一句话：提出 IntelliJ 插件 SWAN_ASSIST，用主动机器学习与用户反馈半自动识别和分类 Java 安全相关方法（SRM）。
静态分析工具要检测特定缺陷和漏洞，必须正确配置安全相关方法（SRM），如 source、sink、sanitizer 和认证方法，但这一过程通常劳动密集且易错。本文提出半自动工具 SWAN_ASSIST：以 IntelliJ 插件形式集成主动机器学习方法 SWAN，用于识别和分类 Java SRM，并通过迭代学习融入用户反馈。该工具会在每一时刻请用户标注对分类结果影响最大的方法，从而以较少交互提升配置效率。实验表明，SWAN_ASSIST 能以高精度分类 SRM，且用户投入相对较低。论文还提供视频演示和开源代码。
To detect specific types of bugs and vulnerabilities, static analysis tools must be correctly configured with security-relevant methods (SRM), e.g., sources, sinks, sanitizers and authentication methods-usually a very labour-intensive and error-prone process. This work presents the semi-automated tool SWAN_ASSIST, which aids the configuration with an IntelliJ plugin based on active machine learning. It integrates our novel automated machine-learning approach SWAN, which identifies and classifies Java SRM. SWAN_ASSIST further integrates user feedback through iterative learning. SWAN_ASSIST aids developers by asking them to classify at each point in time exactly those methods whose classification best impact the classification result. Our experiments show that SWAN_ASSIST classifies SRM with a high precision, and requires a relatively low effort from the user. A video demo of SWAN_ASSIST can be found at https://youtu.be/fSyD3V6EQOY. The source code is available at https://github.com/secure-software-engineering/swan.
DOI 原文 ·
@inproceedings{paperbot5194,
title = {SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods},
author = {Goran Piskachev and Lisa Nguyen Quang Do and Oshando Johnson and Eric Bodden},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00110}
}