• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International conference on information security practice and experience >Designing a Code Vulnerability Meta-scanner
【24h】

Designing a Code Vulnerability Meta-scanner

机译：设计代码漏洞元扫描仪

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The concept of "secure by design" is based on preventive software security and aims at avoiding vulnerabilities as soon as possible. However, finding vulnerabilities manually is a time-consuming and error-prone process. Thus, the use of code scanner tools becomes a good practice for developers. Unfortunately, existing code scanner tools produce too many false positives, which complicates the cycle development task. In this paper, we present an approach to construct a code vulnerability scanner upon existing scanner tools. The aim of such a scanner, called code vulnerability meta-scanner (CVMS), is to be more efficient and reduce the number of false positives. Our experimental results show that none of the scanners strictly subsumes another, and none of them is better than all the others for all the vulnerabilities. So, we propose a method that combines their results with respect to their performances. We experimented our approach using three existing scanner tools (Fortify, Yag Suite and SpotBug). Then, we used the resulted CVMS to annotate a well-known Java application corpus, namely Qualitas Corpus. These experiment results demonstrated that the CVMS performs better than the scanners on which it is constructed.
机译：“通过设计安全”的概念是基于预防性软件安全性，并尽快避免漏洞。但是，手动查找漏洞是耗时和错误的过程。因此，使用代码扫描仪工具成为开发人员的良好做法。不幸的是，现有的代码扫描程序工具产生了太多误报，这使得周期开发任务复杂化。在本文中，我们提出了一种在现有扫描仪工具上构造代码漏洞扫描仪的方法。这种扫描仪的目的，称为代码漏洞元扫描仪（CVM），是更有效和减少误报的数量。我们的实验结果表明，没有一个扫描仪严格归结为另一个，而且这些扫描仪都不是所有其他漏洞的所有人都更好。因此，我们提出了一种将其结果与其表演相结合的方法。我们使用三个现有扫描仪工具（Fortify，YAG Suite和Spotbug）进行了我们的方法。然后，我们使用产生的CVM来注释一个众所周知的Java应用程序语料库，即质量语料库。这些实验结果表明，CVMS比其构造的扫描仪更好地表现得更好。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号