Reachability confirmation of statically detected defects using dynamic analysis

摘要

Static and dynamic analysis of programs are well known approaches to the problem of automatic program behaviour analysis. Both methods have advantages and limitations. Static analysis has lack of precision for the sake of scalability. On the other hand, dynamic analysis has 100% precision while reaching defect point, but suffers from scalability issues. This paper describes an approach to confirmation of reachability of source-sink defects that were found by static analysis with help of dynamic analysis. The combination of methods allows to circumvent limitations and multiply their advantages. Preliminary experiments on several open source projects show that real true positive defects can be confirmed to be reachable using the approach and some false positives can be proved.