Increasing the Precision of Static Code Analysis Using Large Language Models

This paper describes an approach to verifying the results of static code analysis using large language models (LLMs), which filters warnings to eliminate false positives. The prompt for LLM is constructed by retaining data collected by the analyzer, such as abstract syntax trees, symbol tables, and type and function summaries. These data can either be directly included in the prompt or used to more accurately identify the code fragments required to verify the warning. The approach was implemented in SharpChecker, an industrial static analyzer for C#. Real-world code evaluation demonstrated an improved precision by up to 10 percentage points with a preserved high recall (0.8 to 0.97) for context-sensitive and interprocedural path-sensitive detectors of resource leaks, null dereferences, and integer overflows. For an unreachable code detector, the use of information from the static analyzer allows us to improve the recall by 11–27 percentage points compared to an approach that only uses the program source code in the prompt.