Towards Better Static Code Analysis Reports: Sentence Transformer-based Filtering of Non-Actionable Alerts
Tamás Aladics, Norbert Vándor, Rudolf Ferenc, Péter Hegedűs
TLDR
STAF uses sentence transformers to filter non-actionable static code analysis alerts, significantly reducing developer fatigue and improving tool usability.
Key contributions
- Proposes STAF, a Sentence Transformer-based Actionability Filtering method for static code analysis alerts.
- Leverages transformer architecture with sentence embeddings to classify SCA alerts as actionable or non-actionable.
- Achieves an 89% F1 score, outperforming existing SCA filtering methods by 11% in within-project settings.
- Significantly reduces non-actionable findings, enhancing the usability and effectiveness of static analysis tools.
Why it matters
This paper addresses the critical issue of "alert fatigue" in static code analysis, a major barrier to tool adoption. By effectively filtering non-actionable alerts, STAF makes SCA reports more useful and less overwhelming for developers. This can lead to earlier detection of real bugs and vulnerabilities, improving software quality.
Original Abstract
Static code analysis (SCA) tools are widely used as effective ways to detect bugs and vulnerabilities in software systems. However, the reports generated by these tools often contain a large number of non-actionable findings, which can overwhelm developers to the point of ignoring them altogether -- this phenomenon is known as "alert fatigue". In this paper, we combat alert fatigue by proposing STAF: Sentence Transformer-based Actionability Filtering. Our approach leverages a transformer based architecture with sentence embeddings to classify findings into actionable and non-actionable categories. Evaluating STAF on a large dataset of reports from Java projects, we demonstrate that our method can effectively reduce the number of non-actionable findings while maintaining a high level of accuracy in identifying actionable issues. The results show that our approach can improve the usability of static analysis tools reaching an F1 score of 89%, outperforming existing methods for SCA warning filtering by at least 11% in a within-project setting and by at least 6% in a cross-project setting. By providing a more focused and relevant set of findings, we aim to enhance the overall effectiveness of static analysis in software development.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.