Supporting Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability
Context: Static analyses are well-established to aid in understanding bugs or vulnerabilities during the development process or in large-scale studies. A low false-positive rate is essential for the adaption in practice and for precise results of empirical studies. Unfortunately, static analyses tend to report where a vulnerability manifests rather than the fix location. This can cause presumed false positives or imprecise results. Method: To address this problem, we designed an adaption of an existing static analysis algorithm that can distinguish between a manifestation and fix location, and reports error chains. An error chain represents at least two interconnected errors that occur successively, thus building the connection between the fix and manifestation location. We used our tool CogniCryptSUBS for a case study on 471 GitHub repositories, a performance benchmark to compare different analysis configurations, and conducted an expert interview. Result: We found that 50 % of the projects with a report had at least one error chain. Our runtime benchmark demonstrated that our improvement caused only a minimal runtime overhead of less than 4 %. The results of our expert interview indicate that with our adapted version participants require fewer executions of the analysis. Conclusion: Our results indicate that error chains occur frequently in real-world projects, and ignoring them can lead to imprecise evaluation results. The runtime benchmark indicates that our tool is a feasible and efficient solution for detecting error chains in real-world projects. Further, our results gave a hint that the usability of static analyses may benefit from supporting error chains.
Fri 15 MarDisplayed time zone: Athens change
09:00 - 10:30 | Program AnalysisShort Papers and Posters Track / Research Papers / Early Research Achievement (ERA) Track at KURU Chair(s): Xiaozhou Li University of Oulu | ||
09:00 7mTalk | Comparing Execution Trace Using Merkle-Tree to Detect Backward Incompatibilities Early Research Achievement (ERA) Track Atsuhito Yamaoka Nara Institute of Science and Technology, Teyon Son Nara Institute of Science and Technology, Kazumasa Shimari Nara Institute of Science and Technology, Takashi Ishio Future University Hakodate, Kenichi Matsumoto Nara Institute of Science and Technology | ||
09:07 7mTalk | Towards Inter-service Data Flow Analysis of Serverless Applications Early Research Achievement (ERA) Track Giuseppe Raffa Royal Holloway, University of London, Jorge Blasco Universidad Politécnica de Madrid, Dan O'Keeffe Royal Holloway University of London, Santanu Dash Royal Holloway, University of London | ||
09:14 15mTalk | Exploring Strategies for Guiding Symbolic Analysis with Machine Learning Prediction Research Papers Mingyue Yang University of Toronto, Canada, David Lie University of Toronto, Canada, Nicolas Papernot University of Toronto, Canada | ||
09:29 15mTalk | ReIFunc: Identifying Recurring Inline Functions in Binary Code Research Papers Wei Lin Institute of Information Engineering, Chinese Academy of Sciences, Qingli Guo Institute of Information Engineering, Chinese Academy of Sciences, DongSong Yu Zhongguancun Laboratory, Jiawei Yin Institute of Information Engineering, Chinese Academy of Sciences, Qi Gong Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China, Xiaorui Gong Institute of Information Engineering, Chinese Academy of Science | ||
09:44 15mTalk | Reducing False Positives of Static Bug Detectors through Code Representation Learning Research Papers Yixin Yang Beihang University, Ming Wen Huazhong University of Science and Technology, Xiang Gao Beihang University, Yuting Zhang Huazhong University of Science and Technology, Hailong Sun Beihang University | ||
09:59 15mTalk | Supporting Error Chains in Static Analysis for Precise Evaluation Results and Enhanced Usability Research Papers Anna-Katharina Wickert TU Darmstadt, Germany, Michael Schlichtig Heinz Nixdorf Institut and Paderborn University, Marvin Vogel Uni Hamburg, Lukas Winter unaffiliated, Mira Mezini TU Darmstadt, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM Pre-print Media Attached | ||
10:14 7mTalk | LogPM: Character-based Log Parser Benchmark Short Papers and Posters Track Shayan Hashemi , Jesse Nyyssölä University of Helsinki, Mika Mäntylä University of Helsinki and University of Oulu | ||
10:21 7mTalk | On the Hunt for Invalid Objects: Exploring the Object State Space with Program Mutants Short Papers and Posters Track |