Affiliation:
1. Tata Consultancy Services, Hadapasar I.E., Pune, India
2. Eindhoven University of Technology, Eindhoven, The Netherlands
Abstract
Static analysis tools have showcased their importance and usefulness in automated detection of defects. However, the tools are known to generate a large number of alarms which are warning messages to the user. The large number of alarms and cost incurred by their manual inspection have been identified as two major reasons for underuse of the tools in practice. To address these concerns plentitude of studies propose postprocessing of alarms: processing the alarms after they are generated. These studies differ greatly in their approaches to postprocess alarms. A comprehensive overview of the postprocessing approaches is, however, missing.
In this article, we review 130 primary studies that propose postprocessing of alarms. The studies are collected by combining keywords-based database search and snowballing. We categorize approaches proposed by the collected studies into six main categories:
clustering, ranking, pruning, automated elimination of false positives, combination of static and dynamic analyses,
and
simplification of manual inspection.
We provide overview of the categories and sub-categories identified for them, their merits and shortcomings, and different techniques used to implement the approaches. Furthermore, we provide (1) guidelines for selection of the postprocessing techniques by the users/designers of static analysis tools; and (2) directions that can be explored by the researchers.
Publisher
Association for Computing Machinery (ACM)
Subject
General Computer Science,Theoretical Computer Science
Reference191 articles.
1. Integrating Static and Dynamic Analysis for Detecting Vulnerabilities
2. Using Machine Learning Techniques to Classify and Predict Static Code Analysis Tool Warnings
3. A Framework to Compare Alert Ranking Algorithms
4. Hirohisa Aman, Sousuke Amasaki, Tomoyuki Yokogawa, and Minoru Kawahara. 2019. A survival analysis-based prioritization of code checker warning: A case study using PMD. In International Conference on Big Data, Cloud Computing, and Data Science Engineering. Springer, 69–83.
5. Tool support for fine-grained software inspection
Cited by
6 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献