通过基于大语言模型的面向资源意图推断提升静态资源泄漏检测
Boosting Static Resource Leak Detection via LLM-based Resource-Oriented Intention Inference
AI总结：
针对现有静态资源泄漏检测的漏报与误报问题，提出结合LLM意图推断与两阶段静态分析的InferROI方法，在数据集和真实项目中均显著提升检测效果。
摘要：
资源泄漏由资源获取后未被释放导致，通常会引发性能问题与系统崩溃。现有静态检测技术依赖对预定义资源获取/释放API及空检查条件的机械匹配来查找未释放资源，存在两大缺陷：（1）预定义资源获取/释放API的不完备性导致漏报；（2）资源可达性验证识别的不完备性导致误报。为克服这些挑战，我们提出InferROI这一新颖方法，它利用大语言模型（LLMs）卓越的代码理解能力，直接推断代码中面向资源的意图（获取、释放及可达性验证）。InferROI首先提示大语言模型推断给定代码片段中涉及的意图，随后结合两阶段静态分析方法，基于推断出的意图检查控制流路径以检测资源泄漏。\n我们从面向资源意图推断和资源泄漏检测两个方面评估InferROI的有效性。在DroidLeaks和JLeaks数据集上的实验结果表明，InferROI取得了可观的缺陷检测率（分别为59.3%和62.5%）和误报率（分别为18.6%和19.5%）。与三款工业级静态检测器相比，InferROI在DroidLeaks和JLeaks中分别多检测出14~45个和149~485个缺陷。在应用于真实世界开源项目时，InferROI识别出29个未知资源泄漏缺陷（经作者验证），其中7个得到开发者确认。此外，消融实验的结果凸显了将基于大语言模型的推断与静态分析相结合的重要性。
英文摘要：
Resource leaks, caused by resources not being released after acquisition, often lead to performance issues and system crashes. Existing static detection techniques rely on mechanical matching of predefined resource acquisition/release APIs and null-checking conditions to find unreleased resources, suffering from both (1) false negatives caused by the incompleteness of predefined resource acquisition/release APIs and (2) false positives caused by the incompleteness of resource reachability validation identification. To overcome these challenges, we propose InferROI, a novel approach that leverages the exceptional code comprehension capability of large language models (LLMs) to directly infer resource-oriented intentions (acquisition, release, and reachability validation) in code. InferROI first prompts the LLM to infer involved intentions for a given code snippet, and then incorporates a two-stage static analysis approach to check control-flow paths for resource leak detection based on the inferred intentions. We evaluate the effectiveness of InferROI in both resource-oriented intention inference and resource leak detection. Experimental results on the DroidLeaks and JLeaks datasets demonstrate InferROI achieves promising bug detection rate (59.3% and 62.5%) and false alarm rate (18.6% and 19.5%). Compared to three industrial static detectors, InferROI detects 14~45 and 149~485 more bugs in DroidLeaks and JLeaks, respectively. When applied to real-world open-source projects, InferROI identifies 29 unknown resource leak bugs (verified by authors), with 7 of them being confirmed by developers. In addition, the results of an ablation study underscores the importance of combining LLM-based inference with static analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
