Filtering False Positive Alarms in JavaDL and Language Experience Report

Sammanfattning: JavaDL is a domain-specific language (DSL) for writing static program analyses in a declarative logic programming style, based on Datalog. The key feature of this DSL is the ability to pattern-match on literal source code syntax and reason non-locally through declarative programming. Static program analyses generally suer from producing false positive alarms. This results in developers having to deal with unnecessary alarms. A machine learning model could mitigate this problem by filtering true alarms from false ones. We investigate if features based on JavaDL’s pattern-matching are effective. Our results show that they are not, as the knowledge learned does not transfer over to unseen projects. Points-to analysis is another way of improving the precision of otherwise more conservative analysis such as finding non-exhaustive switch statements in Java. As the first users of JavaDL we attempted to write a Points-to analysis, for a subset of the Java language. We report on our experience and put forth possible improvements to JavaDL in a case study.