一句话:提出自动学习调用图剪枝器,在静态空指针分析中兼顾减少误报边与保留真边,将误报率从73%降至23%。
静态分析工具常因误报率过高而难以被开发者接受。本文针对许多静态分析核心的静态调用图,提出一种剪枝技术:先照常构建调用图,再用自动、提前学习得到的剪枝器删除大量误报边,同时尽量保留真实边。难点在于把握剪枝力度,既要积极删除误报边,又不能过度剪枝而丢失真边。作者将学习得到的调用图剪枝器集成到空指针分析工具中并评估其效果。结果表明,该工具的误报率从73%降至23%,虽然报告的错误更少,但误报也显著减少,从而提升了工具对开发者的实用性。
Researchers have reported that static analysis tools rarely achieve a false-positive rate that would make them attractive to developers. We overcome this problem by a technique that leads to reporting fewer bugs but also much fewer false positives. Our technique prunes the static call graph that sits at the core of many static analyses. Specifically, static call-graph construction proceeds as usual, after which a call-graph pruner removes many false-positive edges but few true edges. The challenge is to strike a balance between being aggressive in removing false-positive edges but not so aggressive that no true edges remain. We achieve this goal by automatically producing a call-graph pruner through an automatic, ahead-of-time learning process. We added such a call-graph pruner to a software tool for null-pointer analysis and found that the false-positive rate decreased from 73% to 23%. This improvement makes the tool more useful to developers.