False Positive Elimination in Static Defect Detection

False positive ratio is a key factor for measuring the performance of static defect detection tools. Based on the analysis of a series of false positive elimination techniques, we put forward a defect detection method which combines the strength of forward dataflow analysis and backward constraint query techniques. The forward dataflow analysis generates a conservative dataflow solution, which could help reporting an initial defect detection result. According to the dataflow feature of the initial defect location, by querying the potential constraints that might cause defects, the satisfiability of the initial defects could be determined by the collection of queried constraints, with the help of a general purpose constraint solver. So the initial “coarse granularity” detection result is refined. In addition, introducing the symbolic execution technique during dataflow analysis not only improves the precision of dataflow analysis, but also facilitates the constraint representation and betters the constraint querying efficiency. The comparative experiments on 11 benchmarks from SPEC CPU2000 show that our method efficiently eliminates parts of the false positives with an acceptable overhead increase, and several comparisons between similar tools reveal the scalability of our method.