With program analysis, the results one gets back are approximations (typically abstractions) of the possible concrete execution states. The problem is that there is no information on how "good", or rather how precise, the analysis results are. What we want is some measure of how precise, that is, how close to the concrete, are the analysis results produced.
There are two kinds of measures we might be interested in. First, how over-approximate is an abstract state. Roughly, what is the difference in "size" of the concretization of the abstract state and the set of possible concrete states as determined by the concrete semantics? As a simple example, consider constant propagation. An abstract value that is a constant is always perfectly precise, but "Top" (all constants) may be very imprecise if the concrete value of a variable may be 1 or 2 integers or fairly precise if the concrete value may be any integer. We can come up with similar examples in pointer analysis or shape analysis. Second, we may want to consider possible unsoundness. We want an analysis result to come with a confidence value of being sound. One application is to not make worst-case assumption about a call to unknown code. One possible way to unify these ideas is to consider a measure of how under-approximating or over-approximating an analysis state is.
Such information would give additional information to the user that helps him/her make sense of the analysis results. Another possible application is that such information could provide a more principled way to refine an analysis abstraction (either automatically or interactively).
The basic idea is to come up with an analysis framework that tracks such measures. There many places where approximation is introduced: the abstraction function, joins/widens, abstract transition relation, etc. Each of these operations would somehow track the measure of approximation.
Dynamic analysis may be useful to either 1) validate such instrumented analyses or 2) seed such measures.
Some examples may come from thinking about how much precision is lost with an x-insensitive analysis. For example, we can look at how many calls are merged with a context-insensitive analysis on a particular program. Merging 2 calls loses less precision than 100 calls. And it depends on assumptions on prior distributions of paths. Are the calls uniformly distributed?
Daniel and Amer have some work where the analysis produces "conditional measures": "if I get a coarse input here, then my output will be coarse."
Amer mentioned that work by James Cheney on provenance might be relevant.