SWaP : meta analysis of static analyzer reports for accurate warning prioritization

Abstract

Java being designed in a flexible and user-friendly demeanour, makes it the most accepted programming language for the development of web applications and platforms. Due to the immense popularity, there comes the responsibility of validation of the Java software when the software safety, reliability and quality control is of utmost importance. The detection of bugs in the software during the early stage helps to prevent the unbearable cost of human effort and time to fix them when captured at later stages. Hence many effective tools have been developed over the years to find potential bugs in the software by analysing the code statically. The static analysis tools use different techniques to detect a variety of bugs in the software. As all of these tools follow distinct techniques, the bugs detected hold a minimal overlap, thereby making it difficult to merge the analysis reports generated by them. In this thesis, we propose a mechanism of merging the results of the static analysis tools namely SpotBugs, PMD, SonarScanner and CheckStyle and reporting analysis results in a generic manner. We have also incorporated the prioritizing policy to increase the overall efficiency of the final integrated tool. This way, the user can leverage the benefits from various static analyzers in order to improve the overall quality of the software.