Lessons from building static analysis tools at Google

Finding bugs is easy

Hovemeyer, D., & Pugh, W. (2004) · Companion to the ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA Companion) · doi:10.1145/1028664.1028717 · Cited by 770 · see citing works

A few billion lines of code later

Bessey, A., Block, K., Chelf, B., Chou, A., Fulton, B., Hallem, S., Henri-Gros, C., Kamsky, A., McPeak, S., & Engler, D. (2010) · Communications of the ACM · doi:10.1145/1646353.1646374 · Cited by 634 · see citing works

Using Static Analysis to Find Bugs

Ayewah, N., Pugh, W., Hovemeyer, D., Morgenthaler, J. D., & Penix, J. (2008) · IEEE Software · doi:10.1109/ms.2008.130 · Cited by 536 · see citing works

The ASTREÉ Analyzer

Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Miné, A., Monniaux, D., & Rival, X. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31987-0_3 · Cited by 426 · see citing works

Finding bugs is easy

Hovemeyer, D., & Pugh, W. (2004) · ACM SIGPLAN Notices · doi:10.1145/1052883.1052895 · Cited by 397 · see citing works

Thorough static analysis of device drivers

Ball, T., Bounimova, E., Cook, B., Levin, V., Lichtenberg, J., McGarvey, C., Ondrusek, B., Rajamani, S. K., & Ustuner, A. (2006) · European Conference on Computer Systems · doi:10.1145/1217935.1217943 · Cited by 373 · see citing works

FlumeJava

Chambers, C., Raniwala, A., Perry, F., Adams, S., Henry, R. R., Bradshaw, R., & Weizenbaum, N. (2010) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/1806596.1806638 · Cited by 330 · see citing works

Moving Fast with Software Verification

Calcagno, C., Distefano, D., Dubreil, J., Gabi, D., Hooimeijer, P., Luca, M., O’Hearn, P. W., Papakonstantinou, I., Purbrick, J., & Rodriguez, D. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-17524-9_1 · Cited by 272 · see citing works

Why don’t software developers use static analysis tools to find bugs

Johnson, B., Song, Y., Murphy-Hill, E. R., & Bowdidge, R. W. (2013) · Cited by 268 · see citing works

Why Google stores billions of lines of code in a single repository

Potvin, R., & Levenberg, J. (2016) · Communications of the ACM · doi:10.1145/2854146 · Cited by 158 · see citing works

Tricorder: Building a Program Analysis Ecosystem

Sadowski, C., van Gogh, J., Jaspan, C. N. C., Söderberg, E., Winter, C., & Google Inc (2015) · Cited by 144 · see citing works

The Google FindBugs fixit

Ayewah, N., & Pugh, W. (2010) · International Symposium on Software Testing and Analysis · doi:10.1145/1831708.1831738 · Cited by 130 · see citing works

Thorough static analysis of device drivers

Ball, T., Bounimova, E., Cook, B., Levin, V., Lichtenberg, J., McGarvey, C., Ondrusek, B., Rajamani, S. K., & Ustuner, A. (2006) · ACM SIGOPS Operating Systems Review · doi:10.1145/1218063.1217943 · Cited by 99 · see citing works

Righting software

Larus, J. R., Ball, T., Das, M., DeLine, R. A., Fähndrich, M. A., Pincus, J., Rajamani, S. K., & Venkatapathy, R. (2004) · IEEE Software · doi:10.1109/ms.2004.1293079 · Cited by 97 · see citing works

Does bug prediction support human developers? findings from a google case study

Lewis, C., Lin, Z., Sadowski, C., Zhu, X., Ou, R., & Whitehead, E. J. (2013) · doi:10.5555/2486788.2486838 · Cited by 93 · see citing works

Modular and verified automatic program repair

Logozzo, F., & Ball, T. (2012) · ACM International Conference on Object Oriented Programming Systems Languages and Applications (OOPSLA) · doi:10.1145/2384616.2384626 · Cited by 80 · see citing works

Building Useful Program Analysis Tools Using an Extensible Java Compiler

Aftandilian, E. E., Sauciuc, R., Priya, S., & Krishnan, S. (2012) · IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM) · doi:10.1109/scam.2012.28 · Cited by 78 · see citing works

Repair of Boolean Programs with an Application to C

Griesmayer, A., Bloem, R., & Cook, B. (2006) · Lecture notes in computer science · doi:10.1007/11817963_33 · Cited by 72 · see citing works

Deductive Program Repair

Kneuss, E., Koukoutos, M., & Kunčak, V. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-21668-3_13 · Cited by 48 · see citing works

Large-Scale Automated Refactoring Using ClangMR

Wright, H. K., Jasper, D., Klimek, M., Carruth, C., & Wan, Z. (2013) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsm.2013.93 · Cited by 35 · see citing works

Scalable, example-based refactorings with refaster

Wasserman, L. (2013) · doi:10.1145/2541348.2541355 · Cited by 32 · see citing works

Modular and verified automatic program repair

Logozzo, F., & Ball, T. (2012) · ACM SIGPLAN Notices · doi:10.1145/2398857.2384626 · Cited by 19 · see citing works

Making "Push On Green" a Reality.

Klein, D. V., Betser, D. M., & Monroe, M. G. (2014) · ;login:: the magazine of USENIX & SAGE · Cited by 1 · see citing works

Automated program repair

Le Goues, C., Pradel, M., & Roychoudhury, A. (2019) · Communications of the ACM · doi:10.1145/3318162 · Cited by 410 · see citing works

Scaling static analyses at Facebook

Distefano, D., Fähndrich, M., Logozzo, F., & O'Hearn, P. W. (2019) · Communications of the ACM · doi:10.1145/3338112 · Cited by 212 · see citing works

How developers engage with static analysis tools in different contexts

Vassallo, C., Panichella, S., Palomba, F., Proksch, S., Gall, H. C., & Zaidman, A. (2019) · Empirical Software Engineering · doi:10.1007/s10664-019-09750-5 · Cited by 164 · see citing works

An empirical study on the effectiveness of static C code analyzers for vulnerability detection

Lipp, S., Bănescu, S., & Pretschner, A. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534380 · Cited by 134 · see citing works

The Effectiveness of Supervised Machine Learning Algorithms in Predicting Software Refactoring

Aniche, M. F., Maziero, E. G., Durelli, R. S., & Durelli, V. H. S. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3021736 · Cited by 127 · see citing works

RacerD: compositional static race detection

Blackshear, S., Gorogiannis, N., O’Hearn, P. W., & Sergey, I. (2018) · Proceedings of the ACM on Programming Languages · doi:10.1145/3276514 · Cited by 89 · see citing works

Continuous Reasoning

O’Hearn, P. W. (2018) · ACM/IEEE Symposium on Logic in Computer Science (LICS) · doi:10.1145/3209108.3209109 · Cited by 82 · see citing works

Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study

Fu, Y., Liang, P., Tahir, A., Li, Z., Shahin, M., Yu, J., & Chen, J. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3716848 · Cited by 75 · see citing works

Local Reasoning About the Presence of Bugs: Incorrectness Separation Logic

Raad, A., Berdine, J., Dang, H.-H., Dreyer, D. R., O’Hearn, P. W., & Villard, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-53291-8_14 · Cited by 74 · see citing works

From DevOps to MLOps: Overview and Application to Electricity Market Forecasting

Subramanya, R., Sierla, S., & Vyatkin, V. V. (2022) · Applied Sciences · doi:10.3390/app12199851 · Cited by 79 · see citing works

Quality-Aware DevOps Research: Where Do We Stand?

Alnafessah, A., Gias, A. U., Wang, R., Zhu, L., Casale, G., & Filieri, A. (2021) · IEEE Access · doi:10.1109/access.2021.3064867 · Cited by 64 · see citing works

Automatically Inspecting Thousands of Static Bug Warnings with Large Language Model: How Far Are We?

Wen, C., Cai, Y., Zhang, B., Su, J., Xu, Z., Liu, D., Qin, S., Ming, Z., & Tian, C. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3653718 · Cited by 66 · see citing works

A Survey of Practical Formal Methods for Security

Kulik, T., Dongol, B., Larsen, P. G., Macedo, H. D., Schneider, S. A., Tran-Jørgensen, P. W. V., & Woodcock, J. (2022) · Formal Aspects of Computing · doi:10.1145/3522582 · Cited by 61 · see citing works

Phoenix: automated data-driven synthesis of repairs for static analysis violations

Bavishi, R., Yoshida, H., & Prasad, M. R. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3338952 · Cited by 61 · see citing works

A critical comparison on six static analysis tools: Detection, agreement, and precision

Lenarduzzi, V., Pecorelli, F., Saarimäki, N., Lujan, S., & Palomba, F. (2022) · Journal of Systems and Software · doi:10.1016/j.jss.2022.111575 · Cited by 57 · see citing works

Detecting false alarms from automatic static analysis tools

Kang, H. J., Aw, K. L., & Lo, D. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510214 · Cited by 52 · see citing works

Finding real bugs in big programs with incorrectness logic

Le, Q. L., Raad, A., Villard, J., Berdine, J., Dreyer, D. R., & O’Hearn, P. W. (2022) · Proceedings of the ACM on Programming Languages · doi:10.1145/3527325 · Cited by 52 · see citing works

A large scale study on how developers discuss code smells and anti-pattern in Stack Exchange sites

Tahir, A., Dietrich, J. B., Counsell, S., Licorish, S. A., & Yamashita, A. F. (2020) · Information and Software Technology · doi:10.1016/j.infsof.2020.106333 · Cited by 52 · see citing works

A large-scale study of usability criteria addressed by static analysis tools

Nachtigall, M., Schlichtig, M., & Bodden, E. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534374 · Cited by 47 · see citing works

Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study

Tamberg, K., & Bahşi, H. (2025) · IEEE Access · doi:10.1109/access.2025.3541146 · Cited by 46 · see citing works

Mitigating False Positive Static Analysis Warnings: Progress, Challenges, and Opportunities

Guo, Z., Tan, T., Liu, S., Liu, X., Lai, W., Yang, Y., Li, Y., Chen, L., Dong, W., & Zhou, Y. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3329667 · Cited by 43 · see citing works

Challenges with Responding to Static Analysis Tool Alerts

Imtiaz, N., Rahman, A., Farhana, E., & Williams, L. A. (2019) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr.2019.00049 · Cited by 42 · see citing works

On The Introduction of Automatic Program Repair in Bloomberg

Kirbas, S., Windels, E., McBello, O., Kells, K., Pagano, M. W., Szalanski, R., Nowack, V., Winter, E., Counsell, S., Bowes, D., et al. (2021) · IEEE Software · doi:10.1109/ms.2021.3071086 · Cited by 42 · see citing works

Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics

Tan, T. H., & Li, Y. (2023) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3597926.3598120 · Cited by 40 · see citing works

"False negative - that one is going to kill you": Understanding Industry Perspectives of Static Analysis based Security Testing

Ami, A. S., Moran, K., Poshyvanyk, D., & Nadkarni, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00019 · Cited by 40 · see citing works

A longitudinal study of static analysis warning evolution and the effects of PMD on software quality in Apache open source projects

Trautsch, A., Herbold, S., & Grabowski, J. (2020) · Empirical Software Engineering · doi:10.1007/s10664-020-09880-1 · Cited by 40 · see citing works

How does code style inconsistency affect pull request integration? An exploratory study on 117 GitHub projects

Zou, W., Xuan, J., Xie, X., Chen, Z., & Xu, B. (2019) · Empirical Software Engineering · doi:10.1007/s10664-019-09720-x · Cited by 37 · see citing works

How Do Developers Act on Static Analysis Alerts? An Empirical Study of Coverity Usage

Imtiaz, N., Murphy, T. B., & Williams, L. A. (2019) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre.2019.00040 · Cited by 38 · see citing works

A Logic for Locally Complete Abstract Interpretations

Bruni, R., Giacobazzi, R., Roberta Gori, B., & Ranzato, F. (2021) · ACM/IEEE Symposium on Logic in Computer Science (LICS) · doi:10.1109/lics52264.2021.9470608 · Cited by 37 · see citing works

Code-level model checking in the software development workflow

Chong, N., Cook, B., Καλλάς, Κ., Khazem, K., Monteiro, F. R., Schwartz‐Narbonne, D., Taşiran, S., Tautschnig, M., & Tuttle, M. R. (2020) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3377813.3381347 · Cited by 36 · see citing works

Can Clean New Code Reduce Technical Debt Density?

Δίγκας, Γ., Chatzigeorgiou, A., Ampatzoglou, A., & Avgeriou, P. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3032557 · Cited by 36 · see citing works

Security Notifications in Static Analysis Tools: Developers’ Attitudes, Comprehension, and Ability to Act on Them

Tahaei, M., Vaniea, K. E., Beznosov, K., & Wolters, M. K. (2021) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3411764.3445616 · Cited by 35 · see citing works

Hyperstyle

Birillo, A., Vlasov, I., Burylov, A., Selishchev, V., Goncharov, A., Tikhomirova, E., Vyahhi, N., & Bryksin, T. (2022) · ACM Technical Symposium on Computer Science Education (SIGCSE) · doi:10.1145/3478431.3499294 · Cited by 35 · see citing works

Counterfactual Explanations for Models of Code

Cito, J., Dillig, I., Murali, V., & Chandra, S. (2021) · 2022 IEEE/ACM 44th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513081 · Cited by 66 · see citing works

Neural-Based Test Oracle Generation: A Large-Scale Evaluation and Lessons Learned

Hossain, S. B., Filieri, A., Dwyer, M. B., Elbaum, S. G., & Visser, W. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616265 · Cited by 34 · see citing works

SAVER

Hong, S., Lee, J., Lee, J. S., & Oh, H. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380323 · Cited by 32 · see citing works

Identifying Redundancies in Fork-based Development

Ren, L., Zhou, S., Kästner, C., & Wąsowski, A. (2019) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner.2019.8668023 · Cited by 32 · see citing works

A Correctness and Incorrectness Program Logic

Bruni, R., Giacobazzi, R., Roberta Gori, B., & Ranzato, F. (2023) · Journal of the ACM · doi:10.1145/3582267 · Cited by 31 · see citing works

Understanding Breaking Changes in the Wild

Jayasuriya, D., Terragni, V., Dietrich, J. B., Ou, S., & Blincoe, K. (2023) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3597926.3598147 · Cited by 30 · see citing works

Continuously reasoning about programs using differential Bayesian inference

Heo, K., Raghothaman, M., Si, X., & Naik, M. (2019) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3314221.3314616 · Cited by 29 · see citing works

Code‐level model checking in the software development workflow at Amazon Web Services

Chong, N., Cook, B., Eidelman, J., Καλλάς, Κ., Khazem, K., Monteiro, F. R., Schwartz‐Narbonne, D., Taşiran, S., Tautschnig, M., & Tuttle, M. R. (2021) · Software Practice and Experience · doi:10.1002/spe.2949 · Cited by 29 · see citing works

Towards s/engineer/bot: Principles for Program Repair Bots

van Tonder, R., & Goues, C. L. (2019) · IEEE/ACM International Workshop on Bots in Software Engineering (BotSE) · doi:10.1109/botse.2019.00019 · Cited by 27 · see citing works

Model checking C++ programs

Monteiro, F. R., Gadelha, M. R., & Cordeiro, L. C. (2021) · Software Testing Verification and Reliability · doi:10.1002/stvr.1793 · Cited by 27 · see citing works

Concurrent incorrectness separation logic

Raad, A., Berdine, J., Dreyer, D. R., & O’Hearn, P. W. (2022) · Proceedings of the ACM on Programming Languages · doi:10.1145/3498695 · Cited by 25 · see citing works

Evocatio

Jiang, Z., Gan, S., Herrera, A., Toffalini, F., Romerio, L., Tang, C., Egele, M., Zhang, C., & Payer, M. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560575 · Cited by 25 · see citing works

Katana : Dual Slicing Based Context for Learning Bug Fixes

Sintaha, M., Nashid, N., & Mesbah, A. (2023) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3579640 · Cited by 24 · see citing works

Sorald: Automatic Patch Suggestions for SonarQube Static Analysis Violations

Etemadi, K., Harrand, N., Larsén, S., Adzemovic, H., Phu, H. L., Verma, A., Madeiral, F., Wikström, D., & Monperrus, M. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3167316 · Cited by 23 · see citing works

Software fault prediction based on the dynamic selection of learning technique: findings from the eclipse project study

Rathore, S. S., & Kumar, S. (2021) · Applied Intelligence · doi:10.1007/s10489-021-02346-x · Cited by 23 · see citing works

Mithra: Anomaly Detection as an Oracle for Cyberphysical Systems

Afzal, A., Goues, C. L., & Timperley, C. (2021) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3120680 · Cited by 20 · see citing works

Sys: A {Static/Symbolic} Tool for Finding Good Bugs in Good (Browser) Code

Brown, F., Stefan, D., & Engler, D. (2020) · USENIX Security Symposium · Cited by 22 · see citing works

Characterizing the evolution of statically-detectable performance issues of Android apps

Das, T., Penta, M. D., & Malavolta, I. (2020) · Empirical Software Engineering · doi:10.1007/s10664-019-09798-3 · Cited by 22 · see citing works

Detecting and Characterizing Propagation of Security Weaknesses in Puppet-based infrastructure Management

Rahman, A., & Parnin, C. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3265962 · Cited by 21 · see citing works

A Precise and Expressive Lattice-theoretical Framework for Efficient Network Verification

Horn, A., Kheradmand, A., & Prasad, M. R. (2019) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2019.8888144 · Cited by 20 · see citing works

How to Find Actionable Static Analysis Warnings: A Case Study With FindBugs

Yedida, R., Kang, H. J., Tu, H., Yang, X., Lo, D., & Menzies, T. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3234206 · Cited by 20 · see citing works

Style-Analyzer: Fixing Code Style Inconsistencies with Interpretable Unsupervised Algorithms

Markovtsev, V., Long, W., Mougard, H., Slavnov, K., & Bulychev, E. (2019) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr.2019.00073 · Cited by 20 · see citing works

Codebase-adaptive detection of security-relevant methods

Piskachev, G., Quang, L. N., & Bodden, E. (2019) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3293882.3330556 · Cited by 20 · see citing works

Demanded abstract interpretation

Stein, B., Chang, B.-Y. E., & Sridharan, M. (2021) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3453483.3454044 · Cited by 19 · see citing works

Striking a balance

Utture, A., Liu, S., Kalhauge, C. G., & Palsberg, J. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510166 · Cited by 19 · see citing works

Can GPT-4 Replicate Empirical Software Engineering Research?

Liang, J. T., Badea, C., Bird, C., DeLine, R., Ford, D., Forsgren, N., & Zimmermann, T. (2024) · Proceedings of the ACM on Software Engineering · doi:10.1145/3660767 · Cited by 19 · see citing works

Conquering the extensional scalability problem for value-flow analysis frameworks

Shi, Q., Wu, R., Fan, G., & Zhang, C. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380346 · Cited by 19 · see citing works

Demanded Abstract Interpretation

Stein, B. (2022) · CU Scholar (University of Colorado Boulder) · Cited by 19 · see citing works

Leveraging Practitioners’ Feedback to Improve a Security Linter

Reis, S., Abreu, R., d’Amorim, M., & Fortunato, D. (2022) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3551349.3560419 · Cited by 18 · see citing works

Towards Efficient Large-Scale Interprocedural Program Static Analysis on Distributed Data-Parallel Computation

Gu, R., Zuo, Z., Jiang, X., Yin, H., Wang, Z., Wang, L., Li, X., & Huang, Y. (2020) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3036190 · Cited by 18 · see citing works

Chianina: an evolving graph system for flow- and context-sensitive analyses of million lines of C code

Zuo, Z., Zhang, Y., Pan, Q., Lu, S., Li, Y., Wang, L., Li, X., & Xu, G. H. (2021) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3453483.3454085 · Cited by 18 · see citing works

A Critical Comparison on Six Static Analysis Tools: Detection Agreement and PrecisionPreprint

Lenarduzzi, V., Pecorelli, F., Saarimäki, N., Lujan, S., & Palomba, F. (2022) · SSRN Electronic Journal · doi:10.2139/ssrn.4044439 · Cited by 18 · see citing works

AutoLog: A Log Sequence Synthesis Framework for Anomaly Detection

Huo, Y., Li, Y., Su, Y., He, P., Xie, Z., & Lyu, M. R.-T. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00133 · Cited by 17 · see citing works

Statfier: Automated Testing of Static Analyzers via Semantic-Preserving Program Transformations

Zhang, H., Pei, Y., Chen, J., & Tan, S. H. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616272 · Cited by 17 · see citing works

Evaluating Source Code Quality with Large Language Models: a comparative study

Simões, I. R. D. S., & Venson, E. (2024) · Brazilian Symposium on Software Quality (SBQS) · doi:10.1145/3701625.3701650 · Cited by 16 · see citing works

Goshawk: Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis

Lyu, Y., Fang, Y., Zhang, Y., Sun, Q., Ma, S., Bertino, E., Lu, K., & Li, J. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833613 · Cited by 15 · see citing works

Can static analysis tools find more defects?

Mehrpour, S., & LaToza, T. D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10232-4 · Cited by 14 · see citing works

On the use of static analysis to engage students with software quality improvement: An experience with PMD

AlOmar, E. A., AlOmar, S. A., & Mkaouer, M. W. (2023) · IEEE/ACM International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET) · doi:10.1109/icse-seet58685.2023.00023 · Cited by 14 · see citing works

BigSpa: An Efficient Interprocedural Static Analysis Engine in the Cloud

Zuo, Z., Gu, R., Jiang, X., Wang, Z., Huang, Y., Wang, L., & Li, X. (2019) · IEEE International Parallel and Distributed Processing Symposium (IPDPS) · doi:10.1109/ipdps.2019.00086 · Cited by 14 · see citing works

Directed Dynamic Symbolic Execution for Static Analysis Warnings Confirmation

Gerasimov, A. Y. (2018) · Programming and Computer Software · doi:10.1134/s036176881805002x · Cited by 14 · see citing works

Machine-learning supported vulnerability detection in source code

Sonnekalb, T. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3341466 · Cited by 14 · see citing works

Certifying Decision Trees Against Evasion Attacks by Program Analysis

Calzavara, S., Ferrara, P., & Lucchese, C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-59013-0_21 · Cited by 14 · see citing works

Examining the Relationship of Code and Architectural Smells with Software Vulnerabilities

Sultana, K. Z., Codabux, Z., & Williams, B. J. (2020) · Asia-Pacific Software Engineering Conference (APSEC) · doi:10.1109/apsec51365.2020.00011 · Cited by 14 · see citing works

Find bugs in static bug finders

Wang, J., Huang, Y., Wang, S., & Wang, Q. (2022) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3524610.3527899 · Cited by 13 · see citing works

Usability-Oriented Design of Liquid Types for Java

Gamboa, C., Canelas, P., Timperley, C. S., & Fonseca, A. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00132 · Cited by 13 · see citing works

Understanding the Impact of APIs Behavioral Breaking Changes on Client Applications

Jayasuriya, D., Terragni, V., Dietrich, J. B., & Blincoe, K. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643782 · Cited by 13 · see citing works

Enabling continuous integration in a formal methods setting

Couto, L. D., Tran-Jørgensen, P. W. V., Nilsson, R. S., & Larsen, P. G. (2019) · International Journal on Software Tools for Technology Transfer · doi:10.1007/s10009-019-00546-y · Cited by 12 · see citing works

Same File, Different Changes: The Potential of Meta-Maintenance on GitHub

Hata, H., Kula, R. G., Ishio, T., & Treude, C. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00076 · Cited by 12 · see citing works

What happens in my code reviews? An investigation on automatically classifying review changes

Fregnan, E., Petrulio, F., Geronimo, L. D., & Bacchelli, A. (2022) · Empirical Software Engineering · doi:10.1007/s10664-021-10075-5 · Cited by 12 · see citing works

Predictive Monitoring against Pattern Regular Languages

Ang, Z., & Mathur, U. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3632915 · Cited by 12 · see citing works

Please fix this mutant: How do developers resolve mutants surfaced during code review?

Petrović, G., Ivanković, M., Fraser, G., & Just, R. (2023) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip58684.2023.00019 · Cited by 11 · see citing works

Applying formal verification to microkernel IPC at meta

Carbonneaux, Q., Zilberstein, N., Klee, C., O’Hearn, P. W., & Nardelli, F. Z. (2022) · ACM SIGPLAN International Conference on Certified Programs and Proofs (CPP) · doi:10.1145/3497775.3503681 · Cited by 11 · see citing works

Hippodrome : Data Race Repair Using Static Analysis Summaries

Costea, A., Tiwari, A., Chianasta, S., Kishore, R., Roychoudhury, A., & Sergey, I. (2022) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3546942 · Cited by 10 · see citing works

BigDataflow: A Distributed Interprocedural Dataflow Analysis Framework

Sun, Z., Xu, D., Zhang, Y., Qi, Y. F., Wang, Y., Zuo, Z., Wang, Z., Li, Y., Li, X., Lu, Q., et al. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616348 · Cited by 10 · see citing works

MLOps critical success factors - A systematic literature review

Mehmood, Y., Sabahat, N., & Ijaz, M. A. (2024) · VFAST Transactions on Software Engineering · doi:10.21015/vtse.v12i1.1747 · Cited by 12 · see citing works

Finding and Understanding Defects in Static Analyzers by Constructing Automated Oracles

He, W., Di, P., Ming, M., Zhang, C., Su, T., Li, S., & Sui, Y. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3660781 · Cited by 10 · see citing works

Sound and Partially-Complete Static Analysis of Data-Races in GPU Programs

Liew, D., Cogumbreiro, T., & Lange, J. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3689797 · Cited by 10 · see citing works

Non-termination Proving at Scale

Raad, A., Vanegue, J., & O’Hearn, P. W. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3689720 · Cited by 10 · see citing works

Automated Code Review Comment Classification to Improve Modern Code Reviews

Ochodek, M., Staron, M., Meding, W., & Söder, O. (2022) · Lecture notes in business information processing · doi:10.1007/978-3-031-04115-0_3 · Cited by 10 · see citing works

The role of program analysis in security vulnerability detection: Then and now

Cifuentes, C., Gauthier, F., Hassanshahi, B., Krishnan, P., & McCall, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103463 · Cited by 10 · see citing works

On the Security Blind Spots of Software Composition Analysis

Dietrich, J. B., Rasheed, S., Jordan, A., & White, T. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3689944.3696165 · Cited by 10 · see citing works

Active Documentation: Helping Developers Follow Design Decisions

Mehrpour, S., LaToza, T. D., & Kindi, R. K. (2019) · IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC) · doi:10.1109/vlhcc.2019.8818816 · Cited by 10 · see citing works

Heaps'n leaks

Benz, M., Kristensen, E. K., Luo, L., Borges, N. P., Bodden, E., & Zeller, A. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380438 · Cited by 10 · see citing works

Systemizing Interprocedural Static Analysis of Large-scale Systems Code with Graspan

Zuo, Z., Wang, K., Hussain, A., Sani, A. A., Zhang, Y., Lu, S., Dou, W., Wang, L., Li, X., Wang, C., et al. (2020) · ACM Transactions on Computer Systems · doi:10.1145/3466820 · Cited by 10 · see citing works

Learning How to Listen: Automatically Finding Bug Patterns in Event-Driven JavaScript APIs

Arteca, E., Schäfer, M., & Tip, F. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2022.3147975 · Cited by 9 · see citing works

SoK: Human, Organizational, and Technological Dimensions of Developers’ Challenges in Engineering Secure Software

Mokhberi, A., & Beznosov, K. (2021) · European Symposium on Usable Security (EuroUSEC) · doi:10.1145/3481357.3481522 · Cited by 9 · see citing works

Closing the Gap: A User Study on the Real-world Usefulness of AI-powered Vulnerability Detection & Repair in the IDE

Steenhoek, B. J., Sivaraman, K., Gonzalez, R. S., Mohylevskyy, Y., Moghaddam, R. Z., & Le, W. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00126 · Cited by 8 · see citing works

Static analysis at GitHub

Clem, T., & Thomson, P. (2022) · Communications of the ACM · doi:10.1145/3486594 · Cited by 1 · see citing works

How developers engage with static analysis tools in different contexts

Vassallo, C., Panichella, S., Palomba, F., Proksch, S., Gall, H. C., & Zaidman, A. (2020) · ZHAW Digital Collection · doi:10.21256/zhaw-19308

Scaling static analyses at Facebook

Distefano, D., Fähndrich, M., Logozzo, F., & O'Hearn, P. W. (2019) · Communications of the ACM · doi:10.1145/3338112 · Cited by 212 · see citing works

JIT Feedback - what Experienced Developers like about Static Analysis

Tymchuk, Y., Ghafari, M., & Nierstrasz, O. (2018) · doi:10.7892/boris.126941 · Cited by 2 · see citing works

Adventures in commercial-grade static analysis (keynote)

Goldsmith, S. F. (2019) · State Of the Art in Java Program Analysis · doi:10.1145/3315568.3338015