Soundness by Static Analysis and False-alarm Removal by Statistical Analysis: Our Airac Experience∗
نویسندگان
چکیده
We present our experience of combining, in a realistic setting, a static analysis for soundness and a statistical analysis for false-alarm removal. The static analyzer is Airac that we have developed in the abstract interpretation framework for detecting buffer overruns in ANSI + GNU C programs. Airac is sound (finding all bugs) but with false alarms. Airac raised, for example, 970 buffer-overrun alarms in commercial C programs of 5.3 million lines and 233 among the 970 alarms were true. We addressed the false alarm problem by computing a probability of each alarm being true. We used Bayesian analysis and Monte Carlo method to estimate the probabilities and their credible sets. Depending on the userprovided ratio of the risk of silencing true alarms to that of false alarming, the system selectively present the analysis results (alarms) to the user. Though preliminary, the performance of the combination lets us not hastefully trade the analysis soundness for a reduced number of false alarms.
منابع مشابه
Taming False Alarms from a Domain-Unaware C Analyzer by a Bayesian Statistical Post Analysis
We present our experience of combining, in a realistic setting, a static analyzer with a statistical analysis. This combination is in order to reduce the inevitable false alarms from a domain-unaware static analyzer. Our analyzer named Airac(Array Index Range Analyzer for C) collects all the true buffer-overrun points in ANSI C programs. The soundness is maintained, and the analysis’ cost-accur...
متن کاملUsing a Diagnostic Corpus of C Programs to Evaluate Buffer Overflow Detection by Static Analysis Tools*
A corpus of 291 small C-program test cases was developed to evaluate static and dynamic analysis tools designed to detect buffer overflows. The corpus was designed and labeled using a new, comprehensive buffer overflow taxonomy. It provides a benchmark to measure detection, false alarm, and confusion rates of tools, and also suggests areas for tool enhancement. Experiments with five tools demon...
متن کاملOn the capability of static code analysis to detect security vulnerabilities
Context: Static analysis of source code is a scalable method for discovery of software faults and security vulnerabilities. Techniques for static code analysis have matured in the last decade and many tools have been developed to support automatic detection. Objective: This research work is focused on empirical evaluation of the ability of static code analysis tools to detect security vulnerabi...
متن کاملApplication of Singular Spectrum Analysis to the Noise Reduction of Intrusion Detection Alarms
Intrusion detection systems typically create a large volume of alarms and most of them are false alarms that can be seen as background noises caused by normal system behaviors. Manual analysis of a large number of alarms is both time consuming and labor intensive. This study focuses on the statistical analysis of the alarm flow. Using the Singular Spectrum Analysis (SSA) approach, we found that...
متن کاملTarget detection in SAR images via radiometric multi-resolution analysis
This paper presents a target detection method in synthetic aperture radar (SAR) images with radiometric multiresolution analysis (RMA). The idea is that target saliency can be efficiently computed by comparing the statistics of targets and those of the local background around them. In order to compute reliable statistics of targets, which usually involve a small number of pixels, RMA is adopted...
متن کامل