Improving Review of Clustered-Code Analysis Warnings

While software verification using static analysis tools has proved its significance in early defect detection, the tools often fail to analyze many real world systems. Clustering, breaking a system into multiple clusters, is commonly used technique to scale these tools to large systems. Due to the imprecise nature of static analysis and the conservative approach taken for the inter-cluster communication (data sharing), a large number of analysis warnings are generated. All these reported warnings need to be reviewed manually to check if they represent a defect, and it is a time consuming process. We observe many of the reported warnings are common to multiple clusters and reviewing each of them individually incurs redundancy. We present an approach to improve the manual review process by eliminating the redundancy. This is achieved by grouping the inter-cluster common warnings such that review of a grouped warning under given constraint guarantees same review judgment for the other cluster warnings in the same group. Empirical results obtained with the presented approach indicate that -- a) on an average, 45% of total warnings are common to multiple clusters, and b) with the proposed grouping technique, the manual efforts required to review these common warnings are reduced by 60%.