arXiv:2411.15368cs.SEcs.LG2024-11中稿 · ICSE'25 Research T…被引 1

类型检查能显著影响神经网络对动态语言中变量误用的检测效果。

The Power of Types: Exploring the Impact of Type Checking on Neural Bug Detection in Dynamically Typed Languages

  • 将类型检查器融入神经漏洞检测流程,提升检测准确性。
  • 现有数据集超半数漏洞可被类型检查发现,影响模型训练方向。
  • 移除类型相关漏洞可让模型更关注复杂深层错误,适合高阶开发者使用。

在动态类型语言如Python中,自动化漏洞检测对保障代码质量至关重要。由于缺乏强制类型注解,传统静态分析难以早期发现错误。近年来深度神经网络推动了神经漏洞检测器的发展。在静态类型语言中,类型检查器已集成于编译器,因此神经检测器的设计会考虑此因素。但以往研究在动态类型语言的神经检测器训练与测试中忽略了这一环节。当使用可选类型检查器时,若在测试中包含易被类型检查发现的漏洞,会误导性能评估;若将其纳入训练集,则会使检测器过度聚焦于类型相关错误。本文研究类型检查对变量误用漏洞检测的影响,对现有合成与真实数据集进行类型检查,评估类型相关漏洞的普遍性,并探究其对神经检测器训练与测试的影响。结果表明,现有数据集中存在大量可通过类型检查发现的漏洞。基于此,我们发现将神经检测器与类型检查器结合,在有类型注解的代码中尤为有益。进一步分析显示,神经检测器对类型相关漏洞的识别能力优于其他漏洞。此外,从训练数据中剔除类型相关漏洞后,检测器对类型检查无法覆盖的漏洞识别能力显著提升。

原文摘要 · Abstract (English)

Motivation: Automated bug detection in dynamically typed languages such as Python is essential for maintaining code quality. The lack of mandatory type annotations in such languages can lead to errors that are challenging to identify early with traditional static analysis tools. Recent progress in deep neural networks has led to increased use of neural bug detectors. In statically typed languages, a type checker is integrated into the compiler and thus taken into consideration when the neural bug detector is designed for these languages. Problem: However, prior studies overlook this aspect during the training and testing of neural bug detectors for dynamically typed languages. When an optional type checker is used, assessing existing neural bug detectors on bugs easily detectable by type checkers may impact their performance estimation. Moreover, including these bugs in the training set of neural bug detectors can shift their detection focus toward the wrong type of bugs. Contribution: We explore the impact of type checking on various neural bug detectors for variable misuse bugs, a common type targeted by neural bug detectors. Existing synthetic and real-world datasets are type-checked to evaluate the prevalence of type-related bugs. Then, we investigate how type-related bugs influence the training and testing of the neural bug detectors. Findings: Our findings indicate that existing bug detection datasets contain a significant proportion of type-related bugs. Building on this insight, we discover integrating the neural bug detector with a type checker can be beneficial, especially when the code is annotated with types. Further investigation reveals neural bug detectors perform better on type-related bugs than other bugs. Moreover, removing type-related bugs from the training data helps improve neural bug detectors' ability to identify bugs beyond the scope of type checkers.

漏洞检测类型检查神经网络Python

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。