JavaCC를 이용한 정적 분석 도구 구현
Implement Static Analysis Tool using JavaCC
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this paper, we implemented a static analysis tool for weakness. We implemented on JavaCC using syntax information and control flow information among various information. We also tested the performance of the tool using Juliet-test suite on Eclipse. We were classified using information necessary for diagnosis and diagnostic methods were studied and implemented. By mapping the information obtained at each compiler phase the security weakness, we expected to link the diagnostic method with the program analysis information to the security weakness. In the future, we will extend to implement diagnostic tools using other analysis information.
Abstract
In this paper, we implemented a static analysis tool for weakness. We implemented on JavaCC using syntax information and control flow information among various information. We also tested the performance of the tool using Juliet-test suite on Eclipse. We were classified using information necessary for diagnosis and diagnostic methods were studied and implemented. By mapping the information obtained at each compiler phase the security weakness, we expected to link the diagnostic method with the program analysis information to the security weakness. In the future, we will extend to implement diagnostic tools using other analysis information.
참고문헌 (15)
- SungMoon Hong, "Detection of Security Vulnerability From the Knowledge-Base Representation of Source Code", Journal of The Korea Information Science Society, pp.1618~1620 (2014)
- "Common Weakness Enumeration"[URL]
- "Computer Emergency Response Team"[URL]
- 한경숙, "C", C++ 프로그램을 위한 진단 정보와 분석 방법의 분류, 2017, pp.22(3), 81~88[DOI]
- Alfred V. Aho, "Compilers:Principled, Techniques, and Tools" (1986), Addison Wesley
- "JavaCC"[URL]
- "Juliet test-suite"[URL]
- "MICRO FOCUS Inc."[URL]
- "Sparrow Co"[URL]
- "CODEMIND"[URL]
- Minero Aoki, "Compiler structure and principle :Language processing system learned by the compiler", ~ (2009)
- C. Cadar, "Symbolic execution for software testing: three decades late", Communications of the ACM, 56(2), pp.82~90 (2013)
- P. Cousot, "Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints", Proceedings of the 4th ACM SIGACT- SIGPLAN symposium on Principles of programming languages, pp.238~252 (1977), ACM
- Kuznetsov, "Efficient State Merging in Symbolic Execution" (2012)
- "LLVM"[URL]