Abstract-This paper presents our results from identifying and documenting false positives generated by static code analysis tools. By false positives, we mean a static code analysis tool generates a warning message, but the warning message is not really an error. The goal of our study is to understand the different kinds of false positives generated so we can (1) automatically determine if an error message is truly indeed a true positive, and (2) reduce the number of false positives developers and testers must triage. We have used two open-source tools and one commercial tool in our study. The results of our study have led to 14 core false positive patterns, some of which we have confirmed with static code analysis tool developers.
Reynolds et al. REF identified and documented 14 of different kinds of false positive patterns, by running three of SCA tools against C/C++ Juliet test suite.
Identifying and Documenting False Positive Patterns Generated by Static Code Analysis Tools
2017 IEEE/ACM 4th International Workshop on Software Engineering Research and Industrial Practice (SER&IP)
2017 IEEE/ACM 4th International Workshop on Software Engineering Research and Industrial Practice (SER&IP)
Computer Science