Can large language model replace static analysis tools

Abstract

Static analysis tools are widely used to ensure code quality and security, especially in large software projects. Recently, the advent of Large Language Models (LLM), such as the Generative Pre-trained Transformer (GPT), seems to present a strong ability to handle tasks about static code analysis. This paper aims to answer the question, can large language model replace static analysis tools? We present an extensive evaluation of ChatGPT’s capabilities in identifying and analyzing issues detectable by three well-known Java static analysis tools: PMD, SpotBugs, and SonarQube. Through a series of experiments, we assess the performance of two versions of GPT, GPT-3.5 and GPT-4, across various categories of code issues. We conduct a detailed analysis of the experiment results and discuss the limitation of using ChatGPT to perform as a static analysis tool. The findings during our research suggest that while GPT, especially GPT-4 performs outstanding marks on the dataset we chose, it is improper to fully replace the static code analyzers at the time. Working as the supplementary of static code analyzers can be a nice way to enhance the code quality ensuring projects.