The tool they use for evaluation (softwipe) is discussed in another paper, but seems to basically count/combine the results of a set of different static and dyn

The tool they use for evaluation (softwipe) is discussed in another paper, but seems to basically count/combine the results of a set of different static and dynamic analysis tools (ASan, UBSan, cppcheck etc) Presumably those results should correlate somewhat with bugs and defects.