.png){kind=icon}
返回
Comprehensive Evaluation of Static Analysis Tools for Their Performance in Finding Vulnerabilities in Java Code
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2024.3389955.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Various static code analysis tools have been designed to automatically detect software faults and security vulnerabilities. This paper aims to 1) conduct an empirical evaluation to assess the performance of five free and state-of-the-art static analysis tools in detecting Java security vulnerabilities using a well-defined and repeatable approach; 2) report on the vulnerabilities that are best and worst detected by static Java analyzers. We used the Juliet benchmark test suite in a controlled experiment to assess the effectiveness of five widely used Java static analysis tools. The vulnerabilities were successfully detected by one, two, or three tools. Only one vulnerability has been detected by four tools. The tools missed 13% of the Java vulnerability categories appearing in our experiment. More critically, none of the five tools could identify all the vulnerabilities in our experiment. We conclude that, despite recent improvements in their methodologies, current state-of-the-art static analysis tools are still ineffective for identifying the security vulnerabilities occurring in a small-scale, artificial test suite.
Keyword:
Empirical evaluation
Juliet test suite
performance metrics
static analysis tools
security vulnerabilities
Java
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
Static Code Analysis Alarms Filtering Reloaded: A New Real-World Dataset and its ML-Based Utilization.png)
IEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏分享收藏A screening test for the determination of cut flower longevity and ethylene sensitivity of carnation
OAAI
OAAI分享收藏Error-Type-A Novel Set of Software Metrics for Software Fault Prediction错误类型-一组用于软件故障预测的新型软件度量IEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏
查看更多内容