SMT-based false positive elimination in static program analysis

  • Authors:

  • Maximilian Junker;Ralf Huuck;Ansgar Fehnker;Alexander Knapp

  • Affiliations:

  • Technische Universität München, Munich, Germany;NICTA, University of New South Wales, Sydney, Australia;NICTA, University of New South Wales, Sydney, Australia;Universität Augsburg, Augsburg, Germany

  • Venue:
  • ICFEM'12 Proceedings of the 14th international conference on Formal Engineering Methods: formal methods and software engineering
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Static program analysis for bug detection in large C/C++ projects typically uses a high-level abstraction of the original program under investigation. As a result, so-called false positives are often inevitable, i.e., warnings that are not true bugs. In this work we present a novel abstraction refinement approach to automatically investigate and eliminate such false positives. Central to our approach is to view static analysis as a model checking problem, to iteratively compute infeasible sub-paths of infeasible paths using SMT solvers, and to refine our models by adding observer automata to exclude such paths. Based on this new framework we present an implementation of the approach into the static analyzer Goanna and discuss a number of real-life experiments on larger C code projects, demonstrating that we were able to remove most false positives automatically.