ISA: A Source Code Static Vulnerability Detection System Based on Data Fusion

Abstract

Static analysis is a kind of effective method to detect the vulnerabilities in the software. Without running the programs, static analysis tools can be used to automatically discover unknown bugs. To cope with the problem of high false positives and false negatives in source code static analysis methods, this paper presents a source code static analysis technology for vulnerability detection based on data fusion. By parsing and making data fusion on the outcome of different static analysis methods, this technology lets different results validate each other, which greatly decreases the false positives and false negatives. Brief explanations are given to support this method. A prototype system of scalable source code analysis system (ISA for short) is designed and implemented which also can automatically search for the best result based on feedback of the user interaction. The whole system is scalable and platform-independent. It is proved by experiment that this method has a better performance with lower false positives and false negatives and higher efficiency compared with one single method.

A systematic literature review of actionable alert identification techniques for automated static code analysis

“…Kong et al [34] show that the alert prioritization generated via data fusion of redundant alerts performed better than the alert prioritization's of the individual tools. Meng et al [38] discussed some of the alerts found by the ASA; however, there were no numerical results on a larger subject program.…”

“…Developers can focus their alert inspection activities on the alerts they are most likely to want to act on. Ten of the 21 studies use information about the alerts themselves to predict actionable alerts [6,21,22,31,32,34,35,38,40,45]. Six of the selected studies utilize information from the development history of a project to use the past to predict the future [6,22,31,32,45,55].…”

“…True negative classification (TN) [21,22,61]: Classifying an alert as unactionable when the alert is unactionable. False positive classification (FP) [21,22,34,61]: Classifying an alert as actionable when the alert is actually unactionable. False negative classification (FN) [21,22,34,61]: Classifying an alert as unactionable when the alert is actually actionable.…”

“…Additionally, when only considering the top 30 alerts, the precision of the fix-based prioritization is almost doubled, and in some cases tripled, from the tool's ordering of alerts. Objective: Kong et al [34] use data fusion to identify vulnerable code using alerts generated by ASAs focused on finding security vulnerabilities.…”

Survey on static program analysis results refinement approaches

“…А в последствии изначальное ранжирование изменяется на основе реакции пользователя в процессе инспекции предупреждений о дефектах. Из других методов стоит выделить ранжирование предупреждений на основе статического вычисления вероятности исполнения мест, для которых предупреждения даны [25], и ранжирование предупреждений на основе слияния результатов нескольких инструментов статического анализа [26,27].…”