基于相似特征的软件安全性缺陷检测算法

A Method for Detecting Software Security Vulnerability Based on Similar Characteristics

文章在全面分析软件系统安全性缺陷的基础上,提出一种基于相似特征的软件安全性缺陷检测算法。针对C语言源代码,应用实例推理CBR的技术原理,通过检测算法将源代码的安全特征与已知安全性缺陷的实例特征进行相似匹配,通过相似度计算来判定软件代码是否存在安全性缺陷。实验表明该算法有效地提高了缺陷检测的准确性和效率,解决了现有基于规则匹配的检测方法不能快速而准确地处理大型遗产软件和结构较为复杂的软件的问题。同时阈值的定义和选择也提高了检测算法的适应性和灵活性。

Current detecting methods based on rule-matching cannot rapidly and accurately handle the large-scale legacy software and structure-complicated software.To solve these problems,a novel vulnerability detecting method based on similar characteristics is proposed in this paper.Through comprehensive analysis of software security vulnerability,the method aims at C code security detection.Based on case-based reasoning technology,similarity matching is performed between security characteristics of source code and ...