Improving the accuracy of static analysis based on state partition

Abstract

In order to avoid the path explosion problem in full path-sensitive detection during the process of path-sensitive defect detection, defect states are often merged at merging nodes on control flow graph, but this rough merging strategy may lead to accuracy loss and false positives. In this paper, state partition is proposed to handle the implicit variable relationships on respective paths and to improve the accuracy of detection. We also propose a path merging strategy with state partition to avoid accuracy loss caused by untimely merging of data flow information, and it has been implemented in our static analysis tool, Defect Testing System (DTS). Experiment on a large number of C open source projects shows the great improvement this strategy makes.