 |
We define true positive and false positive in the static analysis as follows using Sommerville's reliability and security. Since reliability is the ability to provide services as specified, only inputs defined in the specification are considered within the reliability range, and other inputs are considered within the security range. When an input defined in the specification enters the program, if the static analysis tool generates an alarm for the statement, it is a true positive in terms of reliability and a false positive in terms of security. When an undefined input in the specification enters the program, true positive and false positive is the opposite of the previous result in terms of reliability and security. |
IEEE/ICACT20210212 Slide.07
[Big Slide]