一句话：结合静态分析与历史统计缺陷模型，在行级提供更少、更及时且更具体的缺陷警告。
软件缺陷检测常分为静态代码分析与基于历史数据的统计建模两条路线：静态分析能定位到具体行，却产生大量误报；统计模型可判断文件或提交是否有风险，但粒度粗且不说明具体原因。本文提出工具 WarningsGuru，将静态分析与统计缺陷模型结合，并分析仓库中的全部提交，从而在行级给出具体警告，并突出统计上高风险提交中新引入的警告。作者在两个开源项目上评估：CommitGuru 的统计模型分别将 25% 和 29% 的提交标为高风险；与静态分析结合后，含警告的高风险提交降至 20%，含新警告的提交仅 3% 和 6%，显著减少开发者需检查的提交与警告数量。工具与源码已公开。
The detection of bugs in software systems has been divided into two research areas: static code analysis and statistical modeling of historical data. Static analysis indicates precise problems on line numbers but has the disadvantage of suggesting many warning which are often false positives. In contrast, statistical models use the history of the system to suggest which files or commits are likely to contain bugs. These course-grained predictions do not indicate to the developer the precise reasons for the bug prediction. We combine static analysis with statistical bug models to limit the number of warnings and provide specific warnings information at the line level. Previous research was able to process only a limited number of releases, our tool, WarningsGuru, can analyze all commits in a source code repository and we currently have processed thousands of commits and warnings. Since we process every commit, we present developers with more precise information about when a warning is introduced allowing us to show recent warnings that are introduced in statistically risky commits. Results from two OSS projects show that CommitGuru's statistical model flags 25% and 29% of all commits as risky. When we combine this with static analysis in WarningsGuru the number of risky commits with warnings is 20% for both projects and the number commits with new warnings is only 3% and 6%. We can drastically reduce the number of commits and warnings developers have to examine. The tool, source code, and demo is available at https://github.com/louisq/warningsguru.
DOI 原文 ·
@inproceedings{paperbot4680,
title = {WarningsGuru: integrating statistical bug models with static analysis to provide timely and specific bug warnings},
author = {Louis-Philippe Querel and Peter C. Rigby},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3264599}
}