Mitigating False Positive Static Analysis Warnings: Progress, Challenges, and Opportunities

Zhaoqiang Guo

doi:10.1109/TSE.2023.3329667

Mitigating False Positive Static Analysis Warnings: Progress, Challenges, and Opportunities

2023-12-01

5

PRE

AI

DOI：10.1109/TSE.2023.3329667

原文链接

原文求助

摘要

En 中文

Static analysis (SA) tools can generate useful static warnings to reveal the problematic code snippets in a software system without dynamically executing the corresponding source code. In the literature, static warnings are of paramount importance because they can easily indicate specific types of software defects in the early stage of a software development process, which accordingly reduces the maintenance costs by a substantial margin. Unfortunately, due to the conservative approximations of such SA tools, a large number of false positive (FP for short) warnings (i.e., they do not indicate real bugs) are generated, making these tools less effective. During the past two decades, therefore, many false positive mitigation (FPM for short) approaches have been proposed so that more accurate and critical warnings can be delivered to developers. This paper offers a detailed survey of research achievements on the topic of FPM. Given the collected 130 surveyed papers, we conduct a comprehensive investigation from five different perspectives. First, we reveal the research trends of this field. Second, we classify the existing FPM approaches into five different types and then present the concrete research progress. Third, we analyze the evaluation system applied to examine the performance of the proposed approaches in terms of studied SA tools, evaluation scenarios, performance indicators, and collected datasets, respectively. Fourth, we summarize the four types of empirical studies relating to SA warnings to exploit the insightful findings that are helpful to reduce FP warnings. Finally, we sum up 10 challenges unresolved in the literature from the aspects of systematicness, effectiveness, completeness, and practicability and outline possible research opportunities based on three emerging techniques in the future.

Keyword:

Static warnings

false positives

defects

static analysis tools

software quality assurance

Mitigating False Positive Static Analysis Warnings: Progress, Challenges, and Opportunities

摘要

期刊

机构

引用论文