一句话：提出 GLITCH，面向多种 IaC 技术实现跨语言的安全异味自动检测，避免为每种技术重复实现检测逻辑。
论文关注基础设施即代码（IaC）脚本中的安全异味，即可能导致安全弱点的编码模式。现有自动化检测工具通常只面向 Puppet、Ansible、Chef 等特定技术；当某种新异味的检测在某一工具中实现后，无法直接复用于其他工具支持的技术，只能重复开发。GLITCH 旨在实现跨 IaC 技术的多语言（polyglot）安全异味自动检测，以统一或复用检测能力，减少重复工作。摘要未提供具体实现细节与实验结果，但目标是将安全异味检测从单一技术扩展到多种 IaC 技术生态。
Infrastructure as Code (IaC) is the process of managing IT infrastructure via programmable configuration files (also called IaC scripts). Like other software artifacts, IaC scripts may contain security smells, which are coding patterns that can result in security weaknesses. Automated analysis tools to detect security smells in IaC scripts exist, but they focus on specific technologies such as Puppet, Ansible, or Chef. This means that when the detection of a new smell is implemented in one of the tools, it is not immediately available for the technologies supported by the other tools — the only option is to duplicate the effort.
DOI 原文 ·
@inproceedings{paperbot7294,
title = {GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code},
author = {Nuno Saavedra and João F. Ferreira},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3556945}
}