Static analysis based efficient elimination of false positive

A system for efficient elimination of false positives in static analysis of application code, the system comprises:

• a processor,
• a memory communicatively coupled with the processor, wherein the memory contains instructions that are readable by the processor;
• a static analyzer module is configured to analyze the application code in order to generate a plurality of static analysis warnings;
• an annotator module is configured to generate an assertion corresponding to each of the plurality of static analysis warnings;
• a complete-range non-deterministic value (cnv) variables identifier module is configured to compute one or more set of cnv variables corresponding to each assertion of the application code using the static analysis techniques,
• wherein the one or more set of cnv variables include complete-range of non-deterministic values;
• a cnv variables checker module is configured to check whether the variables in respect of the generated assertion are cnv variables or not at each of the assertion program points;
• a redundant call identifier module is configured to identify whether one or more verification calls for each generated assertion corresponding to the each of the plurality of static analysis warnings are redundant or non-redundant based on presence of the one or more set of cnv variables, further wherein the system skips the one or more determined redundant verification calls to cause eliminate elimination of false positives efficiently;
• and
• an assertion verifier module is configured to invoke a model checker to verify the one or more non-redundant verification calls and to eliminate the corresponding static analysis warning as false positive depending on the outcome of the verification;
• wherein the identification of redundant verification calls may use the criterion of single or all assertion variables to be cnv variables at the assertion program point.

A computer readable medium storing instructions for efficient elimination of false positives in static analysis of application code, the method comprising:

• performing static analysis on the application code to generate a plurality of static analysis warnings using a static analyzer module;
• generating an assertion corresponding to each of the plurality of static analysis warnings using an annotator module;
• computing one or more set of complete-range non-deterministic value (cnv) variables through static analysis using a cnv variables identifier module, wherein the one or more set of cnv variables include complete-range of non-deterministic values;
• checking whether one or more variables in respect of the generated assertion are cnv variables or not at each of the assertion program points using a cnv variables checker module;
• determining whether one or more verification calls for each generated assertion corresponding to the each of the plurality of static analysis warnings are redundant or non-redundant based on presence of the one or more set of cnv variables, using a redundant calls identifier module;
• skipping the one or more determined redundant verification calls to cause efficient elimi-nation of false positives;
• invoking a model checker to verify the one or more non-redundant verification calls by using an assertion verifier module;
• and
• eliminating by the assertion verifier module the corresponding static analysis warning as false positive depending on the outcome of the verification using a model checker;
• wherein the identification of redundant verification calls may use the criterion of single or all assertion variables to be cnv variables at the assertion program point.