Identifying and documenting false positive patterns generated by static code analysis tools

Static code analysis tools are known to flag a large number of false positives. A false positive is a warning message generated by a static code analysis tool for a location in the source code that does not have any known problems. This thesis presents our approach and results in identifying and documenting false positives generated by static code analysis tools. The goal of our study was to understand the different kinds of false positives generated so we can (1) automatically determine if a warning message from a static code analysis tool truly indicates an error, and (2) reduce the number of false positives developers must triage. We used two open-source tools and one commercial tool in our study. Our approach led to a hierarchy of 14 core false positive patterns, with some patterns appearing in multiple variations. We implemented checkers to identify the code structures of false positive patterns and to eliminate them from the output of the tools. Preliminary results showed that we were able to reduce the number of warnings by 14.0%-99.9% with a precision of 94.2%-100.0% by applying our false positive filters in different cases.

Discipline thesis:degree_discipline

Computer & Information Science

Year dc:date.issued

2017

Author dc:creator

• Reynolds, Zachary P.

Advisor dc:contributor.advisor

• Hill, James H.

• false positive catalog
• false positive elimination
• false positive pattern
• static code analysis

Statement dc:rights

• Attribution 3.0 United States

Licence dc:rights.uri

• http://creativecommons.org/licenses/by/3.0/us/

Language dc:language.iso

en_US

DOI

10.7912/C22651

Identifier URI

http://dx.doi.org/10.7912/C2/2344

OAI identifier oai:identifier

oai:scholarworks.indianapolis.iu.edu:1805/13533