基于静态检测工具的源代码安全缺陷检测研究

Research on source code safety defects based on static test tools

针对已有的使用单个静态检测工具进行源代码安全缺陷检测存在的漏报率和误报率很高的问题,提出了一种基于多种静态检测工具的检测方法。该方法通过对多种工具的检测结果进行统计分析,有效地降低了漏报率和误报率。设计和实现了一个可扩展的源代码静态分析工具平台,并通过实验表明,相对于单个工具的检测结果而言,该平台明显降低了漏报率和误报率。

To cope with the problem of high false negatives and false positives in source code static analysis methods with a static test tool,this paper presented a static analysis detection method for safety defects detection based on several static test tools.This method made statistical analysis on the outcome of different static test tools,which greatly decreased the false negatives and false positives.It designed and implemented a scalable source code static analysis tool platform,and it was proved by experiment that this platform has a better performance with lower false negatives and false positives compared with one single static test tool.