How to Find Actionable Static Analysis Warnings
Automatically generated static code warnings suffer from a large number of
false alarms. Hence, developers only take action on a small percent of those
warnings. To better predict which static code warnings should not be ignored,
we suggest that analysts need to look deeper into their algorithms to find
choices that better improve the particulars of their specific problem.
Specifically, we show here that effective predictors of such warnings can be
created by methods that locally adjust the decision boundary (between
actionable warnings and others). These methods yield a new high water-mark for
recognizing actionable static code warnings. For eight open-source Java
projects (CASSANDRA, JMETER, COMMONS, LUCENE-SOLR, ANT, TOMCAT, DERBY) we
achieve perfect test results on 4/8 datasets and, overall, a median AUC (area
under the true negatives, true positives curve) of 92\%.