迈向更优质的静态代码分析报告：基于句子变换器的非可操作警报过滤
Towards Better Static Code Analysis Reports: Sentence Transformer-based Filtering of Non-Actionable Alerts
AI总结：
本文提出STAF方法，利用句子变换器架构过滤静态代码分析中的非可操作警报，通过减少无效警报数量并提高可操作问题识别准确率，使静态分析工具的实用性提升至89%。
摘要：
静态代码分析（SCA）工具被广泛用于检测软件系统中的错误和漏洞。然而，这些工具生成的报告通常包含大量非可操作发现，这会令开发者感到压力而忽略它们，这种现象称为“警报疲劳”。本文提出STAF：基于句子变换器的可操作性过滤方法。我们的方法利用基于Transformer的架构和句子嵌入来将发现分类为可操作和不可操作类别。在Java项目报告的大型数据集上评估STAF，我们证明我们的方法能够有效减少不可操作发现，同时在识别可操作问题方面保持高水平的准确性。结果表明，我们的方法使静态分析工具的实用性达到89%的F1分数，在项目内设置中比现有方法高出至少11%，在跨项目设置中高出至少6%。通过提供更聚焦和相关的一组发现，我们旨在提高静态分析在软件开发中的整体有效性。
英文摘要：
Static code analysis (SCA) tools are widely used as effective ways to detect bugs and vulnerabilities in software systems. However, the reports generated by these tools often contain a large number of non-actionable findings, which can overwhelm developers to the point of ignoring them altogether -- this phenomenon is known as "alert fatigue". In this paper, we combat alert fatigue by proposing STAF: Sentence Transformer-based Actionability Filtering. Our approach leverages a transformer based architecture with sentence embeddings to classify findings into actionable and non-actionable categories. Evaluating STAF on a large dataset of reports from Java projects, we demonstrate that our method can effectively reduce the number of non-actionable findings while maintaining a high level of accuracy in identifying actionable issues. The results show that our approach can improve the usability of static analysis tools reaching an F1 score of 89%, outperforming existing methods for SCA warning filtering by at least 11% in a within-project setting and by at least 6% in a cross-project setting. By providing a more focused and relevant set of findings, we aim to enhance the overall effectiveness of static analysis in software development.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
