• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Software and Systems Reuse >A Double-Edged Sword? Software Reuse and Potential Security Vulnerabilities
【24h】

A Double-Edged Sword? Software Reuse and Potential Security Vulnerabilities

机译：一把双刃剑？软件重用和潜在的安全漏洞

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Reuse is a common and often-advocated software development practice. Significant efforts have been invested into facilitating it, leading to advancements such as software forges, package managers, and the widespread integration of open source components into proprietary software systems. Reused software can make a system more secure through its maturity and extended vetting, or increase its vulnerabilities through a larger attack surface or insecure coding practices. To shed more light on this issue, we investigate the relationship between software reuse and potential security vulnerabilities, as assessed through static analysis. We empirically investigated 301 open source projects in a holistic multiple-case methods study. In particular, we examined the distribution of potential vulnerabilities between the native code created by a project's development team and external code reused through dependencies, as well as the correlation between the ratio of reuse and the density of vulnerabilities. The results suggest that the amount of potential vulnerabilities in both native and reused code increases with larger project sizes. We also found a weak-to-moderate correlation between a higher reuse ratio and a lower density of vulnerabilities. Based on these findings it appears that code reuse is neither a frightening werewolf introducing an excessive number of vulnerabilities nor a silver bullet for avoiding them.
机译：重用是一个常见而常见的软件开发实践。已经投入了重大努力，促进了它，导致诸如软件伪造，包管理器，开源组件的广泛集成等进步，进入专有软件系统。重复使用的软件可以通过其成熟度和扩展审查更安全，或通过更大的攻击面或不安全的编码实践增加其漏洞。要在此问题上阐明更轻，我们调查软件重用与潜在安全漏洞之间的关系，通过静态分析评估。我们经验在整体多案方法研究中调查了301个开源项目。特别是，我们检查了项目开发团队和通过依赖性重复使用的外部代码创建的本机代码之间的潜在漏洞的分布，以及重用与漏洞密度之间的相关性。结果表明，本机和重复使用代码中的潜在漏洞的数量随着更大的项目尺寸而增加。我们还发现更高的重用比率和较低的漏洞之间的弱与中等的相关性。基于这些发现，似乎代码重用既不是一个可怕的狼人都没有引入过多数量的漏洞，也不是为了避免它们的银弹。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号