A Static Analysis Platform for Investigating Security Trends in Repositories

Static analysis tools come in many forms andconfigurations, allowing them to handle various tasks in a (secure) development process: code style linting, bug/vulnerability detection, verification, etc., and adapt to the specific requirements of a software project, thus reducing the number of false po...

Full description

Saved in:
Bibliographic Details
Published inarXiv.org
Main Authors Sonnekalb, Tim, Christopher-Tobias Knaust, Gruner, Bernd, Clemens-Alexander Brust, Lynn von Kurnatowski, Schreiber, Andreas, Heinze, Thomas S, Mäder, Patrick
Format Paper
LanguageEnglish
Published Ithaca Cornell University Library, arXiv.org 04.04.2023
Subjects
Machine learning
Programming languages
Repositories
Security
Software
Software development
Trends
Workflow
Online AccessGet full text

Cover

More Information
Summary:Static analysis tools come in many forms andconfigurations, allowing them to handle various tasks in a (secure) development process: code style linting, bug/vulnerability detection, verification, etc., and adapt to the specific requirements of a software project, thus reducing the number of false positives.The wide range of configuration options poses a hurdle in their use for software developers, as the tools cannot be deployed out-of-the-box. However, static analysis tools only develop their full benefit if they are integrated into the software development workflow and used on regular. Vulnerability management should be integrated via version history to identify hotspots, for example. We present an analysis platform that integrates several static analysis tools that enable Git-based repositories to continuously monitor warnings across their version history. The framework is easily extensible with other tools and programming languages. We provide a visualization component in the form of a dashboard to display security trends and hotspots. Our tool can also be used to create a database of security alerts at a scale well-suited for machine learning applications such as bug or vulnerability detection.
ISSN:2331-8422