Reducing False Positives of Static Analysis for SEI CERT C Coding Standard

Static analysis tools have important roles in detecting violations in source code which is not compliant with coding standards. However, for industrious size systems, these tools report an overwhelming number of violations, which contain many false positives. This research considers the SEI CERT C Coding Standard and proposes a method for automatically reducing false positives of static analysis tools by combining static analysis and deductive verification. Firstly, static analysis tools are used to detect positions in the source code which may not conform to the SEI CERT C. Secondly, behavioral properties of the program at the detected positions are described by ANSI/ISO C Specification Language regarding the SEI CERT C rule or recommendation they may violate. Deductive verification is then used to prove whether these properties satisfy conventions of the SEI CERT C. Our experiment with source code for tractors, shows that 20% of violation suggestions of Rosecheckers can be handled automatically and 90% false positives of them are reduced.