A Survival Analysis-Based Prioritization of Code Checker Warning: A Case Study Using PMD

Abstract

Static code analysis tools (code checkers) scan source programs and issue warnings to potentially-problematic parts. Programmers can utilize a code checker whenever they change their source code to make sure that their code changes do not carry high risks of decreasing the code quality. Although code checkers would be helpful to detect risky code changes as early as possible, there is a practical problem which prevents an active utilization of such tools in the real: code checkers tend to produce a lot of false-positive warnings, i.e., such a tool outputs many warnings, but the majority of them are not attractive to the programmer. Toward an efficient utilization of code checkers, this paper proposes an application of the survival analysis method to prioritize code checker warnings. The proposed method estimates a warning’s lifetime with using the real trend of warnings through code changes; the brevity of warning means its importance because severe warnings are related to problematic parts which programmers would fix sooner. This paper conducts a large-scale case study of 6,927,432 warnings (259 types of warnings) appeared in 100 open source software projects. The results show that only 30 types of warnings are practically important for programmers in terms of the brevity, and the proposed method can drastically reduce the number of really needed warnings.