Software Engineering Institute

Static analysis (SA) tools analyze source code for security defects and alert users to issues that require repair. While invaluable, SA tools tend to produce a large number of alerts (many of which are false positives), making it difficult to identify valid alerts and, in turn, to address critical security defects. SEI researchers are actively publishing research and building prototype tools to improve static analysis alerts.