一句话：提出全自动机器学习工具 SWAN 检测 Java 程序的安全相关方法并按 SANS Top 25 分类，辅以 SWANAssist 让用户细化分类。
静态分析要在代码审查中准确发现漏洞，必须针对被扫描代码库配置正确的安全相关方法（security-relevant methods, Srm），如 source、sink 等，但手工配置代价高昂。本文提出 SWAN，一种全自动机器学习方法，用于检测 Java 程序中的 source、sink、validator 与认证方法，并将其进一步归类到 SANS Top 25 的具体漏洞类别。为使检测结果自适应具体代码库并提升精度，作者还提出 SWANAssist，允许分析用户对分类结果进行细化。在 12 个流行的 Java 框架上，SWAN 取得了平均 0.826 的精度，优于或可比于现有方法；实验表明 SWANAssist 只需开发者付出相对较低的代价，即可显著提高精度。
More and more companies use static analysis to perform regular code reviews to detect security vulnerabilities in their code, configuring them to detect various types of bugs and vulnerabilities such as the SANS top 25 or the OWASP top 10. For such analyses to be as precise as possible, they must be adapted to the code base they scan. The particular challenge we address in this paper is to provide analyses with the correct security-relevant methods (Srm): sources, sinks, etc. We present SWAN, a fully-automated machine-learning approach to detect sources, sinks, validators, and authentication methods for Java programs. SWAN further classifies the Srm into specific vulnerability classes of the SANS top 25. To further adapt the lists detected by SWAN to the code base and to improve its precision, we also introduce SWANAssist, an extension to SWAN that allows analysis users to refine the classifications. On twelve popular Java frameworks, SWAN achieves an average precision of 0.826, which is better or comparable to existing approaches. Our experiments show that SWANAssist requires a relatively low effort from the developer to significantly improve its precision.
DOI 原文 ·
@inproceedings{paperbot5385,
title = {Codebase-adaptive detection of security-relevant methods},
author = {Goran Piskachev and Lisa Nguyen Quang Do and Eric Bodden},
booktitle = {ISSTA},
year = {2019},
doi = {10.1145/3293882.3330556}
}