An empirical application of user-guided program analysis

Abstract

Although static program analysis methods are frequently employed to enhance software quality, their efficiency in commercial settings is limited by their high false positive rate. The EUGENE tool can effectively lower the false positive rate. However, in continuous integration (CI) environments, the code is always changing, and user feedback from one version of the software cannot be applied to a subsequent version. Additionally, people find it difficult to distinguish between true positives and false positives in the analytical output. In this study, we developed the EUGENE-CI technique to address the CI problem and the EUGENE-rank lightweight heuristic algorithm to rate the reports of the analysis output in accordance with the likelihood that they are true positives. On the three projects ethereum, go-cloud, and kuber-netes, we assessed our methodologies. According to the trial findings, EUGENE-CI may drastically reduce false positives while EUGENE-rank can make it much easier for users to identify the real positives among a vast number of reports. We paired our techniques with GoInsight1 and discovered a vulnerability. We also offered a patch to the community.