A Study on Software Security Vulnerability Detection Using Coding Standard Searching Technique
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The importance of information security has been increasingly emphasized at the national, organizational, and individuallevels due to the widespread adoption of software applications. High-safety software, which includes embedded software,should run without errors, similar to software used in the airline and nuclear energy sectors. Software developmenttechniques in the above sectors are now being used to improve software security in other fields. Secure coding, in particular,is a concept encompassing defensive programming and is capable of improving software security. In this paper, we proposea software security vulnerability detection method using an improved coding standard searching technique. Public staticanalysis tools were used to assess software security and to classify the commands that induce vulnerability. Software securitycan be enhanced by detecting Application Programming Interfaces (APIs) and patterns that can induce vulnerability.
Abstract
The importance of information security has been increasingly emphasized at the national, organizational, and individuallevels due to the widespread adoption of software applications. High-safety software, which includes embedded software,should run without errors, similar to software used in the airline and nuclear energy sectors. Software developmenttechniques in the above sectors are now being used to improve software security in other fields. Secure coding, in particular,is a concept encompassing defensive programming and is capable of improving software security. In this paper, we proposea software security vulnerability detection method using an improved coding standard searching technique. Public staticanalysis tools were used to assess software security and to classify the commands that induce vulnerability. Software securitycan be enhanced by detecting Application Programming Interfaces (APIs) and patterns that can induce vulnerability.
참고문헌 (13)
- APCERT Annual Report 2017, , Carnegie Mellon University software engineering institute, ~ (2018)
- J. Stark, "Product Lifecycle Management", pp.1~29 (2015), Springer
- P. Nunes, "An empirical study on combining diverse static analysis tools for web security vulnerabilities based on development scenarios", Computing, 101(2), pp.161~185 (2019)
- F. Zampetti, "How open source projects use static code analysis tools in continuous integration pipelines", IEEE, 2017, 334~344
- G. Nagy, "A static code smell detector for SQL queries embedded in Java code", IEEE, pp.147~152 (2017)
- Y.S. Jang, "Automatic prevention of buffer overflow vulnerability using candidate code generation", IEICE TRANSACTIONS on Information and Systems, pp.3005~3018 (2018)
- T. Gagie, "Compressed spaced suffix arrays", Mathematics in Computer Science, pp.151~157 (2017)
- N. Zhong, "Effective pattern discovery for text mining", IEEE transactions on knowledge and data engineering, 24(1), pp.30~44 (2010)
- W. Webber, "Evaluating the Effectiveness of Keyword Search", IEEE Data Eng. Bull, 33(1), pp.54~59 (2010)
- S. S. Kia, "Tutorial on dynamic average consensus : the problem, its applications, and the algorithms", IEEE Control Systems Magazine, 39(3), pp.40~72 (2019)
- Improving the usefulness of alerts generated by automated static analysis tools, "J. Bleier", ~ (2017)
- "Juliet test suite" (2019)[URL]
- G. Balan, "Detecting Java Compiled Malware using Machine Learning Techniques", IEEE, pp.435~439 (2018)