一句话：提出InferROI，用LLM推断资源获取/释放/可达性验证意图，再结合两阶段静态分析提升资源泄漏检测。
资源未释放会导致性能问题与系统崩溃。现有静态检测依赖预定义API与空值检查的机械匹配，因API集合不完整而漏报，因可达性验证识别不全而误报。本文提出InferROI，用大语言模型推断代码中的资源导向意图（获取、释放、可达性验证），再结合两阶段静态分析沿控制流路径检测泄漏。在DroidLeaks与JLeaks上，检测率为59.3%和62.5%，误报率为18.6%和19.5%，相比三个工业检测器分别多检出14~45与149~485个缺陷；在真实开源项目中识别29个未知泄漏，7个获开发者确认。消融实验表明LLM推断与静态分析结合必要；意图推断精度74.6%、召回81.8%，覆盖60%以上资源类型。
Resource leaks, caused by resources not being released after acquisition, often lead to performance issues and system crashes. Existing static detection techniques rely on mechanical matching of predefined resource acquisition/release APIs and null-checking conditions to find unreleased resources, suffering from both (1) false negatives caused by the incompleteness of predefined resource acquisition/release APIs and (2) false positives caused by the incompleteness of resource reachability validation identification. To overcome these challenges, we propose InferROI, a novel approach that leverages the exceptional code comprehension capability of large language models (LLMs) to directly infer resource-oriented intentions (acquisition, release, and reachability validation) in code. InferROI first prompts the LLM to infer involved intentions for a given code snippet, and then incorporates a two-stage static analysis approach to check control-flow paths for resource leak detection based on the inferred intentions. We evaluate the effectiveness of InferROI in both resource-oriented intention inference and resource leak detection. Experimental results on the DroidLeaks and JLeaks datasets demonstrate InferROI achieves promising bug detection rate (59.3% and 62.5%) and false alarm rate (18.6% and 19.5%). Compared to three industrial static detectors, InferROI detects 14~45 and 149~485 more bugs in DroidLeaks and JLeaks, respectively. When applied to real-world open-source projects, InferROI identifies 29 unknown resource leak bugs (verified by authors), with 7 of them being confirmed by developers. In addition, the results of an ablation study underscores the importance of combining LLM-based inference with static analysis. Finally, manual annotation indicated that InferROI achieved a precision of 74.6% and a recall of 81.8% in intention inference, covering more than 60% resource types involved in the datasets.
DOI 原文 ·
@inproceedings{paperbot8813,
title = {Boosting Static Resource Leak Detection via LLM-based Resource-Oriented Intention Inference},
author = {Chong Wang and Jianan Liu and Xin Peng and Yang Liu and Yiling Lou},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00131}
}