The goal of this presentation is to introduce a novel learning-based strategy designed for disjunctive static bug-finders. Static bug-finders employed in industrial settings often rely on disjunctive analysis, which involves distinguishing program states along various execution paths. Path-sensitivity is crucial for minimizing false positives and explaining bug report; however, it also exponentially increases analysis costs. Consequently, practical bug-finders, such as Infer, utilize a state-selection heuristic to maintain only a limited number of valuable states. Yet, devising an effective heuristic for real-world programs poses significant challenges, leading to sub-optimal cost-to-efficiency ratios for modern static bug-finders. In this work, we endeavors to address this issue by leveraging machine learning techniques to learn efficient state-selection heuristics from data.

In this talk, I will discuss the challenges we encountered and the strategies we employed to overcome them. Specifically, I will present a technique that efficiently collects alarm-triggering traces, learns multiple candidate models, and adaptively selects the most suitable model tailored to each target program.