-hours currently spent triaging false positives.It also will have a significant impact on improving the quality of complex softwares in general.