.png){kind=icon}
返回
Explaining Static Analysis With Rule Graphs
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2020.2999534.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
As static data-flow analysis becomes able to report increasingly complex bugs, using an evergrowing set of complex internal rules encoded into flow functions, the analysis tools themselves grow more and more complex. In result, for users to be able to effectively use those tools on specific codebases, they require special configurations-a task which in industry is typically performed by individual developers or dedicated teams. To efficiently use and configure static analysis tools, developers need to build a certain understanding of the analysis' rules, i.e., how the underlying analyses interpret the analyzed code and their reasoning for reporting certain warnings. In this article, we explore how to assist developers in understanding the analysis' warnings, and finding weaknesses in the analysis' rules. To this end, we introduce the concept of rule graphs that expose to the developer selected information about the internal rules of data-flow analyses. We have implemented rule graphs on top of a taint analysis, and show how the graphs can support the abovementioned tasks. Our user study and empirical evaluation show that using rule graphs helps developers understand analysis warnings more accurately than using simple warning traces, and that rule graphs can help developers identify causes for false positives in analysis rules.
Keyword:
Static analysis
Tools
SQL injection
Task analysis
Computer bugs
Cognition
Usability
Program analysis
data-flow analysis
rule graphs
analysis configuration
explainability
usability
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
.png){kind=icon}
分享收藏
查看更多内容