一句话：用 Transformer 模型识别静态分析误报，将分析精度提升 17.5%。
现代软件设计日益复杂、迭代迅速，代码缺陷与安全漏洞普遍存在，程序员依赖静态分析工具定期扫描代码库以发现潜在缺陷。然而为追求覆盖率，这类工具往往报告大量误报，开发者不得不逐条人工核查。本文提出一种基于 Transformer 的学习方法，用于判定静态分析告警是否为误报，从而在不牺牲覆盖率的前提下提升告警质量。实验表明，该模型可将静态分析的精度提升 17.5%，并且作者在空指针解引用与资源泄漏两大类缺陷上验证了方法的泛化能力，说明该思路并不局限于单一缺陷类型，具备跨缺陷类型迁移的潜力。
Due to increasingly complex software design and rapid iterative development, code defects and security vulnerabilities are prevalent in modern software. In response, programmers rely on static analysis tools to regularly scan their codebases and find potential bugs. In order to maximize coverage, however, these tools generally tend to report a significant number of false positives, requiring developers to manually verify each warning. To address this problem, we propose a Transformer-based learning approach to identify false positive bug warnings. We demonstrate that our models can improve the precision of static analysis by 17.5%. In addition, we validated the generalizability of this approach across two major bug types: null dereference and resource leak.
@inproceedings{paperbot6902,
title = {Learning to reduce false positives in analytic bug detectors},
author = {Anant Kharkar and Roshanak Zilouchian Moghaddam and Matthew Jin and Xiaoyu Liu and Xin Shi and Colin Clement and Neel Sundaresan},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510153}
}