检索结果-内蒙古大学图书馆

static code analysis Alarms Filtering Reloaded: A New Real-World Dataset and its ML-Based Utilization

IEEE ACCESS 2022年 10卷 55090-55101页

作者： Hegedus, Peter Ferenc, Rudolf Univ Szeged Software Engn Dept H-6720 Szeged Hungary

Even though static code analysis (SCA) tools are integrated into many modern software building and testing pipelines, their practical impact is still seriously hindered by the excessive number of false positive warnings they usually produce. To cope with this problem, researchers have proposed several post-processing methods that aim to filter out false hits (or equivalently identify "actionable" warnings) after the SCA tool produced its results. However, we found that most of these approaches are targeted (i.e., deal with only a few SCA warning types) and evaluated on synthetic benchmarks or small-scale manually collected data sets (i.e., with typical sample sizes of several hundred). In this paper, we present a dataset containing 224,484 real-world warning samples fixed (true positives) or explicitly ignored (false positives) by the developers, which we collected from 9,958 different open-source Java projects from GitHub using a data mining approach. Additionally, we utilize this rich dataset to train a code embedding-based machine learning model for filtering false positive warnings produced by 160 different SonarQube rule checks, one of the most widely adopted SCA tools today. This is the most extensive real-world public dataset and study we know of in this area. Our method works with an accuracy of 91% (best F1-score of 81.3% and AUC of 95.3%) for the classification of SonarQube warnings.

关键词： codes Computer bugs Java Context modeling Benchmark testing Natural language processing Machine learning static code analysis filtering false positives real-world dataset code embedding machine learning

来源：评论

学校读者我要写书评

暂无评论

static code analysis of IEC 61131-3 Programs: Comprehensive Tool Support and Experiences from Large-Scale Industrial Application

引用

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS 2017年第1期13卷 37-47页

作者： Praehofer, Herbert Angerer, Florian Ramler, Rudolf Grillenberger, Friedrich Johannes Kepler Univ Linz Inst Syst Software A-4040 Linz Austria Johannes Kepler Univ Linz Christian Doppler Lab Monitoring & Evolut Very La A-4040 Linz Austria Software Competence Ctr Hagenberg A-4232 Hagenberg Austria ENGEL Austria GmbH A-4311 Schwertberg Austria

static code analysis techniques examine programs without actually executing them. The main benefits lie in improving software quality by detecting problematic code constructs and potential defects in early development stages. Today, static code analysis is a widely used quality assurance technique and numerous tools are available for established programming languages like C/C++, Java, or C#. However, in the domain of programmable logic controller (PLC) programming, static code analysis tools are still rare, although many properties of PLC programming languages are beneficial for static analysis techniques. Therefore, an approach and tool for static code analysis of IEC 61131-3 programs has been developed which is capable of detecting a range of issues commonly occurring in PLC programming. The approach employs different analysis methods, like pattern-matching on program structures, control flow and data flow analyses, and, especially, call graph and pointer analysis techniques. Based on results from an initial analysis project, where common issues for static analysis of PLC programs have been investigated, this paper illustrates adoption and extensions of analysis techniques for PLC programs and presents results from large-scale industrial application.

关键词： Programmable logic controllers software quality software maintenance program analysis static code analysis

来源：评论

学校读者我要写书评

暂无评论

static code analysis Tool for Laravel Framework Based Web Application

Static Code Analysis Tool for Laravel Framework Based Web Ap...

引用

International Conference on Data and Software Engineering (ICoDSE) - Data and Software Engineering for Supporting Sustainable Development Goals

作者： Paramitha, Ranindya Asnar, Yudistira Dwi Wardhana Inst Teknol Bandung Sch Elect Engn & Informat Bandung Indonesia

ISBN: (纸本)9781665494533

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application's source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

关键词： security vulnerabilities static code analysis Laravel taint analysis

来源：评论

学校读者我要写书评

暂无评论

Integrated static code analysis and runtime verification

引用

SOFTWARE-PRACTICE & EXPERIENCE 2015年第10期45卷 1359-1373页

作者： Sozer, H. Ozyegin Univ TR-34794 Istanbul Turkey

static code analysis tools automatically generate alerts for potential software faults that can lead to failures. However, these tools usually generate a very large number of alerts, some of which are subject to false positives. Because of limited resources, it is usually hard to inspect all the alerts. As a complementary approach, runtime verification techniques verify dynamic system behavior with respect to a set of specifications. However, these specifications are usually created manually based on system requirements and constraints. In this paper, we introduce a noval approach and a toolchain for integrated static code analysis and runtime verification. Alerts that are generated by static code analysis tools are utilized for automatically generating runtime verification specifications. On the other hand, runtime verification results are used for automatically generating filters for static code analysis tools to eliminate false positives. The approach is illustrated for the static analysis and runtime verification of an open-source bibliography reference manager software. Copyright (c) 2014 John Wiley & Sons, Ltd.

关键词： software verification runtime verification static code analysis model transformations tool integration

来源：评论

学校读者我要写书评

暂无评论

software technology Ensuring the Integrity of Embedded Software with static code analysis

引用

IEEE SOFTWARE 2009年第3期26卷 96-99页

作者： Chelf, Ben Ebert, Christof Coverity Vector

With embedded software becoming increasingly pervasive and critical to our society, developers must ensure that their software code performs as intended and doesn't fail. static code analysis is key in controlling code quality even before unit testing. It doesn't replace other verification and validation steps but helps remove certain defect types that otherwise wouldn't be found. This article provides an overview on static code analysis and insight on how to best use it.

关键词： static code analysis Verification code Checking Unit Test Review Inspection

来源：评论

学校读者我要写书评

暂无评论

Does ChatGPT Help Novice Programmers Write Better code? Results From static code analysis

引用

IEEE ACCESS 2024年 12卷 114146-114156页

作者： Haindl, Philipp Weinberger, Gerald St Polten Univ Appl Sci Dept Comp Sci & Secur A-3100 St Polten Austria

In the realm of AI-enhanced programming education, there is growing interest in using such tools to help students understand good coding principles. This study investigates the impact of ChatGPT on code quality among part-time undergraduate students in introductory Java programming courses, who lack prior Java experience. The source code of 16 students from the control group (without ChatGPT) and 22 students from the treatment group (with ChatGPT) who completed identical programming exercises focused on coding conventions was analyzed. static code analysis tools assessed adherence to a common coding convention ruleset and calculated cyclomatic and cognitive complexity metrics. The comparative analysis shows that the ChatGPT-assisted group significantly improved code quality, with fewer rule violations and reduced cyclomatic and cognitive complexities. The treatment group adhered more closely to coding standards and produced less complex code. Violations primarily occurred in line length, final parameters, and the extensibility of object-oriented programming (OOP). These findings suggest that ChatGPT can be beneficial in programming education by helping students write cleaner, less complex code and adhere to coding conventions. However, the study's limitations, such as the small sample size and novice status of participants, call for further research with larger, more diverse populations and different educational contexts.

关键词： codes Chatbots Programming Programming profession Education Complexity theory Java Programming education ChatGPT large language models static code analysis

来源：评论

学校读者我要写书评

暂无评论

Technical Debt indication in PLC code for automated Production Systems: Introducing a Domain Specific static code analysis Tool

引用

IFAC-PapersOnLine 2018年第10期51卷 70-75页

作者： Bougouffa, Safa Dong, Quang Huan Diehm, Sebastian Gemein, Fabian Vogel-Heuser, Birgit Institute of Automation and Information Systems Technical University of Munich Garching85748 Germany Schneider Electric Automation GmbH Schneiderplatz 1 Marktheidenfeld97828 Germany

Nowadays, technical debt (TD) has become a well-known metaphor signifying long-term consequences of short-term benefits in system development. Accumulating TD can cause severe maintenance effort, and thus affect the quality of the system. Identifying and managing TD through appropriate methods and tools can be a first step towards preventing TD accumulation. static code analysis is a technique widely used to identify TD at code level in software engineering domain and various tools were developed accordingly. However, tools for identifying TD in technical systems such as automated production systems (aPS) that are mainly controlled by Programmable Logic Controller (PLC) implemented in IEC 61131-3 programming languages are rare. Therefore, this paper presents a tool that uses static code analysis with the application of software quality metrics and coding conventions enabling the PLC software developer to identify TD and evaluate it. © 2016

关键词： Quality control Application programs Applications codes (symbols) Computer circuits Computer software selection and evaluation Controllers Embedded systems Programmable logic controllers Programmed control systems Testing Verification Automated production systems Maintenance efforts Programmable Logic Controller (PLC) Software engineering domain Software quality metrics static code analysis static code analysis tools Validation

来源：评论

学校读者我要写书评

暂无评论

New PHP Language Features Make Your static code analysis Tools Miss Vulnerabilities 40

New PHP Language Features Make Your Static Code Analysis Too...

引用

40th International Conference on Software Maintenance and Evolution

作者： Wang, Lin Zhang, Yuan Tan, Xin Ye, Shengke Yang, Min Fudan Univ Shanghai Peoples R China

ISBN: (纸本)9798350395693;9798350395686

Due to the nature of directly interacting with user inputs, PHP applications are susceptible to taint-style vulnerabilities. To detect such vulnerabilities, static code analysis Tools (SCATs) are widely used for their broad code coverage and scalability. Modeling language features (i.e., to represent and simulate the behavior of program codes) is the keystone of SCATs' vulnerability detection capabilities. Meanwhile, being an actively maintained language, the PHP community introduces several new language features almost every year, rendering many unmodeled features. Though efforts have been made to reduce the number of unmodeled features, e.g., proposing new modeling methods, the impact of the introduction of new PHP features on SCAT during the language evolution is not well-conscious and systematically assessed. To fill the gap, this paper performs a systematic study of new language features and their impact on the ability of SCATs to detect taint-style vulnerabilities in PHP codes. To be specific, we identify 25 widely-used new language features that potentially compromise SCATs' vulnerability detection capabilities. Besides, we assess the impact of these new features on five open-source SCATs and show that the vulnerability detection ability is significantly compromised, with each SCAT affected by 10 features on average. To mitigate the impact, we conduct a theoretical analysis to diagnose the underlying reasons and propose several effective adaptation strategies. Finally, we provide key insights and implications for various stakeholders in static code analysis, emphasizing the need for them to recognize and proactively address the potential effects of language evolution.

关键词： PHP Language Feature static code analysis Web Security Vulnerability Detection

来源：评论

学校读者我要写书评

暂无评论

Automated Classification of static code analysis Alerts: A Case Study

Automated Classification of Static Code Analysis Alerts: A C...

引用

29th IEEE International Conference on Software Maintenance (ICSM)

作者： Yuksel, Ulas Sozer, Hasan Vestel Elect Manisa Turkey Ozyegin Univ Istanbul Turkey

static code analysis tools automatically generate alerts for potential software faults that can lead to failures. However, developers are usually exposed to a large number of alerts. Moreover, some of these alerts are subject to false positives and there is a lack of resources to inspect all the alerts manually. To address this problem, numerous approaches have been proposed for automatically ranking or classifying the alerts based on their likelihood of reporting a critical fault. One of the promising approaches is the application of machine learning techniques to classify alerts based on a set of artifact characteristics. In this work, we evaluate this approach in the context of an industrial case study to classify the alerts generated for a digital TV software. First, we created a benchmark based on this code base by manually analyzing thousands of alerts. Then, we evaluated 34 machine learning algorithms using 10 different artifact characteristics and identified characteristics that have a significant impact. We obtained promising results with respect to the precision of classification.

关键词： alert classification industrial case study static code analysis

来源：评论

学校读者我要写书评

暂无评论

Software Component Score: Measuring Software Component Quality Using static code analysis 15th

Software Component Score: Measuring Software Component Quali...

引用

15th International Conference on Computational Science and Its Applications (ICCSA)

作者： Deniz, Berkhan Aselsan Elect Inc Def Syst Technol SST Grp Ankara Turkey

ISBN: (纸本)9783319214139;9783319214122

static code analysis is a software verification method which analyzes software source code in terms of quality, security and reliability. Unlike other verification activities, static analysis can be automated;thus it can be applied without running the software or creating special test cases. Software metrics are widely practiced by many companies and researchers in order to evaluate their software. In this study, the software component quality measurement method which is developed in an embedded software team will be described. The method is based on automatically collected metrics and predetermined set of rules. First, the measured and calculated metrics under this method will be defined and the reasons for selecting these metrics will be described. Then, the software quality score calculation method using these metrics will be explained. Finally, the gains obtained with this method and the future plans will be related.

关键词： static code analysis Quality measurement code based metrics Software component quality Coding standards

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：