一句话：复现并扩展用静态分析错误轨迹引导动态符号执行确认告警的工作，显著提升其消假阳性性能。
静态分析是检测缺陷与保障软件安全的成熟方法，但大量误报使开发者不愿在生产中使用，且缺乏确认报告的有效技术。本文复现并扩展 Busse 等人的工作，该工作用动态符号执行（DSE）自动确认静态分析报告的潜在缺陷以消除误报。复现发现，静态分析错误轨迹仍能有效指导 DSE 确认缺陷；小幅改进后性能显著提升。作者进一步研究误报与不准确信息对性能的影响，并利用 SV-benchmarks 扩展基准，其包含非平凡注入缺陷且兼容静态分析与 DSE。目标在于展示并理解结合静态分析与符号执行以加速真阳性确认、消除假阳性的潜力。
Static analysis is a well-established method for detecting program defects and ensuring software security. However, developers often refrain from utilizing static analysis tools in production environments due to the significant time wasted on eliminating false positives. Effective techniques are missing for confirming the reports from static analyzers. This paper replicates and extends the work of Busse et al., who designed and evaluated a technique to automate the process of confirming potential bugs reported by static analysis using dynamic symbolic execution (DSE) to eliminate false positives. Our replication reveals that traces generated by static analysis reports still hold value in guiding DSE to confirm bugs. After making minor improvement modifications, we found that the performance of the technique was significantly improved and further studied the effects of false positives and inaccurate information on the performance. We also extend the benchmarks for the task by leveraging Software Verification Benchmarks (SV-benchmarks) which contain non-trivial injected bugs and is compatible with both static analysis and DSE. Our goal is to demonstrate and understand the potential of combining static analysis and symbolic execution techniques for accelerating the confirmation of true positives and the elimination of false positives.
DOI 原文 ·
@inproceedings{paperbot9606,
title = {Revisiting the Combination of Static Analysis Error Traces and Dynamic Symbolic Execution: A Potential Approach for True Positive Confirmation (Registered Report)},
author = {Yihua Xu and Chengyu Zhang and Geguang Pu},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3731720}
}