Lessons from building static analysis tools at Google

Finding bugs is easy

Hovemeyer, D., & Pugh, W. (2004) · Companion to the ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA Companion) · doi:10.1145/1028664.1028717 · Cited by 770

A few billion lines of code later

Bessey, A., Block, K., Chelf, B., Chou, A., Fulton, B., Hallem, S., Henri-Gros, C., Kamsky, A., McPeak, S., & Engler, D. (2010) · Communications of the ACM · doi:10.1145/1646353.1646374 · Cited by 634

Using Static Analysis to Find Bugs

Ayewah, N., Pugh, W., Hovemeyer, D., Morgenthaler, J. D., & Penix, J. (2008) · IEEE Software · doi:10.1109/ms.2008.130 · Cited by 536

The ASTREÉ Analyzer

Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Miné, A., Monniaux, D., & Rival, X. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31987-0_3 · Cited by 426

Finding bugs is easy

Hovemeyer, D., & Pugh, W. (2004) · ACM SIGPLAN Notices · doi:10.1145/1052883.1052895 · Cited by 397

Thorough static analysis of device drivers

Ball, T., Bounimova, E., Cook, B., Levin, V., Lichtenberg, J., McGarvey, C., Ondrusek, B., Rajamani, S. K., & Ustuner, A. (2006) · European Conference on Computer Systems · doi:10.1145/1217935.1217943 · Cited by 373

FlumeJava

Chambers, C., Raniwala, A., Perry, F., Adams, S., Henry, R. R., Bradshaw, R., & Weizenbaum, N. (2010) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/1806596.1806638 · Cited by 330

Moving Fast with Software Verification

Calcagno, C., Distefano, D., Dubreil, J., Gabi, D., Hooimeijer, P., Luca, M., O’Hearn, P. W., Papakonstantinou, I., Purbrick, J., & Rodriguez, D. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-17524-9_1 · Cited by 272

Why don’t software developers use static analysis tools to find bugs

Johnson, B., Song, Y., Murphy-Hill, E. R., & Bowdidge, R. W. (2013) · Cited by 268

Why Google stores billions of lines of code in a single repository

Potvin, R., & Levenberg, J. (2016) · Communications of the ACM · doi:10.1145/2854146 · Cited by 158

Automated program repair

Le Goues, C., Pradel, M., & Roychoudhury, A. (2019) · Communications of the ACM · doi:10.1145/3318162 · Cited by 410

Scaling static analyses at Facebook

Distefano, D., Fähndrich, M., Logozzo, F., & O'Hearn, P. W. (2019) · Communications of the ACM · doi:10.1145/3338112 · Cited by 212

How developers engage with static analysis tools in different contexts

Vassallo, C., Panichella, S., Palomba, F., Proksch, S., Gall, H. C., & Zaidman, A. (2019) · Empirical Software Engineering · doi:10.1007/s10664-019-09750-5 · Cited by 164

An empirical study on the effectiveness of static C code analyzers for vulnerability detection

Lipp, S., Bănescu, S., & Pretschner, A. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534380 · Cited by 134

The Effectiveness of Supervised Machine Learning Algorithms in Predicting Software Refactoring

Aniche, M. F., Maziero, E. G., Durelli, R. S., & Durelli, V. H. S. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3021736 · Cited by 137

RacerD: compositional static race detection

Blackshear, S., Gorogiannis, N., O’Hearn, P. W., & Sergey, I. (2018) · Proceedings of the ACM on Programming Languages · doi:10.1145/3276514 · Cited by 89

Continuous Reasoning

O’Hearn, P. W. (2018) · ACM/IEEE Symposium on Logic in Computer Science (LICS) · doi:10.1145/3209108.3209109 · Cited by 82

Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study

Fu, Y., Liang, P., Tahir, A., Li, Z., Shahin, M., Yu, J., & Chen, J. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3716848 · Cited by 205

Local Reasoning About the Presence of Bugs: Incorrectness Separation Logic

Raad, A., Berdine, J., Dang, H.-H., Dreyer, D. R., O’Hearn, P. W., & Villard, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-53291-8_14 · Cited by 74

From DevOps to MLOps: Overview and Application to Electricity Market Forecasting

Subramanya, R., Sierla, S., & Vyatkin, V. V. (2022) · Applied Sciences · doi:10.3390/app12199851 · Cited by 79

Quality-Aware DevOps Research: Where Do We Stand?

Alnafessah, A., Gias, A. U., Wang, R., Zhu, L., Casale, G., & Filieri, A. (2021) · IEEE Access · doi:10.1109/access.2021.3064867 · Cited by 64

Automatically Inspecting Thousands of Static Bug Warnings with Large Language Model: How Far Are We?

Wen, C., Cai, Y., Zhang, B., Su, J., Xu, Z., Liu, D., Qin, S., Ming, Z., & Tian, C. (2024) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3653718 · Cited by 66

A Survey of Practical Formal Methods for Security

Kulik, T., Dongol, B., Larsen, P. G., Macedo, H. D., Schneider, S. A., Tran-Jørgensen, P. W. V., & Woodcock, J. (2022) · Formal Aspects of Computing · doi:10.1145/3522582 · Cited by 61

Phoenix: automated data-driven synthesis of repairs for static analysis violations

Bavishi, R., Yoshida, H., & Prasad, M. R. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3338952 · Cited by 61

A critical comparison on six static analysis tools: Detection, agreement, and precision

Lenarduzzi, V., Pecorelli, F., Saarimäki, N., Lujan, S., & Palomba, F. (2022) · Journal of Systems and Software · doi:10.1016/j.jss.2022.111575 · Cited by 57

Detecting false alarms from automatic static analysis tools

Kang, H. J., Aw, K. L., & Lo, D. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510214 · Cited by 52

Finding real bugs in big programs with incorrectness logic

Le, Q. L., Raad, A., Villard, J., Berdine, J., Dreyer, D. R., & O’Hearn, P. W. (2022) · Proceedings of the ACM on Programming Languages · doi:10.1145/3527325 · Cited by 52

A large scale study on how developers discuss code smells and anti-pattern in Stack Exchange sites

Tahir, A., Dietrich, J. B., Counsell, S., Licorish, S. A., & Yamashita, A. F. (2020) · Information and Software Technology · doi:10.1016/j.infsof.2020.106333 · Cited by 52

A large-scale study of usability criteria addressed by static analysis tools

Nachtigall, M., Schlichtig, M., & Bodden, E. (2022) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3533767.3534374 · Cited by 47

Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study

Tamberg, K., & Bahşi, H. (2025) · IEEE Access · doi:10.1109/access.2025.3541146 · Cited by 77

Mitigating False Positive Static Analysis Warnings: Progress, Challenges, and Opportunities

Guo, Z., Tan, T., Liu, S., Liu, X., Lai, W., Yang, Y., Li, Y., Chen, L., Dong, W., & Zhou, Y. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3329667 · Cited by 43

Challenges with Responding to Static Analysis Tool Alerts

Imtiaz, N., Rahman, A., Farhana, E., & Williams, L. A. (2019) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr.2019.00049 · Cited by 42

On The Introduction of Automatic Program Repair in Bloomberg

Kirbas, S., Windels, E., McBello, O., Kells, K., Pagano, M. W., Szalanski, R., Nowack, V., Winter, E., Counsell, S., Bowes, D., et al. (2021) · IEEE Software · doi:10.1109/ms.2021.3071086 · Cited by 42

Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics

Tan, T. H., & Li, Y. (2023) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3597926.3598120 · Cited by 40

"False negative - that one is going to kill you": Understanding Industry Perspectives of Static Analysis based Security Testing

Ami, A. S., Moran, K., Poshyvanyk, D., & Nadkarni, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00019 · Cited by 40

A longitudinal study of static analysis warning evolution and the effects of PMD on software quality in Apache open source projects

Trautsch, A., Herbold, S., & Grabowski, J. (2020) · Empirical Software Engineering · doi:10.1007/s10664-020-09880-1 · Cited by 40

How does code style inconsistency affect pull request integration? An exploratory study on 117 GitHub projects

Zou, W., Xuan, J., Xie, X., Chen, Z., & Xu, B. (2019) · Empirical Software Engineering · doi:10.1007/s10664-019-09720-x · Cited by 37

How Do Developers Act on Static Analysis Alerts? An Empirical Study of Coverity Usage

Imtiaz, N., Murphy, T. B., & Williams, L. A. (2019) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre.2019.00040 · Cited by 38

A Logic for Locally Complete Abstract Interpretations

Bruni, R., Giacobazzi, R., Roberta Gori, B., & Ranzato, F. (2021) · ACM/IEEE Symposium on Logic in Computer Science (LICS) · doi:10.1109/lics52264.2021.9470608 · Cited by 37

Code-level model checking in the software development workflow

Chong, N., Cook, B., Καλλάς, Κ., Khazem, K., Monteiro, F. R., Schwartz‐Narbonne, D., Taşiran, S., Tautschnig, M., & Tuttle, M. R. (2020) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3377813.3381347 · Cited by 36

Can Clean New Code Reduce Technical Debt Density?

Δίγκας, Γ., Chatzigeorgiou, A., Ampatzoglou, A., & Avgeriou, P. (2020) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2020.3032557 · Cited by 36

Security Notifications in Static Analysis Tools: Developers’ Attitudes, Comprehension, and Ability to Act on Them

Tahaei, M., Vaniea, K. E., Beznosov, K., & Wolters, M. K. (2021) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3411764.3445616 · Cited by 45

Hyperstyle

Birillo, A., Vlasov, I., Burylov, A., Selishchev, V., Goncharov, A., Tikhomirova, E., Vyahhi, N., & Bryksin, T. (2022) · ACM Technical Symposium on Computer Science Education (SIGCSE) · doi:10.1145/3478431.3499294 · Cited by 35

Neural-Based Test Oracle Generation: A Large-Scale Evaluation and Lessons Learned

Hossain, S. B., Filieri, A., Dwyer, M. B., Elbaum, S. G., & Visser, W. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616265 · Cited by 34

SAVER

Hong, S., Lee, J., Lee, J. S., & Oh, H. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380323 · Cited by 32

Identifying Redundancies in Fork-based Development

Ren, L., Zhou, S., Kästner, C., & Wąsowski, A. (2019) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner.2019.8668023 · Cited by 33

A Correctness and Incorrectness Program Logic

Bruni, R., Giacobazzi, R., Roberta Gori, B., & Ranzato, F. (2023) · Journal of the ACM · doi:10.1145/3582267 · Cited by 31

Understanding Breaking Changes in the Wild

Jayasuriya, D., Terragni, V., Dietrich, J. B., Ou, S., & Blincoe, K. (2023) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3597926.3598147 · Cited by 30

Continuously reasoning about programs using differential Bayesian inference

Heo, K., Raghothaman, M., Si, X., & Naik, M. (2019) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3314221.3314616 · Cited by 29

Code‐level model checking in the software development workflow at Amazon Web Services

Chong, N., Cook, B., Eidelman, J., Καλλάς, Κ., Khazem, K., Monteiro, F. R., Schwartz‐Narbonne, D., Taşiran, S., Tautschnig, M., & Tuttle, M. R. (2021) · Software Practice and Experience · doi:10.1002/spe.2949 · Cited by 29

Towards s/engineer/bot: Principles for Program Repair Bots

van Tonder, R., & Goues, C. L. (2019) · IEEE/ACM International Workshop on Bots in Software Engineering (BotSE) · doi:10.1109/botse.2019.00019 · Cited by 27

Model checking C++ programs

Monteiro, F. R., Gadelha, M. R., & Cordeiro, L. C. (2021) · Software Testing Verification and Reliability · doi:10.1002/stvr.1793 · Cited by 27

Concurrent incorrectness separation logic

Raad, A., Berdine, J., Dreyer, D. R., & O’Hearn, P. W. (2022) · Proceedings of the ACM on Programming Languages · doi:10.1145/3498695 · Cited by 25

Evocatio

Jiang, Z., Gan, S., Herrera, A., Toffalini, F., Romerio, L., Tang, C., Egele, M., Zhang, C., & Payer, M. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560575 · Cited by 25

Katana : Dual Slicing Based Context for Learning Bug Fixes

Sintaha, M., Nashid, N., & Mesbah, A. (2023) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3579640 · Cited by 24

Sorald: Automatic Patch Suggestions for SonarQube Static Analysis Violations

Etemadi, K., Harrand, N., Larsén, S., Adzemovic, H., Phu, H. L., Verma, A., Madeiral, F., Wikström, D., & Monperrus, M. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3167316 · Cited by 23

Software fault prediction based on the dynamic selection of learning technique: findings from the eclipse project study

Rathore, S. S., & Kumar, S. (2021) · Applied Intelligence · doi:10.1007/s10489-021-02346-x · Cited by 23

Mithra: Anomaly Detection as an Oracle for Cyberphysical Systems

Afzal, A., Goues, C. L., & Timperley, C. (2021) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3120680 · Cited by 20

Sys: A {Static/Symbolic} Tool for Finding Good Bugs in Good (Browser) Code

Brown, F., Stefan, D., & Engler, D. (2020) · USENIX Security Symposium · Cited by 22

Characterizing the evolution of statically-detectable performance issues of Android apps

Das, T., Penta, M. D., & Malavolta, I. (2020) · Empirical Software Engineering · doi:10.1007/s10664-019-09798-3 · Cited by 22

Detecting and Characterizing Propagation of Security Weaknesses in Puppet-based infrastructure Management

Rahman, A., & Parnin, C. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3265962 · Cited by 21

A Precise and Expressive Lattice-theoretical Framework for Efficient Network Verification

Horn, A., Kheradmand, A., & Prasad, M. R. (2019) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2019.8888144 · Cited by 20

How to Find Actionable Static Analysis Warnings: A Case Study With FindBugs

Yedida, R., Kang, H. J., Tu, H., Yang, X., Lo, D., & Menzies, T. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3234206 · Cited by 27

Style-Analyzer: Fixing Code Style Inconsistencies with Interpretable Unsupervised Algorithms

Markovtsev, V., Long, W., Mougard, H., Slavnov, K., & Bulychev, E. (2019) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr.2019.00073 · Cited by 20

Codebase-adaptive detection of security-relevant methods

Piskachev, G., Quang, L. N., & Bodden, E. (2019) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3293882.3330556 · Cited by 20

Demanded abstract interpretation

Stein, B., Chang, B.-Y. E., & Sridharan, M. (2021) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3453483.3454044 · Cited by 19

Striking a balance

Utture, A., Liu, S., Kalhauge, C. G., & Palsberg, J. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510166 · Cited by 19

Can GPT-4 Replicate Empirical Software Engineering Research?

Liang, J. T., Badea, C., Bird, C., DeLine, R., Ford, D., Forsgren, N., & Zimmermann, T. (2024) · Proceedings of the ACM on Software Engineering · doi:10.1145/3660767 · Cited by 19

Conquering the extensional scalability problem for value-flow analysis frameworks

Shi, Q., Wu, R., Fan, G., & Zhang, C. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380346 · Cited by 19

Demanded Abstract Interpretation

Stein, B. (2022) · CU Scholar (University of Colorado Boulder) · Cited by 19

Leveraging Practitioners’ Feedback to Improve a Security Linter

Reis, S., Abreu, R., d’Amorim, M., & Fortunato, D. (2022) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3551349.3560419 · Cited by 18

Towards Efficient Large-Scale Interprocedural Program Static Analysis on Distributed Data-Parallel Computation

Gu, R., Zuo, Z., Jiang, X., Yin, H., Wang, Z., Wang, L., Li, X., & Huang, Y. (2020) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3036190 · Cited by 18

Chianina: an evolving graph system for flow- and context-sensitive analyses of million lines of C code

Zuo, Z., Zhang, Y., Pan, Q., Lu, S., Li, Y., Wang, L., Li, X., & Xu, G. H. (2021) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/3453483.3454085 · Cited by 18

A Critical Comparison on Six Static Analysis Tools: Detection Agreement and PrecisionPreprint

Lenarduzzi, V., Pecorelli, F., Saarimäki, N., Lujan, S., & Palomba, F. (2022) · SSRN Electronic Journal · doi:10.2139/ssrn.4044439 · Cited by 18

AutoLog: A Log Sequence Synthesis Framework for Anomaly Detection

Huo, Y., Li, Y., Su, Y., He, P., Xie, Z., & Lyu, M. R.-T. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00133 · Cited by 22

Statfier: Automated Testing of Static Analyzers via Semantic-Preserving Program Transformations

Zhang, H., Pei, Y., Chen, J., & Tan, S. H. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616272 · Cited by 17

Evaluating Source Code Quality with Large Language Models: a comparative study

Simões, I. R. D. S., & Venson, E. (2024) · Brazilian Symposium on Software Quality (SBQS) · doi:10.1145/3701625.3701650 · Cited by 16

Goshawk: Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis

Lyu, Y., Fang, Y., Zhang, Y., Sun, Q., Ma, S., Bertino, E., Lu, K., & Li, J. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833613 · Cited by 18

Can static analysis tools find more defects?

Mehrpour, S., & LaToza, T. D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10232-4 · Cited by 14

On the use of static analysis to engage students with software quality improvement: An experience with PMD

AlOmar, E. A., AlOmar, S. A., & Mkaouer, M. W. (2023) · IEEE/ACM International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET) · doi:10.1109/icse-seet58685.2023.00023 · Cited by 14

BigSpa: An Efficient Interprocedural Static Analysis Engine in the Cloud

Zuo, Z., Gu, R., Jiang, X., Wang, Z., Huang, Y., Wang, L., & Li, X. (2019) · IEEE International Parallel and Distributed Processing Symposium (IPDPS) · doi:10.1109/ipdps.2019.00086 · Cited by 14

Directed Dynamic Symbolic Execution for Static Analysis Warnings Confirmation

Gerasimov, A. Y. (2018) · Programming and Computer Software · doi:10.1134/s036176881805002x · Cited by 14

Machine-learning supported vulnerability detection in source code

Sonnekalb, T. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3341466 · Cited by 14

Certifying Decision Trees Against Evasion Attacks by Program Analysis

Calzavara, S., Ferrara, P., & Lucchese, C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-59013-0_21 · Cited by 14

Examining the Relationship of Code and Architectural Smells with Software Vulnerabilities

Sultana, K. Z., Codabux, Z., & Williams, B. J. (2020) · Asia-Pacific Software Engineering Conference (APSEC) · doi:10.1109/apsec51365.2020.00011 · Cited by 14

Find bugs in static bug finders

Wang, J., Huang, Y., Wang, S., & Wang, Q. (2022) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3524610.3527899 · Cited by 13

Usability-Oriented Design of Liquid Types for Java

Gamboa, C., Canelas, P., Timperley, C. S., & Fonseca, A. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00132 · Cited by 13

Understanding the Impact of APIs Behavioral Breaking Changes on Client Applications

Jayasuriya, D., Terragni, V., Dietrich, J. B., & Blincoe, K. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643782 · Cited by 13

Enabling continuous integration in a formal methods setting

Couto, L. D., Tran-Jørgensen, P. W. V., Nilsson, R. S., & Larsen, P. G. (2019) · International Journal on Software Tools for Technology Transfer · doi:10.1007/s10009-019-00546-y · Cited by 12

Same File, Different Changes: The Potential of Meta-Maintenance on GitHub

Hata, H., Kula, R. G., Ishio, T., & Treude, C. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00076 · Cited by 12

What happens in my code reviews? An investigation on automatically classifying review changes

Fregnan, E., Petrulio, F., Geronimo, L. D., & Bacchelli, A. (2022) · Empirical Software Engineering · doi:10.1007/s10664-021-10075-5 · Cited by 12

Predictive Monitoring against Pattern Regular Languages

Ang, Z., & Mathur, U. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3632915 · Cited by 12

Please fix this mutant: How do developers resolve mutants surfaced during code review?

Petrović, G., Ivanković, M., Fraser, G., & Just, R. (2023) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip58684.2023.00019 · Cited by 11

Applying formal verification to microkernel IPC at meta

Carbonneaux, Q., Zilberstein, N., Klee, C., O’Hearn, P. W., & Nardelli, F. Z. (2022) · ACM SIGPLAN International Conference on Certified Programs and Proofs (CPP) · doi:10.1145/3497775.3503681 · Cited by 11

Hippodrome : Data Race Repair Using Static Analysis Summaries

Costea, A., Tiwari, A., Chianasta, S., Kishore, R., Roychoudhury, A., & Sergey, I. (2022) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3546942 · Cited by 10

BigDataflow: A Distributed Interprocedural Dataflow Analysis Framework

Sun, Z., Xu, D., Zhang, Y., Qi, Y. F., Wang, Y., Zuo, Z., Wang, Z., Li, Y., Li, X., Lu, Q., et al. (2023) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3611643.3616348 · Cited by 10

MLOps critical success factors - A systematic literature review

Mehmood, Y., Sabahat, N., & Ijaz, M. A. (2024) · VFAST Transactions on Software Engineering · doi:10.21015/vtse.v12i1.1747 · Cited by 12

Finding and Understanding Defects in Static Analyzers by Constructing Automated Oracles

He, W., Di, P., Ming, M., Zhang, C., Su, T., Li, S., & Sui, Y. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3660781 · Cited by 10

Sound and Partially-Complete Static Analysis of Data-Races in GPU Programs

Liew, D., Cogumbreiro, T., & Lange, J. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3689797 · Cited by 19

Non-termination Proving at Scale

Raad, A., Vanegue, J., & O’Hearn, P. W. (2024) · Proceedings of the ACM on Programming Languages · doi:10.1145/3689720 · Cited by 10

Automated Code Review Comment Classification to Improve Modern Code Reviews

Ochodek, M., Staron, M., Meding, W., & Söder, O. (2022) · Lecture notes in business information processing · doi:10.1007/978-3-031-04115-0_3 · Cited by 10

The role of program analysis in security vulnerability detection: Then and now

Cifuentes, C., Gauthier, F., Hassanshahi, B., Krishnan, P., & McCall, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103463 · Cited by 10

On the Security Blind Spots of Software Composition Analysis

Dietrich, J. B., Rasheed, S., Jordan, A., & White, T. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3689944.3696165 · Cited by 10

Active Documentation: Helping Developers Follow Design Decisions

Mehrpour, S., LaToza, T. D., & Kindi, R. K. (2019) · IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC) · doi:10.1109/vlhcc.2019.8818816 · Cited by 10

Heaps'n leaks

Benz, M., Kristensen, E. K., Luo, L., Borges, N. P., Bodden, E., & Zeller, A. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380438 · Cited by 10

Systemizing Interprocedural Static Analysis of Large-scale Systems Code with Graspan

Zuo, Z., Wang, K., Hussain, A., Sani, A. A., Zhang, Y., Lu, S., Dou, W., Wang, L., Li, X., Wang, C., et al. (2020) · ACM Transactions on Computer Systems · doi:10.1145/3466820 · Cited by 10

Learning How to Listen: Automatically Finding Bug Patterns in Event-Driven JavaScript APIs

Arteca, E., Schäfer, M., & Tip, F. (2022) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2022.3147975 · Cited by 9

SoK: Human, Organizational, and Technological Dimensions of Developers’ Challenges in Engineering Secure Software

Mokhberi, A., & Beznosov, K. (2021) · European Symposium on Usable Security (EuroUSEC) · doi:10.1145/3481357.3481522 · Cited by 9

Closing the Gap: A User Study on the Real-world Usefulness of AI-powered Vulnerability Detection & Repair in the IDE

Steenhoek, B. J., Sivaraman, K., Gonzalez, R. S., Mohylevskyy, Y., Moghaddam, R. Z., & Le, W. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00126 · Cited by 8

Tailoring programs for static analysis via program transformation

van Tonder, R., & Goues, C. L. (2020) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3377811.3380343 · Cited by 8

Static analysis at GitHub

Clem, T., & Thomson, P. (2022) · Communications of the ACM · doi:10.1145/3486594 · Cited by 1

How developers engage with static analysis tools in different contexts

Vassallo, C., Panichella, S., Palomba, F., Proksch, S., Gall, H. C., & Zaidman, A. (2020) · ZHAW Digital Collection · doi:10.21256/zhaw-19308

Scaling static analyses at Facebook

Distefano, D., Fähndrich, M., Logozzo, F., & O'Hearn, P. W. (2019) · Communications of the ACM · doi:10.1145/3338112 · Cited by 212

JIT Feedback - what Experienced Developers like about Static Analysis

Tymchuk, Y., Ghafari, M., & Nierstrasz, O. (2018) · doi:10.7892/boris.126941 · Cited by 2

Adventures in commercial-grade static analysis (keynote)

Goldsmith, S. F. (2019) · State Of the Art in Java Program Analysis · doi:10.1145/3315568.3338015