Static Analysis Violation Prioritization via Matrix Factorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static code analysis tools generate a high number of false positives, overwhelming development teams and reducing productivity, as different team members prioritize code quality aspects differently, leading to irrelevant or excessive results to review and fix.
Innovation Solution
A Machine Learning-based recommender system that encodes code snippets and metadata into vectors, builds a utility matrix, and applies matrix factorization to predict and prioritize violations based on user actions, displaying relevant recommendations to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static code analysis is performed on a large codebase, then code quality issues are detected, but the number of false positives increases significantly
Solution Approach 1:
The patent segments the large codebase into smaller modules or components for analysis. By dividing the codebase, the static analysis tool can focus on specific segments, reducing the overall number of false positives while maintaining detection coverage. Each segment is analyzed independently, allowing for more precise error identification.
Solution Approach 2:
The patent introduces an intermediary layer between the static analysis tool and the developer. This intermediary processes the analysis results, filters out false positives, and prioritizes genuine issues before presenting them to developers. This mediation step reduces the volume of false alarms reaching the development team.
2Reliability
If all violations are presented to developers, then comprehensive code quality coverage is achieved, but developer productivity decreases due to overwhelming volume
Solution Approach 1:
The patent applies local quality by prioritizing and presenting different types of violations based on their severity, context, and relevance to specific developers or code modules. Instead of presenting all violations uniformly, the system tailors the presentation to highlight the most critical issues first, allowing developers to focus on high-impact problems without being overwhelmed by less significant findings.
Solution Approach 2:
The patent implements partial action by selectively presenting a subset of violations to developers based on priority thresholds and contextual relevance. Rather than displaying every single violation, the system filters and presents only those that meet certain criteria for importance, enabling developers to address the most critical issues efficiently while maintaining comprehensive code quality coverage over time.
3Adaptability or versatility
If different team members review all violations, then diverse perspectives on code quality are utilized, but time and effort requirements increase significantly
Solution Approach 1:
The patent creates a universal violation prioritization system that serves multiple team members with different perspectives and expertise. The system analyzes violations once and generates prioritized recommendations that are applicable to all team members, eliminating redundant review efforts. Each violation is evaluated against multiple criteria simultaneously, providing a unified prioritization framework that accommodates diverse team perspectives without requiring each member to independently review all violations.
Data Source
AI summary
System and method for recommending static analysis fixes in a computer program include: receiving violations from a static analysis tool and the meta data related to the violations; for each violation, encoding a code snippet in which said each violation is located into a first vector and encoding meta-data associated with each violation into a second vector; for each violation, concatenating the first vector and the second vector into a single vector; generating a utility matrix from the single vectors, where values in each cell correspond to a certain user's action on one of the violations; revising the utility matrix, based on user selection of selected violations of the plurality of violations; and executing a matrix factorization process to build intermediate representations of users and sets of violations to update the utility matrix as an updated utility matrix to obtain predictions for missing values, as recommendation to the user.