Evaluating static analysis defect warnings on production software

ACM SIGPLAN/SIGSOFT Workshop on Program Analysis for Software Tools and Engineering

Volumn , Issue , 2007, Pages 1-7

  Ayewah, Nathaniel ^a   Pugh, William ^a   Morgenthaler, J David ^b   Penix, John ^b   Zhou, Yuqian ^b  

^a UNIVERSITY OF MARYLAND   (United States)

^b GOOGLE INC   (United States)

Author keywords

Bug patterns; Bugs; False positives; FindBugs; Java; Software defects; Software quality; Static analysis

Indexed keywords

BUG PATTERNS; SOFTWARE DEFECTS; SOFTWARE QUALITY;

COMPUTER SOFTWARE MAINTENANCE; JAVA PROGRAMMING LANGUAGE; STATIC ANALYSIS;

COMPUTER SOFTWARE;

EID: 36549070602     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1251535.1251536     Document Type: Conference Paper

References (13)

1. A. Almossawi, K. Lim, and T. Sinha. Analysis tool evaluation: Coverity prevent, May 2006. http://www.cs.cmu.edu/aldrich/courses/654/tools/cure- coverity-06.pdf.
2. K. I. Boudnik. Static analyzers comparison, October 2006. http://weblogs.java.net/blog/cos/archive/2006/10/static_analyzer.html.
3. B. Chelf, D. Engler, and S. Hallem. How to write system-specific, static checkers in metal. In PASTE '02: Proceedings of the 2002 ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering, pages 51-60, New York, NY, USA, 2002. ACM Press.
4. T. Copeland. PMD Applied. Centennial Books, November 2005.
5. D. Engler, D. Y. Chen, S. Hallem, A. Chou, and B. Chelf. Bugs as deviant behavior: a general approach to inferring errors in systems code. In SOSP '01: Proceedings of the eighteenth ACM symposium on Operating systems principles, pages 57-72, New York, NY, USA, 2001. ACM Press.
6. T. D. Isil Dillig and A. Aiken. Static error detection using semantic inconsistency inference. In Proceedings of the Conference on Programming Language Design and Implementation, June 2007.
7. Z. Li, L. Tan, X. Wang, S. Lu, Y. Zhou, and C. Zhai. Have things changed now?: an empirical study of bug characteristics in modern open source software. In ASID '06: Proceedings of the 1st workshop on Architectural and system support for improving software dependability, pages 25-33, New York, NY, USA, 2006. ACM Press.
8. R. O'Callahan. Static analysis and scary headlines, September 2006. http://weblogs.mozillazine.org/roc/archives/2006/09/ static_analysis_and_scar_head.html.
9. N. Rutar, C. B. Almazan, and J. S. Foster. A comparison of bug finding tools for java. In ISSRE '04: Proceedings of the 15th International Symposium on Software Reliability Engineering (ISSRE'04), pages 245-256, Washington, DC, USA, 2004. IEEE Computer Society.
10. J. Spacco, D. Hovemeyer, and W. Pugh. Tracking defect warnings across versions. In MSR '06: Proceedings of the 2006 international workshop on Mining software repositories, pages 133-136, New York, NY, USA, 2006. ACM Press.
11. S. Wagner, F. Deissenboeck, M. A. J. Wimmer, and M. Schwalb. An evaluation of bug pattern tools for java, January 2007. unpublished.
12. S. Wagner, J. Jurjens, C. Koller, and P. Trischberger. Comparing bug finding tools with reviews and tests. In Proc. 17th International Conference on Testing of Communicating Systems, pages 40-55, 2005.
13. M. Zitser, R. Lippmann, and T. Leek. Testing static analysis tools using exploitable buffer overflows from open source code. In SIGSOFT '04/FSE-12: Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering, pages 97-106, New York, NY, USA, 2004. ACM Press.