In software practice, static analysis tools remain an integral part of detecting defects in software and there have been various tools designed to run the analysis in different programming languages like Java, C++, and Python. This paper presents an empirical comparison of popular static analysis tools for identifying software defects using several datasets using Java, C++, and Python code. The study used popular analysis tools such as SonarQube, PMD, Checkstyle, and FindBugs to perform the comparison based on using the datasets. The study also used various evaluation metrics such as Precision, Recall, and F1-score to determine the performance of each analysis tool. The study results show that SonarQube performs considerably well than all other tools in terms of its defect detection across the various three programming languages. These findings remain consistent with other existing studies that also agree on SonarQube being an effective tool for defect detection in software. The study contributes to much insight on static analysis tools with different programming languages and additional information to understand the strengths and weaknesses of each analysis tool. The study also discusses the implications for software development researchers and practitioners, and future directions in this area. Our research approach aim is to provide a recommendation guideline to enable software developers, practitioners, and researchers to make the right choice on static analysis tools to detect errors in their software codes. Also, for researchers to embark on investigating and improving software analysis tools to enhance the quality and reliability of the software systems and its software development processes practice.
翻译:在软件工程实践中,静态分析工具仍是检测软件缺陷的核心手段,目前已存在多种针对Java、C++和Python等不同编程语言设计的分析工具。本研究基于多个采用Java、C++和Python代码的数据集,对主流静态分析工具的缺陷识别能力进行了实证比较。研究选用SonarQube、PMD、Checkstyle和FindBugs等常用分析工具,并采用精确率、召回率和F1分数等评估指标对各工具性能进行评测。实验结果表明,在三种编程语言的缺陷检测中,SonarQube的表现显著优于其他工具。该结论与现有研究一致,均证实SonarQube在软件缺陷检测方面具有高效性。本研究不仅深化了对不同编程语言环境下静态分析工具的理解,还提供了各分析工具优缺点的认知框架。同时,本文探讨了该发现对软件开发研究人员与实践者的启示意义,并指出该领域的未来研究方向。本研究的核心目标是建立推荐指南,帮助软件开发人员、实践者及研究人员针对其软件代码的缺陷检测正确选用静态分析工具,同时为研究人员深入探索并改进软件分析工具、提升软件系统质量与可靠性以及优化开发流程实践提供依据。