NDLI: Evaluation of static analysis tools for software security

Content Provider	IEEE Xplore Digital Library
Author	AlBreiki, H.H. Mahmoud, Q.H.
Copyright Year	2014
Description	Author affiliation: Dept. of Electr., Comput. & Software Eng., Univ. of Ontario Inst. of Technol., Oshawa, ON, Canada (Mahmoud, Q.H.) \|\| Dept. of Comput. Inf. Sci., Higher Colleges of Technol., United Arab Emirates (AlBreiki, H.H.)
Abstract	Security has been always treated as an add-on feature in the software development lifecycle, and addressed by security professionals using firewalls, proxies, intrusion prevention systems, antivirus and platform security. Software is at the root of all common computer security problems, and hence hackers don't create security holes, but rather exploit them. Security holes in software applications are the result of bad design and implementation of software systems and applications. To address this problem, several initiatives for integrating security in the software development lifecycle have been proposed, along with tools to support a security-centric software development lifecycle. This paper introduces a framework for evaluating security static analysis tools such as source code analyzers, and offers evaluation of non-commercial static analysis tools such as Yasca, CAT.NET, and FindBugs. In order to evaluate the effectiveness of such tools, common software weaknesses are defined based on CWE/SANS Top 25, OWASP Top Ten and NIST source code weaknesses. The evaluation methodology is based on the NIST Software Assurance Metrics And Tool Evaluation (SAMATE). Results show that security static analysis tools are, to some extent, effective in detecting security holes in source code; source code analyzers are able to detect more weaknesses than bytecode and binary code scanners; and while tools can assist the development team in security code review activities, they are not enough to uncover all common weaknesses in software. The new test cases developed for this research have been contributed to the NIST Software Assurance Reference Dataset (samate.nist.gov/SARD).
Starting Page	93
Ending Page	98
File Size	3138122
Page Count	6
File Format	PDF
ISBN	9781479972104
e-ISBN	9781479972128
DOI	10.1109/INNOVATIONS.2014.6987569
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-11-09
Publisher Place	United Arab Emirates
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Industries Java Binary codes Computer architecture Static analysis OWASP NIST SAMATE Software Security metrics Security Software security
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Of Massive Static Analysis Data

Cyber security at software development time

184 samate and evaluating static analysis tools.

Static Analyzers: Seat Belts for Your Code

Practical static analysis for inference of security-related program properties

A comparative study on software vulnerability static analysis techniques and tools

Evaluating Bug Finders -- Test and Measurement of Static Code Analyzers

Two approaches for pay-per-use software construction

Software assurance with samate reference dataset, tool standards, and studies

Evaluation of static analysis tools for software security

Similar Documents

Of Massive Static Analysis Data

Cyber security at software development time

184 samate and evaluating static analysis tools.

Static Analyzers: Seat Belts for Your Code

Practical static analysis for inference of security-related program properties

A comparative study on software vulnerability static analysis techniques and tools

Evaluating Bug Finders -- Test and Measurement of Static Code Analyzers

Two approaches for pay-per-use software construction

Software assurance with samate reference dataset, tool standards, and studies

Evaluation of static analysis tools for software security