一句话：提出基于可靠依赖的静态分析告警健全聚类，若簇主导告警为假则同簇其余告警必假，减少45%告警报告。
静态分析器常产生大量告警，其中许多为误报，给人工审查带来沉重负担。本文提出一种健全的告警聚类方法，不依赖统计启发式，而是发现告警之间的可靠依赖关系。聚类满足：若一个簇中的主导告警被判定为误报，则同簇其余告警也必定为误报，从而可安全地合并报告。作者在真实的缓冲区溢出分析器上实现了该聚类算法，并证明其能减少45%的告警报告。该框架适用于任何基于抽象解释的静态分析，且与抽象精化及统计排序方案正交，可作为现有分析流程的补充。
We present a sound method for clustering alarms from static analyzers. Our method clusters alarms by discovering sound dependencies between them such that if the dominant alarms of a cluster turns out to be false, all the other alarms in the same cluster are guaranteed to be false. We have implemented our clustering algorithm on top of a realistic buffer-overflow analyzer and proved that our method reduces 45% of alarm reports. Our framework is applicable to any abstract interpretation-based static analysis and orthogonal to abstraction refinements and statistical ranking schemes.
@article{LeeLY12,
title = {Sound Non-Statistical Clustering of Static Analysis Alarms},
author = {Woosuk Lee and Wonchan Lee and Dongok Kang and Kihong Heo and Hakjoo Oh and Kwangkeun Yi},
journal = {ACM Transactions on Programming Languages and Systems},
volume = {39},
number = {4},
year = {2017},
doi = {10.1145/3095021}
}