Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Boosting Static Resource Leak Detection via LLM-based Resource-Oriented Intention Inference

Chong Wang, Jianan Liu, Xin Peng, Yang Liu, Yiling Lou

TL;DR

InferROI addresses the limitations of traditional static resource-leak detectors that rely on predefined API pairs and reachability checks. It jointly leverages LLM-based inference of resource-oriented intentions (ACQ, REL, VAL) and a two-stage static path analysis to detect leaks, enabling broad coverage beyond predefined APIs. Empirical results on DroidLeaks and JLeaks show substantial improvements in bug detection and competitive false alarm rates, with additional successes in real open-source projects and cross-LLM generalization. The work demonstrates the practical potential of combining LLM-based code understanding with static analysis to enhance reliability in resource management tasks.

Abstract

Resource leaks, caused by resources not being released after acquisition, often lead to performance issues and system crashes. Existing static detection techniques rely on mechanical matching of predefined resource acquisition/release APIs and null-checking conditions to find unreleased resources, suffering from both (1) false negatives caused by the incompleteness of predefined resource acquisition/release APIs and (2) false positives caused by the incompleteness of resource reachability validation identification. To overcome these challenges, we propose InferROI, a novel approach that leverages the exceptional code comprehension capability of large language models (LLMs) to directly infer resource-oriented intentions (acquisition, release, and reachability validation) in code. InferROI first prompts the LLM to infer involved intentions for a given code snippet, and then incorporates a two-stage static analysis approach to check control-flow paths for resource leak detection based on the inferred intentions. We evaluate the effectiveness of InferROI in both resource-oriented intention inference and resource leak detection. Experimental results on the DroidLeaks and JLeaks datasets demonstrate InferROI achieves promising bug detection rate (59.3% and 62.5%) and false alarm rate (18.6% and 19.5%). Compared to three industrial static detectors, InferROI detects 14~45 and 149~485 more bugs in DroidLeaks and JLeaks, respectively. When applied to real-world open-source projects, InferROI identifies 29 unknown resource leak bugs (verified by authors), with 7 of them being confirmed by developers. In addition, the results of an ablation study underscores the importance of combining LLM-based inference with static analysis.

Boosting Static Resource Leak Detection via LLM-based Resource-Oriented Intention Inference

TL;DR

InferROI addresses the limitations of traditional static resource-leak detectors that rely on predefined API pairs and reachability checks. It jointly leverages LLM-based inference of resource-oriented intentions (ACQ, REL, VAL) and a two-stage static path analysis to detect leaks, enabling broad coverage beyond predefined APIs. Empirical results on DroidLeaks and JLeaks show substantial improvements in bug detection and competitive false alarm rates, with additional successes in real open-source projects and cross-LLM generalization. The work demonstrates the practical potential of combining LLM-based code understanding with static analysis to enhance reliability in resource management tasks.

Abstract

Resource leaks, caused by resources not being released after acquisition, often lead to performance issues and system crashes. Existing static detection techniques rely on mechanical matching of predefined resource acquisition/release APIs and null-checking conditions to find unreleased resources, suffering from both (1) false negatives caused by the incompleteness of predefined resource acquisition/release APIs and (2) false positives caused by the incompleteness of resource reachability validation identification. To overcome these challenges, we propose InferROI, a novel approach that leverages the exceptional code comprehension capability of large language models (LLMs) to directly infer resource-oriented intentions (acquisition, release, and reachability validation) in code. InferROI first prompts the LLM to infer involved intentions for a given code snippet, and then incorporates a two-stage static analysis approach to check control-flow paths for resource leak detection based on the inferred intentions. We evaluate the effectiveness of InferROI in both resource-oriented intention inference and resource leak detection. Experimental results on the DroidLeaks and JLeaks datasets demonstrate InferROI achieves promising bug detection rate (59.3% and 62.5%) and false alarm rate (18.6% and 19.5%). Compared to three industrial static detectors, InferROI detects 14~45 and 149~485 more bugs in DroidLeaks and JLeaks, respectively. When applied to real-world open-source projects, InferROI identifies 29 unknown resource leak bugs (verified by authors), with 7 of them being confirmed by developers. In addition, the results of an ablation study underscores the importance of combining LLM-based inference with static analysis.
Paper Structure (35 sections, 3 equations, 5 figures, 5 tables, 1 algorithm)

This paper contains 35 sections, 3 equations, 5 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Motivating Example
  3. Approach
  4. Resource-Oriented Intentions
  5. LLM-Based Intention Inference
  6. Feeding LLM with Prompt
  7. Extracting Structured Expressions
  8. Static Resource Leak Detection
  9. Enumerating Control-Flow Paths
  10. Detecting Resource Leaks
  11. Implementation
  12. Evaluation
  13. Effectiveness in Resource Leak Detection (RQ1)
  14. Data
  15. Baselines
  16. ...and 20 more sections

Figures (5)

  • Figure 1: Comparison between Buggy Version (Left) and Fixed Version (Right) Associated with A n d r o i d H t t p C l i e n t Leak
  • Figure 2: Approach Overview of InferROI
  • Figure 3: Prompt Template
  • Figure 4: Answer Generated by GPT-4 Model
  • Figure 5: API Description of C u r s o r A d a p t e r . c h a n g e C u r s o r ( C u r s o r )