False positive elimination in suspected code fault automatic confirmation

摘要

Since code static analysis can not simultaneously maintain the reliability and completeness, the analysis result has a large number of false positives. Therefore, it is great significance to eliminate the false positives. In this paper, based on the path-sensitive and demand-drive, an approach for eliminating false positives in the initial results of static analysis, and thus confirming part of suspected faults is presented. Our approach employs two main techniques, demand-driven based local program analysis and searching correlation procedures of defect feature, which can not only avoid an exhaustive program exploration, but also undertake detailed path analysis on the correlation procedures that improves the accuracy of analysis. In order to illustrate and verify our approach, an experimental study is performed on the five open source C projects. The results show that, compared with state-of-the-art approaches, our approach takes less time and can eliminate more false positives.