一句话:提出 BayeSmith,自动学习静态分析告警概率模型的结构与权重,以更好排序真实缺陷并减少误报。
现有静态分析告警的概率推理技术虽能结合外部反馈降低人工检查负担,但其模型结构预定义,难以跨程序学习或迁移知识,且常对外部反馈过度泛化,导致真实缺陷被误抑制。BayeSmith 从初始模型和带缺陷标签的训练程序出发,自动学习概率模型的结构与权重,并据此优化对真实缺陷的优先级排序。作者在 C 程序集上使用两种静态分析进行评估,证明所学模型显著提升三种先进概率推理系统的性能。
We present BayeSmith, a general framework for automatically learning probabilistic models of static analysis alarms. Several probabilistic reasoning techniques have recently been proposed which incorporate external feedback on semantic facts and thereby reduce the user's alarm inspection burden. However, these approaches are fundamentally limited to models with pre-defined structure, and are therefore unable to learn or transfer knowledge regarding an analysis from one program to another. Furthermore, these probabilistic models often aggressively generalize from external feedback and falsely suppress real bugs. To address these problems, we propose BayeSmith that learns the structure and weights of the probabilistic model. Starting from an initial model and a set of training programs with bug labels, BayeSmith refines the model to effectively prioritize real bugs based on feedback. We evaluate the approach with two static analyses on a suite of C programs. We demonstrate that the learned models significantly improve the performance of three state-of-the-art probabilistic reasoning systems.