一句话：提出 ViolationTracker，通过代码实体锚定与处理合并提交，精确匹配相邻修订间的静态分析违规并重建其生命周期。
自动静态分析工具常因误报多、规则优先级与配置不当而难以采纳。追踪违规历史有助于理解开发者对检测结果的期望，但相邻修订间违规匹配不精确，且合并提交常被忽略，准确识别引入或修复违规的修订仍很困难。本文提出 ViolationTracker，利用代码实体锚定启发式匹配相邻修订中的违规实例，并处理合并提交，构建包含引入、修复、删除和重新打开等事件的违规生命周期。在含 500 个违规实例、30 类违规案例的 158 条线程的手工验证数据集上，违规匹配达到 93% 以上精确率和 98% 召回率，优于现有方法；违规历史重建精确率为 99.4%。初步实证还表明可据此识别可操作违规并优先排序规则。
Automatic static analysis tools (ASATs) detect source code violations to static analysis rules and are usually used as a guard for source code quality. The adoption of ASATs, however, is often challenged because of several problems such as a large number of false alarms, invalid rule priorities, and inappropriate rule configurations. Research has shown that tracking the history of the violations is a promising way to solve the above problems because the facts of violation fixing may reflect the developers' subjective expectations on the violation detection results. Precisely identifying the revisions that induce or fix a violation is however challenging because of the imprecise matching of violations between code revisions and ignorance of merge commits in the maintenance history. In this paper, we propose ViolationTracker, an approach to precisely matching the violation instances between adjacent revisions and building the life cycle of violations with the identification of inducing, fixing, deleting, and reopening of each violation case. The approach employs code entity anchoring heuristics for violation matching and considers merge commits that used to be ignored in existing research. We evaluate ViolationTracker with a manually-validated dataset that consists of 500 violation instances and 158 threads of 30 violation cases with detailed evolution history from open-source projects. Violation Tracker achieves over 93 % precision and 98 % recall on violation matching, outperforming the state-of-the-art approach, and 99.4 % precision on rebuilding the histories of violation cases. We also show that ViolationTracker is useful to identify actionable violations. A preliminary empirical study reveals the possibility to prioritize static analysis rules according to further analysis on the actionable rates of the rules.
@inproceedings{YuWPPZXZ23,
title = {ViolationTracker: Building Precise Histories for Static Analysis Violations},
author = {Ping Yu and Yijian Wu and Xin Peng and Jiahan Peng and Jian Zhang and Peicheng Xie and Wenyun Zhao},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00171}
}