标题： StaAgent：一种用于测试静态分析器的代理框架 显示英文标题

标题： StaAgent: An Agentic Framework for Testing Static Analyzers

摘要： 静态分析工具在软件开发生命周期早期识别错误中起着关键作用，但它们的规则实现通常测试不足且容易出现不一致。 为了解决这个问题，我们提出了StaAgent，这是一个代理框架，利用大型语言模型（LLMs）的生成能力来系统地评估静态分析器规则。 StaAgent由四个专业代理组成：种子生成代理，将错误检测规则转换为具体的、引发错误的种子程序；代码验证代理，确保这些种子的正确性；突变生成代理，生成语义等效的突变体；以及分析器评估代理，通过比较静态分析器对种子及其对应突变体的行为进行变形测试。 通过揭示不一致的行为，StaAgent有助于发现规则实现中的缺陷。 这个由LLM驱动的多代理框架提供了一种可扩展和适应性的解决方案，以提高静态分析器的可靠性。 我们在五个最先进的LLMs（CodeL-lama、DeepSeek、Codestral、Qwen和GPT-4o）上对五个广泛使用的静态分析器（SpotBugs、SonarQube、ErrorProne、Infer和PMD）进行了评估。 实验结果表明，我们的方法可以帮助揭示这五个静态分析器最新版本中的64个有问题的规则（即SpotBugs中有28个，SonarQube中有18个，ErrorProne中有6个，Infer中有4个，PMD中有8个）。 此外，64个漏洞中有53个无法被SOTA基线检测到。 我们已将所有漏洞报告给开发人员，其中两个已经修复。另外三个已得到开发人员的确认，其余的正在等待回复。 这些结果证明了我们方法的有效性，并强调了代理式、由LLM驱动的数据合成在推进软件工程方面的前景。 显示英文摘要

摘要： Static analyzers play a critical role in identifying bugs early in the software development lifecycle, but their rule implementations are often under-tested and prone to inconsistencies. To address this, we propose StaAgent, an agentic framework that harnesses the generative capabilities of Large Language Models (LLMs) to systematically evaluate static analyzer rules. StaAgent comprises four specialized agents: a Seed Generation Agent that translates bug detection rules into concrete, bug-inducing seed programs; a Code Validation Agent that ensures the correctness of these seeds; a Mutation Generation Agent that produces semantically equivalent mutants; and an Analyzer Evaluation Agent that performs metamorphic testing by comparing the static analyzer's behavior on seeds and their corresponding mutants. By revealing inconsistent behaviors, StaAgent helps uncover flaws in rule implementations. This LLM-driven, multi-agent framework offers a scalable and adaptable solution to improve the reliability of static analyzers. We evaluated StaAgent with five state-of-the-art LLMs (CodeL-lama, DeepSeek, Codestral, Qwen, and GPT-4o) across five widely used static analyzers (SpotBugs, SonarQube, ErrorProne, Infer, and PMD). The experimental results show that our approach can help reveal 64 problematic rules in the latest versions of these five static analyzers (i.e., 28 in SpotBugs, 18 in SonarQube, 6 in ErrorProne, 4 in Infer, and 8 in PMD). In addition, 53 out of the 64 bugs cannot be detected by the SOTA baseline. We have reported all the bugs to developers, with two of them already fixed. Three more have been confirmed by developers, while the rest are awaiting response. These results demonstrate the effectiveness of our approach and underscore the promise of agentic, LLM-driven data synthesis to advance software engineering.