@inproceedings{4f4d3df653c14faebac99674b318f1b9,
title = "Is a False Positive really False Positive?",
abstract = "As the number of devices with software increases, software reliability and security has become more critical. To improve reliability and security, developers and test engineers use static analysis tools to find defects early in the development process. However, it takes a lot of time and effort to determine whether alarms from performing static analysis are true or false positive. In this paper, we argue that all integer overflow generated by static analysis tools are weaknesses and should eventually be corrected. To show that our argument is reasonable, we explain static analysis results for binary search program code and CWE:190 example code in terms of reliability and security. It is unnecessary to identify whether the integer overflow generated by static analysis tools is true or false positive.",
keywords = "False Positive, Integer Overflow, Software Reliability, Software Security, Static Analysis, True Positive",
author = "Choi, {Hong Jun} and Hyuk Lee and Choi, {Jin Young}",
note = "Funding Information: This work was supported by the National Research Foundation of Korea(NRF) grant funded by the Korea government(MSIT) (No. NRF-2018R1A2B6009122). Publisher Copyright: {\textcopyright} 2021 Global IT Research Institute (GiRI).; 23rd International Conference on Advanced Communication Technology, ICACT 2021 ; Conference date: 07-02-2021 Through 10-02-2021",
year = "2021",
month = feb,
day = "7",
doi = "10.23919/ICACT51234.2021.9370442",
language = "English",
series = "International Conference on Advanced Communication Technology, ICACT",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "145--149",
booktitle = "23rd International Conference on Advanced Communication Technology",
}