This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
On the Value of Static Analysis for Fault Detection in Software
April 2006 (vol. 32 no. 4)
pp. 240-253
ASCII Text
x 
 
Jiang Zheng, Laurie Williams, Nachiappan Nagappan, Will Snipes, John P. Hudepohl, Mladen A. Vouk, "On the Value of Static Analysis for Fault Detection in Software," IEEE Transactions on Software Engineering, vol. 32, no. 4, pp. 240-253, April, 2006.
 
 
BibTex
x
 
@article{ 10.1109/TSE.2006.38,
author = {Jiang Zheng and Laurie Williams and Nachiappan Nagappan and Will Snipes and John P. Hudepohl and Mladen A. Vouk},
title = {On the Value of Static Analysis for Fault Detection in Software},
journal ={IEEE Transactions on Software Engineering},
volume = {32},
number = {4},
issn = {0098-5598},
year = {2006},
pages = {240-253},
doi = {http://doi.ieeecomputersociety.org/10.1109/TSE.2006.38},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}
 
 
RefWorks Procite/RefMan/Endnote
x 
 
TY - JOUR
JO - IEEE Transactions on Software Engineering
TI - On the Value of Static Analysis for Fault Detection in Software
IS - 4
SN - 0098-5598
SP240
EP253
EPD - 240-253
A1 - Jiang Zheng,
A1 - Laurie Williams,
A1 - Nachiappan Nagappan,
A1 - Will Snipes,
A1 - John P. Hudepohl,
A1 - Mladen A. Vouk,
PY - 2006
KW - Code inspections
KW - walkthroughs.
VL - 32
JA - IEEE Transactions on Software Engineering
ER -
 
No single software fault-detection technique is capable of addressing all fault-detection concerns. Similarly to software reviews and testing, static analysis tools (or automated static analysis) can be used to remove defects prior to release of a software product. To determine to what extent automated static analysis can help in the economic production of a high-quality product, we have analyzed static analysis faults and test and customer-reported failures for three large-scale industrial software systems developed at Nortel Networks. The data indicate that automated static analysis is an affordable means of software fault detection. Using the Orthogonal Defect Classification scheme, we found that automated static analysis is effective at identifying Assignment and Checking faults, allowing the later software production phases to focus on more complex, functional, and algorithmic faults. A majority of the defects found by automated static analysis appear to be produced by a few key types of programmer errors and some of these types have the potential to cause security vulnerabilities. Statistical analysis results indicate the number of automated static analysis faults can be effective for identifying problem modules. Our results indicate static analysis tools are complementary to other fault-detection techniques for the economic production of a high-quality software product.

[1] A.F. Ackerman, L.S. Buchwalk, and F.H. Lewski, “Software Inspections: An Effective Verification Process,” IEEE Software, vol. 6, no. 3, pp. 31-36, May 1989.
[2] V. Basili, G. Caldiera, and D.H. Rombach, “The Goal Question Metric Paradigm,” Encyclopedia of Software Eng., vol. 2, pp. 528-532, 1994.
[3] V.R. Basili, S. Green, O. Laitenberger, F. Lanubile, F. Shull, S. Sorumgard, and M.V. Zelkowitz, “The Empirical Investigation of Perspective-Based Reading,” Empirical Software Eng. — An Int'l J., vol. 1, no. 2, 1996.
[4] B. Beizer, Software Testing Techniques. London: Int'l Thompson Computer Press, 1990.
[5] B.W. Boehm, Software Engineering Economics. Prentice-Hall, 1981.
[6] B. Chess, “Improving Computer Security Using Extended Static Checking,” Proc. IEEE Symp. Security and Privacy, pp. 160-173, 2002.
[7] B. Chess and G. McGraw, “Static Analysis for Security,” IEEE Security & Privacy, vol. 2, no. 6, pp. 76-79, 2004.
[8] R. Chillarege, I.S. Bhandari, J. Chaar, M.J. Halliday, D.S. Moebus, B.K. Ray, and M.Y. Wong, “Orthogonal Defect Classification— A Concept for In-Process Measurements,” IEEE Trans. Software Eng., vol. 18, no. 11, pp. 943-956, Nov. 1992.
[9] C. Differding, B. Hoisl, and C.M. Lott, “Technology Package for the Goal Question Metric Paradigm,” Fraunhofer Inst. for Empirical Software Eng. Internal Report 281/96, Apr. 1996.
[10] K.E. Emam and I. Wieczorek, “The Repeatability of Code Defect Classifications,” Proc. Ninth Int'l Symp. Software Reliability Eng., p. 322, Nov. 1998.
[11] N.E. Fenton and S.L. Pfleeger, Software Metrics. Boston: Int'l Thompson Publishing, 1997.
[12] R. Hochman, T.M. Khoshgoftaar, E.B. Allen, and J.P. Hudepohl, “Using the Genetic Algorithm to Build Optimal Neural Networks for Fault-Prone Module Detection,” Proc. Seventh Int'l Symp. Software Reliability Eng., pp. 152-162, 1996.
[13] R. Hochman, T.M. Khoshgoftaar, E.B. Allen, and J.P. Hudepohl, “Evolutionary Neural Networks: A Robust Approach to Software Reliability Problems,” Proc. Eighth Int'l Symp. Software Reliability Eng., pp. 13-26, 1997.
[14] D. Hovemeyer and W. Pugh, “Finding Bugs is Easy,” Proc. Conf. Object Oriented Programming Systems Languages and Applications (OOSPLA) Companion, pp. 132-135, 2004.
[15] W.S. Humphrey, A Discipline for Software Engineering. Addison Wesley, 1995.
[16] IEEE, “IEEE Standard Glossary of Software Engineering Terminology,” IEEE Standard 610.12-1990, 1990.
[17] IEEE, “IEEE Standard Classification for Software Anomalies,” IEEE Standard 1044-1993, 1993.
[18] C. Jones, “Software Defect Removal Efficiency,” Computer, vol. 29, no. 4, pp. 94-95, Apr. 1996.
[19] C. Jones, Software Assessments, Benchmarks, and Best Practices. Addison-Wesley, May 2000.
[20] D. Kelly and T. Shepard, “A Case Study in the Use of Defect Classification in Inspections,” Proc. IBM Centre for Advanced Studies Conf., pp. 7-20, 2001.
[21] T.M. Khoshgoftaar, E.B. Allen, J.P. Hudepohl, and S.J. Aud, “Applications of Neural Networks to Software Quality Modeling of a Very Large Telecommunications System,” Trans. Neural Networks, vol. 8, no. 4, pp. 902-909, 1997.
[22] T.M. Khoshgoftaar, E.B. Allen, J.P. Hudepohl, and W. Jones, “Classification Tree Models of Software Quality over Multiple Releases,” Proc. 10th Int'l Symp. Software Reliability Eng., pp. 116-125, 1999.
[23] T.M. Khoshgoftaar, E.B. Allen, K.S. Kalaichelvan, N. Goel, J.P. Hudepohl, and J. Mayrand, “Detection of Fault-Prone Program Modules in a Very Large Telecommunications System,” Proc. Sixth Int'l Symp. Software Reliability Eng., pp. 24-33, 1995.
[24] T.M. Khoshgoftaar, E.B. Allen, A. Naik, W. Jones, and J.P. Hudepohl, “Using Classification Trees for Software Quality Models: Lessons Learned,” Int'l J. Software Eng. and Knowledge Eng., vol. 9, no. 2, pp. 217-231, 1999.
[25] T.M. Khoshgoftaar and J.C. Munson, “The Lines of Code Metric as a Predictor of Program Faults: A Critical Analysis,” Proc. 14th Computer Software and Applications Conf. (COMPSAC), pp. 408-413, 1990.
[26] T.M. Khoshgoftaar, J.C. Munson, and D.L. Lanning, “A Comparative Study of Predictive Models for Program Changes During System Testing and Maintenance,” Proc. Ninth Int'l Conf. Software Maintenance, pp. 72-79, 1993.
[27] N. Kikuchi and T. Kikuno, “Improving the Testing Process by Program Static Analysis,” Proc. Asia-Pacific Software Eng. Conf. (APSEC), pp. 195-201, 2001.
[28] J.R. Larus, T. Ball, M. Das, R. DeLine, M. Fahndrich, J. Pincus, S.K. Rajamani, and R. Venkatapathy, “Righting Software,” IEEE Software, vol. 21, no. 3, pp. 92-100, 2004.
[29] J.C. Munson and T.M. Khoshgoftaar, “Regression Modelling of Software Quality: Empirical Investigation,” Information and Software Technology, vol. 32, no. 2, pp. 106-114, 1990.
[30] J.C. Munson and T.M. Khoshgoftaar, “The Detection of Fault-Prone Programs,” IEEE Trans. Software Eng., vol. 18, no. 5, pp. 423-433, May 1992.
[31] N. Nagappan and T. Ball, “Static Analysis Tools as Early Indicators of Pre-Release Defect Density,” Proc. Int'l Conf. Software Eng. (ICSE), pp. 580-586, 2005.
[32] N. Nagappan, L. Williams, M. Vouk, J. Hudepohl, and W. Snipes, “A Preliminary Investigation of Automated Software Inspection,” Proc. IEEE Int'l Symp. Software Reliability Eng. (ISSRE), pp. 429-439, 2004.
[33] L. Osterweil, “Integrating the Testing, Analysis, and Debugging of Programs,” Proc. Symp. Software Validation, 1984.
[34] A.A. Porter and P.M. Johnson, “Assessing Software Review Meetings: Results of a Comparative Analysis of Two Experimental Studies,” IEEE Trans. Software Eng., vol. 23, no. 3, pp. 129-145, 1997.
[35] Reasoning Inc. “Automated Software Inspection: A New Approach to Increase Software Quality and Productivity,” http://www.reasoning.com/pdfASI.pdf, 2003.
[36] I. Rus, F. Shull, and P. Donzelli, “Decision Support for Using Software Inspections,” Proc. 28th Ann. NASA Goddard Software Eng. Workshop, p. 11, 2003.
[37] N. Rutar, C.B. Almazan, and J.S. Foster, “A Comparison of Bug Finding Tools for Java,” Proc. IEEE Int'l Symp. Software Reliability Eng. (ISSRE), pp. 245-256, 2004.
[38] G.M. Schneider, J. Martin, and W.T. Tsai, “An Experimental Study of Fault Detection in User Requirements Documents,” ACM Trans. Software Eng. and Methodology, vol. 1, no. 2, pp. 188-204, Apr. 1992.
[39] G.H. Travassos, F. Shull, M. Fredericks, and V.R. Basili, “Detecting Defects in Object Oriented Designs: Using Reading Techniques to Improve Software Quality,” Proc. Conf. Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA), pp. 47-56, Nov. 1999.
[40] M. Young and R.N. Taylor, “Rethinking the Taxonomy of Fault Detection Techniques,” Proc. Int'l Conf. Software Eng., pp. 53-62, 1989.

Index Terms:
Code inspections, walkthroughs.
Citation:
Jiang Zheng, Laurie Williams, Nachiappan Nagappan, Will Snipes, John P. Hudepohl, Mladen A. Vouk, "On the Value of Static Analysis for Fault Detection in Software," IEEE Transactions on Software Engineering, vol. 32, no. 4, pp. 240-253, April 2006, doi:10.1109/TSE.2006.38
Usage of this product signifies your acceptance of the Terms of Use.