We present a sound method for clustering alarms from static analyzers. Our method clusters alarms by discovering sound dependencies between them such that if the dominant alarms of a cluster turns out to be false, all the other alarms in the same cluster are guaranteed to be false. We have implemented our clustering algorithm on top of a realistic buffer-overflow analyzer and proved that our method reduces 45% of alarm reports. Our framework is applicable to any abstract interpretation-based static analysis and orthogonal to abstraction refinements and statistical ranking schemes.

@article{LeeLY12,
  title = {Sound Non-Statistical Clustering of Static Analysis Alarms},
  author = {Woosuk Lee and Wonchan Lee and Dongok Kang and Kihong Heo and Hakjoo Oh and Kwangkeun Yi},
  journal = {ACM Transactions on Programming Languages and Systems},
  volume = {39},
  number = {4},
  year = {2017},
  doi = {10.1145/3095021}
}