Who Writes What Checkers?—Learning from Bug Repositories

Static code checkers have been useful for finding bugs in large-scale C code. Domain-specific checkers are particularly effective in finding deep/subtle bugs because they can make use of domain-specific knowledge. To develop domain-specific checkers, however, typical bug patterns in certain domains must first be extracted. This paper explores the use of machine learning to help extract bug patterns from bug repositories. We used natural language processing to analyze over 370,000 bug descriptions of Linux and classified them into 66 clusters. Our preliminary work with this approach is encouraging: by investigating one of the 66 clusters, we were able to identify typical bug patterns in PCI device drivers and developed static code checkers to find them. When applied to the latest version of Linux, the developed checkers found two unknown bugs.