一句话：提出两层持久化摘要设计 LibAlchemy，在静态缺陷检测中平衡第三方库摘要的精度与开销。
第三方库函数误用会带来质量与安全问题，但用传统静态分析检测这类缺陷并不容易。一个可行思路是离线自动生成并持久化 TPL 函数摘要，再在在线组合式静态分析中复用。然而面对数百万行 TPL 代码，现有摘要设计陷入矛盾：高精度摘要带来不可承受的空间与时间开销，而不精确摘要又会严重损害精度或召回率。本文提出 LibAlchemy，其核心是两层持久化摘要设计，试图在摘要精度与离线/在线分析开销之间取得平衡。摘要中未报告具体实验评估与量化结果。
Despite the benefits of using third-party libraries (TPLs), the misuse of TPL functions raises quality and security concerns. Using traditional static analysis to detect bugs caused by TPL function is non-trivial. One promising solution would be to automatically generate and persist the summaries of TPL functions offline and then reuse these summaries in compositional static analysis online. However, when dealing with millions of lines of TPL code, the summaries designed by existing studies suffer from an unresolved paradox. That is, a highly precise form of summary leads to an unaffordable space and time overhead, while an imprecise one seriously hurts its precision or recall.
@inproceedings{paperbot11342,
title = {LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding Systems},
author = {Rongxin Wu and Yuxuan He and Jiafeng Huang and Chengpeng Wang and Wensheng Tang and Qingkai Shi and Xiao Xiao and Charles Zhang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639132}
}