一种有效的静态缺陷函数检测框架

An Effective Framework of Static Vulnerable Function Detection

基于在软件开发过程中有很多静态缺陷函数检测方法与工具都具有局限性,且对软件开发后期的黑盒测试关联不大,文中提出了一种在软件开发早期运用的静态缺陷函数检测框架,该框架不仅可以解决静态分析工具误报的问题,还可以为后期的安全性黑盒测试提供数据流约束,为自动生成数据流提供有效支持。

Although there are many methods and tools of static vulnerable function detection for use in the process of software development,they have their limitations.Besides,they provide no support for the black-box testing in the later stage of software development.In this paper,based on the previous work,a framework of static vulnerable function detection used in the early stage of software development is proposed,which not only can avoid false alarms by static analysis tools to some degree,but also can provide a set of data-flow constraints used to automatically generate the data-flow in the black-box testing for security in the later stage.