nach oben

Erschienen in:

2017 | OriginalPaper | Buchkapitel

On the Verification of Software Vulnerabilities During Static Code Analysis Using Data Mining Techniques

(Short Paper)

verfasst von : Foteini Cheirdari, George Karabatis

Erschienen in: On the Move to Meaningful Internet Systems. OTM 2017 Conferences

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

Software assurance analysts deal with thousands of potential vulnerabilities many of which could be false positives during the process of static code analysis. Manual review of all such potential vulnerabilities is tedious, time consuming, and frequently impractical. Several experiments were conducted using a production code base with the aid of a variety of static code analysis tools. A data mining process was created, which employed different classifiers for comparison. Furthermore, a selection process identified the most important features that led to significant improvements in accuracy, precision, and recall, as evidenced by the experimental data. This paper proposes machine learning algorithms to minimize false positives with a high degree of accuracy.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel A Novel WebGIS-Based Situational Awareness Platform for Trustworthy Big Data Integration and Analytics in Mobility Context

Nächstes Kapitel Linked Data and Ontology Reference Model for Infectious Disease Reporting Systems

Chimdyalwar, B., Darke, P., Chavda, A., Vaghani, S., Chauhan, A.: Eliminating static analysis false positives using loop abstraction and bounded model checking. In: Bjørner, N., de Boer, F. (eds.) FM 2015. LNCS, vol. 9109, pp. 573–576. Springer, Cham (2015). doi:10.1007/978-3-319-19249-9_35 CrossRef

Chen, C., Lu, K., Wang, X., Zhou, X., Fang, L.: Pruning false positives of static data-race detection via thread specialization. In: Wu, C., Cohen, A. (eds.) APPT 2013. LNCS, vol. 8299, pp. 77–90. Springer, Heidelberg (2013). doi:10.1007/978-3-642-45293-2_6 CrossRef

Common Weakness Enumeration. https://cwe.mitre.org/

Post, H., Sinz, C., Kaiser, A., Gorges, T.: Reducing false positives by combining abstract interpretation and bounded model checking. In: IEEE (2008)

Medeiros, I., Neves, N., Correia, M.: Detecting and removing web application vulnerabilities with static analysis and data mining. In: IEEE (2016)

Gondra, I.: Applying machine learning to software fault-proneness prediction. In: JSS (2007)

Yoon, J., Jin, M., Jung, Y.: Reducing false alarms from an industrial strength static analyzer by SVM. In: APSEC (2014)

Ruthruff, J.R., Penix, J., Morgenthaler, J.D., Elbaum, S., Rothermel, G.: Predicting accurate and actionable static analysis warnings: an experimental approach. In: ACM (2008)

KD nuggets, Precision and Recall Calculation. http://www.kdnuggets.com/faq/precision-recall.html

10.

Yi, K., Choi, H., Kim, J., Kim, Y.: An empirical study on classification methods for alarms from a bug-finding static C analyzer. Inf. Process. Lett. 102(2–3), 118–123 (2007)CrossRefMathSciNetMATH

11.

Hanam, Q., Tan, L., Holmes, R., Lam, P.: Finding patterns in static analysis alerts: improving actionable alert ranking. In: MSR (2014)

12.

Heckman, S., Williams, L.: A model building process for identifying static analysis alerts. In: IEEE (2009)

13.

Heckman, S., Williams, L.: Automated ranking and filtering of static analysis alerts. In: IEEE (2006)

14.

SCIKIT, Stochastic Gradient Descent. http://scikit-learn.org/stable/modules/sgd.html

15.

Springer Link, F Measure. https://link.springer.com/referenceworkentry/10.1007/978-0-387-39940-9_483

16.

Stat Trek, Statistics and Probability Dictionary. http://stattrek.com/statistics/dictionary.aspx?definition=Stratified_sampling

17.

Kim, S., Ernst, M.D.: Prioritizing warning categories by analyzing software history. In: IEEE Xplore (2007)

18.

Kim, S., Ernst, M.D.: Which warnings should I fix first? In: ACM SIGSOFT (2007)

19.

Kremenek, T., Engler, D.: Z-ranking: using statistical analysis to counter the impact of static analysis approximations. In: Cousot, R. (ed.) SAS 2003. LNCS, vol. 2694, pp. 295–315. Springer, Heidelberg (2003). doi:10.1007/3-540-44898-5_16 CrossRef

20.

Muske, T.B., Baid, A., Sanas, T.: Review efforts reduction by partitioning of static analysis warnings. In: 2013 IEEE 13th International Working Conference on Source Code Analysis and Manipulation (SCAM) (2013)

21.

Muske, T.: Improving review of clustered-code analysis warnings. In: 2014 IEEE International Conference on Software Maintenance and Evolution (2014)

22.

Muske, T., Serebrenik, A.: Survey of approaches for handling static analysis alarms. In: SCAM (2016)

23.

Yuksel, U., Sozer, H.: Automated classification of static code analysis alerts: a case study. In: ICSM (2013)

24.

UFLDL Tutorial, Optimization: Stochastic Gradient Descent. http://ufldl.stanford.edu/tutorial/supervised/OptimizationStochasticGradientDescent/

25.

Weka 3: Data Mining Software in Java. http://www.cs.waikato.ac.nz/ml/weka/

26.

WEKA. weka.sourceforge.net/doc.dev/weka/classifiers/functions/SGD.html

27.

WIKIPEDIA, Stochastic Gradient Descent. https://en.wikipedia.org/wiki/Stochastic_gradient_descent

28.

Lee, W., Lee, W., Yi, K.: Sound non-statistical clustering od static analysis alarms. In: VMCAI (2012)

29.

Kim, Y., Lee, J., Han, H., Choe, K.-M.: Filtering false alarms of buffer overflow analysis using SMT solvers. In: Infosof (2009)

30.

Jung, Y., Kim, J., Shin, J., Yi, K.: Taming false alarms from a domain-unaware C analyzer by a bayesian statistical post analysis. In: Hankin, C., Siveroni, I. (eds.) SAS 2005. LNCS, vol. 3672, pp. 203–217. Springer, Heidelberg (2005). doi:10.1007/11547662_15 CrossRef

Titel: On the Verification of Software Vulnerabilities During Static Code Analysis Using Data Mining Techniques
verfasst von: Foteini Cheirdari
George Karabatis
Verlag: Springer International Publishing
Buch: On the Move to Meaningful Internet Systems. OTM 2017 Conferences
Print ISBN: 978-3-319-69458-0

Electronic ISBN: 978-3-319-69459-7

Copyright-Jahr: 2017
DOI: https://doi.org/10.1007/978-3-319-69459-7_7

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"