# How to Find Actionable Static Analysis Warnings: A Case Study with FindBugs

arXiv: https://arxiv.org/abs/2205.10504 · HTML: https://mlsanity.com/paper/2205.10504/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 23 of its 80 references that are in the map.
- First posted on arXiv 21 May 2022.

## Builds on (most cited first, 23 of 23)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [MixMatch: A Holistic Approach to Semi-Supervised Learning](https://mlsanity.com/paper/1905.02249/) (2019)
- [CodeBERT: A Pre-Trained Model for Programming and Natural Languages](https://mlsanity.com/paper/2002.08155/) (2020)
- [Visualizing the Loss Landscape of Neural Nets](https://mlsanity.com/paper/1712.09913/) (2017)
- [Semi-Supervised Learning with Deep Generative Models](https://mlsanity.com/paper/1406.5298/) (2014)
- [On the Number of Linear Regions of Deep Neural Networks](https://mlsanity.com/paper/1402.1869/) (2014)
- [How Does Batch Normalization Help Optimization?](https://mlsanity.com/paper/1805.11604/) (2018)
- [S4L: Self-Supervised Semi-Supervised Learning](https://mlsanity.com/paper/1905.03670/) (2019)
- [A Survey on Deep Learning with Noisy Labels: How to train your model when you cannot trust on the annotations?](https://mlsanity.com/paper/2012.03061/) (2020)
- [Is "Better Data" Better than "Better Data Miners"? (On the Benefits of Tuning SMOTE for Defect Prediction)](https://mlsanity.com/paper/1705.03697/) (2017)
- [Detecting False Alarms from Automatic Static Analysis Tools: How Far are We?](https://mlsanity.com/paper/2202.05982/) (2022)
- [Better Data Labelling with EMBLEM (and how that Impacts Defect Prediction)](https://mlsanity.com/paper/1905.01719/) (2019)
- [Learning to Reduce False Positives in Analytic Bug Detectors](https://mlsanity.com/paper/2203.09907/) (2022)
- [How to "DODGE" Complex Software Analytics?](https://mlsanity.com/paper/1902.01838/) (2019)
- [Identifying Self-Admitted Technical Debts with Jitterbug: A Two-step Approach](https://mlsanity.com/paper/2002.11049/) (2020)
- [An Empirical Study of Rule-Based and Learning-Based Approaches for Static Application Security Testing](https://mlsanity.com/paper/2107.01921/) (2021)
- [Simpler Hyperparameter Optimization for Software Analytics: Why, How, When?](https://mlsanity.com/paper/2008.07334/) (2020)
- [DebtFree: Minimizing Labeling Cost in Self-Admitted Technical Debt Identification using Semi-Supervised Learning](https://mlsanity.com/paper/2201.10592/) (2022)
- [Mining Scientific Workflows for Anomalous Data Transfers](https://mlsanity.com/paper/2103.12221/) (2021)
- [NullAway: Practical Type-Based Null Safety for Java](https://mlsanity.com/paper/1907.02127/) (2019)
- [Validating Static Warnings via Testing Code Fragments](https://mlsanity.com/paper/2106.04735/) (2021)

## Built on by (most cited first, 1 of 1)

- [Is Hyper-Parameter Optimization Different for Software Analytics?](https://mlsanity.com/paper/2401.09622/) (2024)

## Abstract (arXiv)

Automatically generated static code warnings suffer from a large number of false alarms. Hence, developers only take action on a small percent of those warnings. To better predict which static code warnings should not be ignored, we suggest that analysts need to look deeper into their algorithms to find choices that better improve the particulars of their specific problem. Specifically, we show here that effective predictors of such warnings can be created by methods that locally adjust the decision boundary (between actionable warnings and others). These methods yield a new high water-mark for recognizing actionable static code warnings. For eight open-source Java projects (cassandra, jmeter, commons, lucene-solr, maven, ant, tomcat, derby) we achieve perfect test results on 4/8 datasets and, overall, a median AUC (area under the true negatives, true positives curve) of 92%.