Test based static analysis misinformation eliminating method

Abstract

The invention provides a test based static analysis misinformation eliminating method capable of enhancing usability of a software static analysis technology and reducing time and labor cost in artificially confirming and testing a static analysis report. A testing technology is adopted to acquire procedural information which is mutually verified with target paths and target defects related in the static analysis report to confirm the defects or eliminate misinformation. The test based static analysis misinformation elimination method includes reading static analysis report files stored in a metadata interchange format based on an extensible markup language, and analyzing information with the target defects; subjecting each specified defect to static analysis warning, performing continuous concrete execution, symbolic execution and constraint solving on a programs by adopting an idea of mixed execution, and modeling and acquiring the runtime information according to features with different defects during the course; adopting the runtime information acquired in the previous step to confirm whether the defects occur or not, or judging that the static analysis warning is the misinformation; iterating till all the static analysis warnings are processed.

Description

technical field [0001] The present invention relates to a technique for reducing the number of false positives in static analysis results by using a test method, mainly using a dynamic test technology combining symbolic execution and specific execution to verify the static analysis results, and realizing the judgment and elimination of false positives in software static analysis results. It belongs to the technical field combining software engineering, software testing, and software dynamic and static analysis. Background technique [0002] Both static analysis and dynamic analysis techniques are used to find program defects in C / C++ programs. Static analysis techniques usually formalize different types of software defect detection processes as a specific matching problem, that is, to match the characteristics or patterns of a certain defect in the target analysis program. Because software defects often occur on specific control flow paths, most static analysis techniques a...

AI Technical Summary

Problems solved by technology

However, static analysis tools may sacrifice accuracy for better scalability, resulting in inaccurate modeling of many important program properties, such as heap memory cells, etc.

In addition, due to the lack of runtime information, static analysis tools often report a large number of unacknowledged alarms, while real memory leaks are hidden

This severely limits the usability of static analysis tools in real development, even a mature commercial static analysis tool may report a large number of alarms when analyzing moderate-sized programs

Manually reviewing all these alerts and finding real defects is a difficult, tedious and time-consuming job

Images