一句话:面向云基 SAST 平台提出输入切分,以支撑开发团队自建应用安全测试基础设施。
随着软件开发团队采用 DevSecOps 实践,应用安全的责任越来越多地转移到开发团队,他们需要搭建自己的静态应用安全测试(SAST)基础设施。论文标题表明其核心关注云基 SAST 平台中的输入切分(input splitting),即针对云端 SAST 场景对分析输入进行拆分或划分,以适配或改善此类平台的使用。摘要本身仅给出上述 DevSecOps 背景,未说明具体的切分策略、实现机制或实验评估;因此本文可理解为面向云基 SAST 基础设施的工程与静态分析支撑技术研究。
As software development teams adopt DevSecOps practices, application security is increasingly the responsibility of development teams, who are required to set up their own Static Application Security Testing (SAST) infrastructure.
@inproceedings{paperbot7012,
title = {Input splitting for cloud-based static application security testing platforms},
author = {Maria Christakis and Thomas Cottenier and Antonio Filieri and Linghui Luo and Muhammad Numair Mansur and Lee Pike and Nicolás Rosner and Martin Schäf and Aritra Sengupta and Willem Visser},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3558944}
}