Abstract
The concept of “secure by design” is based on preventive software security and aims at avoiding vulnerabilities as soon as possible. However, finding vulnerabilities manually is a time-consuming and error-prone process. Thus, the use of code scanner tools becomes a good practice for developers. Unfortunately, existing code scanner tools produce too many false positives, which complicates the cycle development task.
In this paper, we present an approach to construct a code vulnerability scanner upon existing scanner tools. The aim of such a scanner, called code vulnerability meta-scanner (CVMS), is to be more efficient and reduce the number of false positives. Our experimental results show that none of the scanners strictly subsumes another, and none of them is better than all the others for all the vulnerabilities. So, we propose a method that combines their results with respect to their performances. We experimented our approach using three existing scanner tools (Fortify, Yag Suite and SpotBug). Then, we used the resulted CVMS to annotate a well-known Java application corpus, namely Qualitas Corpus. These experiment results demonstrated that the CVMS performs better than the scanners on which it is constructed.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
CWE: CWE is a community-developed list of common software security weaknesses. It serves as a common language, a measuring stick for software security tools, and as a baseline for weakness identification, mitigation, and prevention efforts.
References
Alves, H., Fonseca, B., Antunes, N.: Software metrics and security vulnerabilities: dataset and exploratory study. In: 2016 12th European Dependable Computing Conference (EDCC), pp. 37–44, September 2016
Antunes, N., Vieira, M.: Comparing the effectiveness of penetration testing and static code analysis on the detection of SQL injection vulnerabilities in web services. In: 2009 15th IEEE Pacific Rim International Symposium on Dependable Computing, pp. 301–306, November 2009
Antunes, N., Vieira, M.: Benchmarking vulnerability detection tools for web services. In: 2010 IEEE International Conference on Web Services, pp. 203–210, July 2010
Arteau, P.: Bugs Patterns. https://find-sec-bugs.github.io/bugs.htm
Arteau, P.: Find Security Bugs. https://find-sec-bugs.github.io
Austin, A., Williams, L.: One technique is not enough: a comparison of vulnerability discovery techniques. In 2011 International Symposium on Empirical Software Engineering and Measurement (ESEM), pp. 97–106 (2011)
Boland, T., Black, P.E.: Juliet 1.1 C/C++ and Java test suite. Computer 45(10), 88–90 (2012)
Micro Focus. Fortify static code analyzer. https://www.microfocus.com/fr-fr/products/static-code-analysis-sast/overview
Micro Focus. Fortify Static Code Analyzer (SCA) Static Application Security Testing. https://www.microfocus.com/media/data-sheet/fortify_static_code_analyzer_static_application_security_testing_ds.pdf
Fonseca, J., Vieira, M.: Mapping software faults with web security vulnerabilities. In: 2008 IEEE International Conference on Dependable Systems and Networks with FTCS and DCC (DSN), pp. 257–266, June 2008
Fonseca, J., Vieira, M., Madeira, H.: Testing and comparing web vulnerability scanning tools for SQL injection and XSS attacks. In: 13th Pacific Rim International Symposium on Dependable Computing (PRDC 2007), pp. 365–372, December 2007
Foster, J.S., Almazan, C.B., Rutar, N.: A comparison of bug finding tools for Java. In: 15th International Symposium on Software Reliability Engineering(ISSRE), pp. 245–256 (2004)
Howard, M., David, L.B.: Writing Secure Code for Windows Vista\(^{TM}\), 1st edn. Microsoft Press, Redmond (2007)
Jimenez,, M.: Evaluating vulnerability prediction models. Ph.D. thesis, Université du Luxembourg (2018)
Livshits, V.B., Lam, M.S.: Finding security vulnerabilities in java applications with static analysis. In: Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14, SSYM 2005, p. 18. USENIX Association, Berkeley (2005)
Meng, N., Wang, Q., Wu, Q., Mei, H.: An approach to merge results of multiple static analysis tools (short paper). In: 2008 The Eighth International Conference on Quality Software, pp. 169–174, August 2008
Mitre. Common Weakness Enumeration (2019). https://cwe.mitre.org/
Mitre (2019). https://www.mitre.org/
Morrison, P., Herzig, K., Murphy, B., Williams, L.: Challenges with applying vulnerability prediction models. In: Proceedings of the 2015 Symposium and Bootcamp on the Science of Security, HotSoS 2015, pp. 4:1–4:9. ACM, New York (2015)
NSA. Juliet Test Suite v1.2 for Java (2012). https://samate.nist.gov
Nunes, P., Medeiros, I., Fonseca, J., Neves, N., Correia, M., Vieira, M.: On combining diverse static analysis tools for web security: an empirical study. In: 2017 13th European Dependable Computing Conference (EDCC), pp. 121–128, September 2017
OWASP. Vulnerability (2016). https://www.owasp.org/index.php/Category:Vulnerability
YAGAAN Software Security. Yag Suite (2017). https://www.yagaan.com/products.html#yag-approche
Tempero, E., et al.: Qualitas corpus: a curated collection of Java code for empirical studies. In: 2010 Asia Pacific Software Engineering Conference (APSEC 2010), pp. 336–345, December 2010
Terra, R., Miranda, L.F., Valente, M.T., Bigonha, R.S.: Qualitas.class corpus: a compiled version of the Qualitas Corpus. Softw. Eng. Notes 38(5), 1–4 (2013)
Venter, H.S., Eloff, J.H.P., Li, Y.L.: Standardising vulnerability categories. Comput. Secur. 27(3), 71–83 (2008)
Vieira, M., Antunes, N., Madeira, H.: Using web security scanners to detect vulnerabilities in web services. In: 2009 IEEE/IFIP International Conference on Dependable Systems Networks, pp. 566–571, June 2009
Wang, Q., Meng, N., Zhou, Z., Li, J., Mei, H.: Towards SOA-based code defect analysis. In: 2008 IEEE International Symposium on Service-Oriented System Engineering, pp. 269–274, December 2008
Zhang, Y., Wu, Q., Yang, G., Wen, T.: ASVC: an automatic security vulnerability categorization framework based on novel features of vulnerability data. J. Commun. 10(2), 107–116 (2015)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Benabidallah, R., Sadou, S., Le Trionnaire, B., Borne, I. (2019). Designing a Code Vulnerability Meta-scanner. In: Heng, SH., Lopez, J. (eds) Information Security Practice and Experience. ISPEC 2019. Lecture Notes in Computer Science(), vol 11879. Springer, Cham. https://doi.org/10.1007/978-3-030-34339-2_11
Download citation
DOI: https://doi.org/10.1007/978-3-030-34339-2_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-34338-5
Online ISBN: 978-3-030-34339-2
eBook Packages: Computer ScienceComputer Science (R0)