Embedded Files
Automatic Identification of False Alarms
Summary:
Static Code Analysis (SCA) tools try to find bugs by analyzing the source code using some static analysis techniques which do not require executing the code. Different static analysis techniques such as syntactic pattern matching, data flow analysis, model checking and verification theorems have been used by these tools to discover a wide range of bugs. While intending to help quickly identifying bugs in the program, these tools however, usually generate an unduly enormous number of warnings due to the use of underlying approximate analysis techniques. This information overload can easily hinder the potential benefits of such tools. Understanding the warnings and their categorization can help to perceive the strengths and limitations of these SCA tools. Our project aims to develop a tool which automatically filters the false alarms generated by the SCA tools, which will help testers to only concentrate on actual errors.
The Project:
Software contain bugs. A software bug is a defect in the software. As a result, the functionality of the software might get altered and disrupted. Some bugs are easy to find whereas others are almost impossible to figure out as the code having these bugs may never get exercised, or their execution may not result in observed failures. Some bugs that come up may even go unnoticed because they are not apprehended as bugs or are not enough severe. Software bugs are caused by several types of errors that are made while coding. An error is a mismatch between the program and its specifications. For instance, bugs may be resulted due to the programming errors made intentionally or unintentionally, like logical inconsistencies (e.g., a conditional test that cannot possibly be true), runtime errors (e.g., dereferencing a null pointer), resource leaks (performance of the program degrades until the program crashes) or potential security violations (e.g., SQL injection). Software bugs can outlay companies large amounts of money, specifically when they induce to software failures. Hence, fixing bugs before the software is put to use, is very important.
SCA can be viewed as an automated code review process. It is used for detecting bugs in the source code without the need of executing the code. It looks for violations within the code and some specific type of programming errors. Additionally it can help in maintaining the coding conventions.
Process of Identification of False Alarms (Membrane soft)
References:
Nagappan, Nachiappan, and Thomas Ball. "Static analysis tools as early indicators of pre-release defect density." Proceedings of the 27th international conference on Software engineering. ACM, 2005.
Emanuelsson, Pär, and Ulf Nilsson. "A comparative study of industrial static analysis tools." Electronic notes in theoretical computer science 217 (2008): 5-21.
Ayewah, Nathaniel, et al. "Using static analysis to find bugs." Software, IEEE 25.5 (2008): 22-29.
List of Open Source Tools for Static Code Analysis - https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
Static Program Analysis - https://en.wikipedia.org/wiki/Static_program_analysis
Findbugs - http://findbugs.sourceforge.net/
Page updated
Google Sites
Report abuse