一句话：从数据中学习状态选择启发式，并为每个目标程序自适应挑选最佳模型，显著提升析取式静态缺陷查找效率。
工业级静态缺陷查找器通常执行析取式分析，即按程序不同执行路径区分程序状态。这种路径敏感性能有效降低误报，但会使分析代价呈指数增长。因此实际工具依赖状态选择启发式，只跟踪少量最有价值的状态；然而为真实程序设计好的启发式十分困难，导致现代静态缺陷查找器的代价/缺陷发现效率仍然偏低。本文提出一种基于学习的方法来解决该问题：从数据中自动学习有效的状态选择启发式。其关键技术是数据驱动的流程——高效收集触发告警的执行轨迹、学习多个候选模型，并为每个目标程序自适应地选择最合适的模型。作者以 Infer 为平台，在一系列开源 C 程序上进行评估，结果表明该技术显著提升了 Infer 的缺陷查找效率。
We present a new learning-based approach for accel-erating disjunctive static bug-finders. Industrial static bug-finders usually perform disjunctive analysis, differentiating program states along different execution paths of a program. Such path-sensitivity is essential for reducing false positives but it also increases analysis costs exponentially. Therefore, practical bug-finders use a state-selection heuristic to keep track of a small number of beneficial states only. However, designing a good heuristic for real-world programs is challenging; as a result, modern static bug-finders still suffer from low cost/bug-finding efficiency. In this paper, we aim to address this problem by learning effective state-selection heuristics from data. To this end, we present a novel data-driven technique that efficiently collects alarm-triggering traces, learns multiple candidate models, and adaptively chooses the best model tailored for each target program. We evaluate our approach with Infer and show that our technique significantly improves Infer's bug-finding efficiency for a range of open-source C programs.