Abstract

Static software checking tools are useful as an additional automated software inspection step that can easily be integrated in the development cycle and assist in creating secure, reliable and high quality code. However, an often quoted disadvantage of these tools is that they generate an overly large number of warnings, including many false positives (warnings that do not indicate real bugs) due to the approximate analysis techniques. Therefore, programmers have to spend a considerable amount of time on screening out real bugs from a large number of re-ported warnings, which is time-consuming and inefficient. This information overload can easily hinder the potential benefits of such tools. The tools ’ warning prioritization is little help in focusing on important warnings: the maximum possible precision by selecting high priority warning instances. In this thesis project, we conducted an empirical investigation on the issues detected by a popular bug-finding tool, FindBugs, on 2 open-source Java projects, Tomcat and Axis. We investigate the correlation between source code metrics and warning categories