一句话：提出 RICAN，利用输入无关性与定向模糊测试覆盖关键路径，可靠消除静态分析误报。
静态分析误报率高，已有基于模型检测、符号执行、动态分析、测试或机器学习的方法要么难以扩展，要么可能错误删除真实缺陷。本文提出 RICAN，其核心洞察是输入无关性：若告警有效性在每条执行路径上均独立于程序输入，则当测试已覆盖从入口到告警点的所有相关路径且未触发缺陷时，可安全判定为误报。RICAN 先用数据依赖分析识别输入无关告警，再计算仅包含可能影响告警有效性的分支与循环的必要路径集，最后利用动态测试与后向定向模糊测试覆盖这些关键路径。在六个真实开源项目上，RICAN 从 2912 个 double free、use-after-free 和空指针解引用告警中可靠消除 1313 个误报（45.09%），开销可忽略；用户研究显示其平均减少超过 70% 的人工检查工作量，并帮助程序员更快、更准确地发现缺陷。
Static analysis is a foundational technique for detecting software defects, yet it notoriously suffers from high false positive rates. Prior efforts to reduce false positives via model checking, symbolic execution, dynamic analysis, testing, or machine learning either fail to scale or mistakenly eliminate real defects. This paper presents RICAN, a novel approach that leverages dynamic testing to reliably eliminate false alarms in static analysis. The key insight behind RICAN is the concept of input-agnosticity: if the validity of an alarm is independent of program inputs along each execution path, then once all such paths from the program entry to the alarm site have been exercised by tests without triggering the alarmed bug, the alarm can be safely classified as a false positive. To realize this insight, RICAN uses data-dependence analysis to identify input-agnostic alarms among all reported alarms. However, validating even input-agnostic alarms requires exploring all feasible paths, which is generally infeasible. To address this, RICAN computes a necessary set of paths by identifying only those branches and loops that may influence the alarm's validity. Finally, RICAN eliminates false alarms using existing dynamic testing and post-directed fuzzing to cover these critical paths. We evaluate RICAN on six real-world open-source projects. Our experiments show that RICAN can reliably eliminate 1,313 (45.09%) false positives across 2,912 double free, use-after-free, and null pointer dereference alarms, while incurring negligible overhead. Our user studies further demonstrate that RICAN reduces the manual effort required for alarm inspection by over 70% on average and helps programmers find bugs more quickly and accurately, highlighting its practical usefulness in real-world static analysis.
@article{WangWWW26,
title = {Bridging Coverage and Confidence: Reliable Static False Alarm Elimination via Input-Agnosticity},
author = {Jiayi Wang and Yu Wang and Linzhang Wang and Ke Wang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {PLDI},
year = {2026},
doi = {10.1145/3808301}
}