Despite their ability to aid developers in detecting potential defects early in the software development life cycle, static analysis tools often suffer from precision issues (i.e., high false positive rates of reported alarms). To improve the availability of these tools, many automated warning identification techniques have been proposed to assist developers in classifying false positive alarms. However, existing approaches mainly focus on using hand-engineered features or statement-level abstract syntax tree token sequences to represent the defective code, failing to capture semantics from the reported alarms. To overcome the limitations of traditional approaches, this paper employs deep neural networks' powerful feature extraction and representation abilities to generate code semantics from control flow graph paths for warning identification. The control flow graph abstractly represents the execution process of a given program. Thus, the generated path sequences of the control flow graph can guide the deep neural networks to learn semantic information about the potential defect more accurately. In this paper, we fine-tune the pre-trained language model to encode the path sequences and capture the semantic representations for model building. Finally, this paper conducts extensive experiments on eight open-source projects to verify the effectiveness of the proposed approach by comparing it with the state-of-the-art baselines.

翻译：尽管静态分析工具能够帮助开发者在软件开发生命周期早期检测潜在缺陷，但其常因精度问题（即报告告警的高误报率）而受限。为提升这些工具的可用性，学界提出了多种自动化告警识别技术以辅助开发者分类误报警报。然而，现有方法主要依赖人工设计特征或基于语句级抽象语法树令牌序列来表征缺陷代码，未能从所报告告警中捕获语义信息。为克服传统方法的局限性，本文利用深度神经网络强大的特征提取与表征能力，从控制流图路径中生成代码语义以进行告警识别。控制流图以抽象形式描述程序的执行过程，其生成的路径序列可引导深度神经网络更准确地学习潜在缺陷的语义信息。本文通过微调预训练语言模型来编码路径序列，并捕获语义表征以构建模型。最后，我们在八个开源项目上开展广泛实验，通过与最先进基线方法的对比验证了所提方法的有效性。