Standard

Analyzing the State of Static Analysis : A Large-Scale Evaluation in Open Source Software. / Beller, Moritz; Bholanath, Radjino; McIntosh, Shane; Zaidman, Andy.

Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering. Piscataway, NJ : IEEE, 2016. p. 470-481.

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Harvard

Beller, M, Bholanath, R, McIntosh, S & Zaidman, A 2016, Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Source Software. in Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering. IEEE, Piscataway, NJ, pp. 470-481. https://doi.org/10.1109/SANER.2016.105

APA

Beller, M., Bholanath, R., McIntosh, S., & Zaidman, A. (2016). Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Source Software. In Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering (pp. 470-481). Piscataway, NJ: IEEE. https://doi.org/10.1109/SANER.2016.105

Vancouver

Beller M, Bholanath R, McIntosh S, Zaidman A. Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Source Software. In Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering. Piscataway, NJ: IEEE. 2016. p. 470-481 https://doi.org/10.1109/SANER.2016.105

Author

Beller, Moritz ; Bholanath, Radjino ; McIntosh, Shane ; Zaidman, Andy. / Analyzing the State of Static Analysis : A Large-Scale Evaluation in Open Source Software. Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering. Piscataway, NJ : IEEE, 2016. pp. 470-481

BibTeX

@inproceedings{33b1c0f41afd459da7b05476c9033869,
title = "Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Source Software",
abstract = "The use of automatic static analysis has been a software engineering best practice for decades. However, we still do not know a lot about its use in real-world software projects: How prevalent is the use of Automated Static Analysis Tools (ASATs) such as FindBugs and JSHint? How do developers use these tools, and how does their use evolve over time? We research these questions in two studies on nine different ASATs for Java, JavaScript, Ruby, and Python with a population of 122 and 168,214 open-source projects. To compare warnings across the ASATs, we introduce the General Defect Classification (GDC) and provide a grounded-theory-derived mapping of 1,825 ASAT-specific warnings to 16 top-level GDC classes. Our results show that ASAT use is widespread, but not ubiquitous, and that projects typically do not enforce a strict policy on ASAT use. Most ASAT configurations deviate slightly from the default, but hardly any introduce new custom analyses. Only a very small set of default ASAT analyses is widely changed. Finally, most ASAT configurations, once introduced, never change. If they do, the changes are small and have a tendency to occur within one day of the configuration's initial introduction.",
keywords = "General Defect Classification, Automated Static Analysis Tools, ASATs, GitHub, Open-Source Software",
author = "Moritz Beller and Radjino Bholanath and Shane McIntosh and Andy Zaidman",
year = "2016",
month = "3",
doi = "10.1109/SANER.2016.105",
language = "English",
pages = "470--481",
booktitle = "Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering",
publisher = "IEEE",
address = "United States",

}

RIS

TY - GEN

T1 - Analyzing the State of Static Analysis

T2 - A Large-Scale Evaluation in Open Source Software

AU - Beller, Moritz

AU - Bholanath, Radjino

AU - McIntosh, Shane

AU - Zaidman, Andy

PY - 2016/3

Y1 - 2016/3

N2 - The use of automatic static analysis has been a software engineering best practice for decades. However, we still do not know a lot about its use in real-world software projects: How prevalent is the use of Automated Static Analysis Tools (ASATs) such as FindBugs and JSHint? How do developers use these tools, and how does their use evolve over time? We research these questions in two studies on nine different ASATs for Java, JavaScript, Ruby, and Python with a population of 122 and 168,214 open-source projects. To compare warnings across the ASATs, we introduce the General Defect Classification (GDC) and provide a grounded-theory-derived mapping of 1,825 ASAT-specific warnings to 16 top-level GDC classes. Our results show that ASAT use is widespread, but not ubiquitous, and that projects typically do not enforce a strict policy on ASAT use. Most ASAT configurations deviate slightly from the default, but hardly any introduce new custom analyses. Only a very small set of default ASAT analyses is widely changed. Finally, most ASAT configurations, once introduced, never change. If they do, the changes are small and have a tendency to occur within one day of the configuration's initial introduction.

AB - The use of automatic static analysis has been a software engineering best practice for decades. However, we still do not know a lot about its use in real-world software projects: How prevalent is the use of Automated Static Analysis Tools (ASATs) such as FindBugs and JSHint? How do developers use these tools, and how does their use evolve over time? We research these questions in two studies on nine different ASATs for Java, JavaScript, Ruby, and Python with a population of 122 and 168,214 open-source projects. To compare warnings across the ASATs, we introduce the General Defect Classification (GDC) and provide a grounded-theory-derived mapping of 1,825 ASAT-specific warnings to 16 top-level GDC classes. Our results show that ASAT use is widespread, but not ubiquitous, and that projects typically do not enforce a strict policy on ASAT use. Most ASAT configurations deviate slightly from the default, but hardly any introduce new custom analyses. Only a very small set of default ASAT analyses is widely changed. Finally, most ASAT configurations, once introduced, never change. If they do, the changes are small and have a tendency to occur within one day of the configuration's initial introduction.

KW - General Defect Classification

KW - Automated Static Analysis Tools

KW - ASATs

KW - GitHub

KW - Open-Source Software

UR - http://resolver.tudelft.nl/uuid:33b1c0f4-1afd-459d-a7b0-5476c9033869

U2 - 10.1109/SANER.2016.105

DO - 10.1109/SANER.2016.105

M3 - Conference contribution

SP - 470

EP - 481

BT - Proceedings of the 23rd IEEE International Conference on Software Analysis, Evolution, and Reengineering

PB - IEEE

CY - Piscataway, NJ

ER -

ID: 8928491