FuzzSlice：通过函数级模糊测试剪除静态分析警告中的误报
FuzzSlice: Pruning False Positives in Static Analysis Warnings Through Function-Level Fuzzing
AI总结：
FuzzSlice通过函数级代码切片与模糊测试，自动剪除静态分析警告中的误报，在Juliet数据集和开源项目中分别减少100%和62.26%的误报。
摘要：
人工确认静态分析报告是一项艰巨的任务。这既是因为警告数量庞大，也是因为其中误报密度很高。已有研究提出使用模糊测试技术来验证静态分析警告。然而，一个主要的限制是，对整个项目进行模糊测试以触达所有静态分析警告是不可行的。这可能需要数天时间，并且为了线性增加代码覆盖率，需要消耗指数级的机器时间。因此，我们提出了FuzzSlice，一个新颖的框架，能够自动剪除静态分析警告中可能的误报。与以往主要侧重于确认静态分析警告中真阳性（这需要端到端模糊测试）的工作不同，FuzzSlice专注于排除潜在的误报，而误报在静态分析报告中占大多数。我们工作的关键洞察是：在给定的时间预算内，如果某个警告在函数级模糊测试下未产生崩溃，则该警告可能是误报。为实现这一目标，FuzzSlice首先致力于在函数级生成可编译的代码切片，然后对这些代码切片进行模糊测试，而不是对整个二进制文件进行模糊测试。FuzzSlice也不太可能将真正的缺陷误分类为误报，因为崩溃输入同样可以在函数级由模糊测试器复现。我们在Juliet合成数据集和真实世界的复杂C项目上评估了FuzzSlice。我们的评估显示，Juliet数据集中的真实标签包含864个误报，FuzzSlice全部检测到了这些误报。对于开源代码库，我们成功让其中两个开源代码库的开发人员独立地为这些警告标注。FuzzSlice自动识别了这两个代码库中开发人员确认的53个误报中的33个。因此，FuzzSlice在开源代码库中将误报减少了62.26%，在Juliet数据集中减少了100%。
英文摘要：
Manual confirmation of static analysis reports is a daunting task. This is due to both the large number of warnings and the high density of false positives among them. Fuzzing techniques have been proposed to verify static analysis warnings. However, a major limitation is that fuzzing the whole project to reach all static analysis warnings is not feasible. This can take several days and exponential machine time to increase code coverage linearly. Therefore, we propose FuzzSlice, a novel framework that automatically prunes possible false positives among static analysis warnings. Unlike prior work that mostly focuses on confirming true positives among static analysis warnings, which requires end-to-end fuzzing, FuzzSlice focuses on ruling out potential false positives, which are the majority in static analysis reports. The key insight that we base our work on is that a warning that does not yield a crash when fuzzed at the function level in a given time budget is a possible false positive. To achieve this, FuzzSlice first aims to generate compilable code slices at the function level and then fuzzes these code slices instead of the entire binary. FuzzSlice is also unlikely to misclassify a true bug as a false positive because the crashing input can be reproduced by a fuzzer at the function level as well. We evaluate FuzzSlice on the Juliet synthetic dataset and real-world complex C projects. Our evaluation shows that the ground truth in the Juliet dataset had 864 false positives which were all detected by FuzzSlice. For the open-source repositories, we were able to get the developers from two of these open-source repositories to independently label these warnings. FuzzSlice automatically identifies 33 out of 53 false positives confirmed by developers in these two repositories. Thus FuzzSlice reduces false positives by 62.26% in the open-source repositories and by 100% in the Juliet dataset.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
