Abstract:Today, small and medium-sized enterprises (SMEs) in the software industry face major challenges. Their resource constraints require high efficiency in development. Furthermore, quality assurance (QA) measures need to be taken to mitigate the risk of additional, expensive effort for bug fixes or compensations. Automated static analysis (ASA) can reduce this risk because it promises low application effort. SMEs seem to take little advantage of this opportunity. Instead, they still mainly rely on the dynamic analysis approach of software testing. In this article, we report on our experiences from a technology transfer project. Our aim was to evaluate the results static analysis can provide for SMEs as well as the problems that occur when introducing and using static analysis in SMEs. We analysed five software projects from five collaborating SMEs using three different ASA techniques: code clone detection, bug pattern detection and architecture conformance analysis. Following the analysis, we applied a quality model to aggregate and evaluate the results. Our study shows that the effort required to introduce ASA techniques in SMEs is small (mostly below one person-hour each). Furthermore, we encountered only few technical problems. By means of the analyses, we could detect multiple defects in production code. The participating companies perceived the analysis results to be a helpful addition to their current QA and will include the analyses in their QA process. With the help of the Quamoco quality model, we could efficiently aggregate and rate static analysis results. However, we also encountered a partial mismatch with the opinions of the SMEs. We conclude, that ASA and quality models can be a valuable and affordable addition to the QA process of SMEs.

On the Benefit of Automated Static Analysis for Small and Medium-Sized Software Enterprises

Introduction of Static Quality Analysis in Small and Medium-Sized Software Enterprises: Experiences from Technology Transfer

Improving software security with static automated code analysis in an industry setting

Supporting secure programming in web applications through interactive static analysis.

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Efficacy of static analysis tools for software defect detection on open-source projects

Why Do Software Developers Use Static Analysis Tools? A User-Centered Study of Developer Needs and Motivations

Test Analysis: Searching for Faults in Tests (N)

Self-adaptive static analysis

Automated Software Testing Starting from Static Analysis: Current State of the Art

Formal Runtime Error Detection During Development in the Automotive Industry

A Static Analysis Platform for Investigating Security Trends in Repositories

Towards SOA-Based Code Defect Analysis

The Cost and Benefits of Static Analysis During Development

Easing Maintenance of Academic Static Analyzers

Static Code Analysis in the AI Era: An In-depth Exploration of the Concept, Function, and Potential of Intelligent Code Analysis Agents

How far are German companies in improving security through static program analysis tools?

Automated Program Analysis for Novice Programmers

Scaling Symbolic Execution to Large Software Systems

Deploying Static Analysis

Automatically Inspecting Thousands of Static Bug Warnings with Large Language Model: How Far Are We?