Supporting Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability ...

• Main Authors: Wickert, Anna-Katharina, Schlichtig, Michael, Vogel, Marvin, Winter, Lukas, Mezini, Mira, Bodden, Eric
• Format: Article in Journal/Newspaper
• Language: unknown
• Published: arXiv 2024
• Subjects: Software Engineering cs.SE; FOS Computer and information sciences; Rovaniemi
• Online Access: https://dx.doi.org/10.48550/arxiv.2403.07808; https://arxiv.org/abs/2403.07808

Context: Static analyses are well-established to aid in understanding bugs or vulnerabilities during the development process or in large-scale studies. A low false-positive rate is essential for the adaption in practice and for precise results of empirical studies. Unfortunately, static analyses tend to report where a vulnerability manifests rather than the fix location. This can cause presumed false positives or imprecise results. Method: To address this problem, we designed an adaption of an existing static analysis algorithm that can distinguish between a manifestation and fix location, and reports error chains. An error chain represents at least two interconnected errors that occur successively, thus building the connection between the fix and manifestation location. We used our tool CogniCryptSUBS for a case study on 471 GitHub repositories, a performance benchmark to compare different analysis configurations, and conducted an expert interview. Result: We found that 50 % of the projects with a report ... : 12 pages, 4 figures, accepted by the IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), March 12-15, 2024, Rovaniemi, Finland at the research papers track ...