Software Security Static Analysis False Alerts Handling Approaches

Abstract

False Positive Alerts (FPA), generated by Static Analyzers Tools (SAT), reduce the effectiveness of the automatic code review, letting them be underused in practice. Researchers conduct a lot of tests to improve SAT accuracy while keeping FPA at a lower rate. They use different simulated and production datasets to validate their proposed methods. This paper surveys recent approaches dealing with FPA filtering; it compares them and discusses their usefulness. It also studies the used datasets to validate the identified methods and show their effectiveness to cover most program defects. This study focuses mainly on the security bugs covered by the datasets and handled by the existing methods.

Static Code Analysis: A Tree of Science Review

“…Lenarduzzi et al [58] show the importance of identifying the rules applied in SonarQube because it could reduce faultproneness. Akremi [5] proposed a categorization of SA techniques to compare different tools. Liu et al [59] created AVATAR to automate the correctness of bugs, in other words, a patch generator.…”

“…Azeem et al [4] present a literature review of code smell with machine learning. Akremi [5] provided recent efforts in static analysis tools to classify different false positive outcomes. However, there is a missing paper that shows the evolution of this important topic with its subfields.…”

A forensic-driven data model for automatic vehicles events analysis

“…It is essential to use trusted software to integrity-aware process the gathered data to avoid admissibility issues. A good solution is their validation using code review tools ( Akremi, 2021b ) before deployment.…”