How to Find Actionable Static Analysis Warnings: A Case Study with FindBugs
This work addresses the issue for software developers by improving the identification of actionable static analysis warnings, though it is incremental as it builds on existing methods with local adjustments.
The paper tackled the problem of high false alarm rates in static code warnings by proposing methods that locally adjust decision boundaries to better predict actionable warnings, achieving perfect test results on 4 out of 8 datasets and a median AUC of 92%.
Automatically generated static code warnings suffer from a large number of false alarms. Hence, developers only take action on a small percent of those warnings. To better predict which static code warnings should not be ignored, we suggest that analysts need to look deeper into their algorithms to find choices that better improve the particulars of their specific problem. Specifically, we show here that effective predictors of such warnings can be created by methods that locally adjust the decision boundary (between actionable warnings and others). These methods yield a new high water-mark for recognizing actionable static code warnings. For eight open-source Java projects (cassandra, jmeter, commons, lucene-solr, maven, ant, tomcat, derby) we achieve perfect test results on 4/8 datasets and, overall, a median AUC (area under the true negatives, true positives curve) of 92%.