一句话：FuzzSlice 以函数级 fuzzing 验证静态分析警告，从而剪除误报、降低人工确认成本。
静态分析报告的人工确认十分繁重，原因在于警告数量庞大且其中误报密度很高。已有工作尝试用 fuzzing 验证静态分析警告，但关键瓶颈是：为触达所有警告而对整个项目进行 fuzzing 并不可行，可能需要数天时间，且机器时间随代码覆盖率线性增长而呈指数上升。FuzzSlice 将 fuzzing 的粒度从整个项目缩小到单个函数，通过对函数级代码进行模糊测试来验证静态分析警告，并据此剪除误报，从而避免全项目 fuzzing 带来的不可行开销。摘要未给出具体实验评估结果。
Manual confirmation of static analysis reports is a daunting task. This is due to both the large number of warnings and the high density of false positives among them. Fuzzing techniques have been proposed to verify static analysis warnings. However, a major limitation is that fuzzing the whole project to reach all static analysis warnings is not feasible. This can take several days and exponential machine time to increase code coverage linearly.
@inproceedings{paperbot11255,
title = {FuzzSlice: Pruning False Positives in Static Analysis Warnings through Function-Level Fuzzing},
author = {Aniruddhan Murali and Noble Mathews and Mahmoud Alfadel and Meiyappan Nagappan and Meng Xu},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3623321}
}