Static Code Analysis False Positive Reduction via ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static code analysis tools often produce a high number of false positive violations, which hinder development and testing progress and hinder the adoption of static code analysis in software development practices, as existing machine learning approaches have limitations in filtering these results effectively.
Innovation Solution
A method that combines static analysis features with code representation features using a language model and meta-data, such as author and creation date, to construct feature vectors for test violations, and applies statistical learning techniques to estimate the probability of true errors or false positives, thereby prioritizing relevant findings for development teams.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static code analysis is performed to identify errors in program code, then error detection capability is improved, but the number of false positive violations increases
Solution Approach 1:
A machine learning model is introduced as an intermediary between the static code analyzer and the development team. The model takes violation data from the static analyzer and processes it through learned patterns to predict whether each violation is a true error or false positive, filtering out false positives before they reach developers
Solution Approach 2:
The system implements feedback by using labeled violation data (where human experts have identified true errors vs. false positives) to train the machine learning model. The model continuously improves by learning from past violations and their outcomes, adjusting its predictions based on patterns in the feedback data
2Object-generated harmful factors
If traditional machine learning approaches are used to filter static code analysis results, then false positive reduction is attempted, but effectiveness is limited due to reliance on basic source code metrics
Solution Approach 1:
The system changes the parameters fed to the machine learning model from basic source code metrics (like number of if statements or for statements) to enriched violation data that includes static analysis results, code representation features from language models, and violation metadata. This parameter enrichment significantly improves filtering precision
Solution Approach 2:
The approach combines multiple types of data into a composite feature set for the machine learning model: static analysis violation data, code representation vectors from language models (such as BERT or CodeBERT), and violation metadata. This composite approach creates a more robust filtering system than any single data type alone
3Measurement precision
If all test violations are analyzed manually to determine true errors, then accuracy is improved, but time consumption and resource requirements increase significantly
Solution Approach 1:
Instead of requiring manual analysis of all violations, the system performs partial manual analysis on a labeled subset of violations to train the machine learning model. Once trained, the model automatically processes the remaining violations, achieving high accuracy without the time cost of complete manual review
Solution Approach 2:
The machine learning model performs preliminary filtering of violations before they reach manual reviewers. By pre-processing and prioritizing violations based on predicted true error probability, the system reduces the overall time required for error identification while maintaining high accuracy
Data Source
AI summary
Computer-implemented method for improving the test results of a static code analyzer includes: receiving a plurality of test violations from the static code analyzer; constructing a first vector for each code snippet containing error candidates; constructing a second vector for each test violation from meta-data associated with said each test violation; merging the first vector with the second vector to produce a feature vector for each test violation; and applying statistical learning techniques to each feature vector to estimate a probability that an error candidate in the plurality of test violations is a true error or a false positive.