An Empirical Study of Security Warnings from Static Application Security Testing Tools

Authors: Bushra Aloraini Meiyappan Nagappan Daniel M. German Shinpei Hayashi Yoshiki Higo

Venue: JSS   Journal of Systems and Software, Vol. 158, pp. 110427, 2019

Year: 2019

Abstract: The Open Web Application Security Project (OWASP) defines Static Application Security Testing (SAST) tools as those that can help find security vulnerabilities in the source code or compiled code of software. Such tools detect and classify the vulnerability warnings into one of many types (e.g., input validation and representation). It is well known that these tools produce high numbers of false positive warnings. However, what is not known is if specific types of warnings have a higher predisposition to be false positives or not. Therefore, our goal is to investigate the different types of SAST-produced warnings and their evolution over time to determine if one type of warning is more likely to have false positives than others. To achieve our goal, we carry out a large empirical study where we examine 116 large and popular C++ projects using six different state-of-the-art open source and commercial SAST tools that detect security vulnerabilities. In order to track a piece of code that has been tagged with a warning, we use a new state of the art framework called cregit+ that traces source code lines across different commits. The results demonstrate the potential of using SAST tools as an assessment tool to measure the quality of a product and the possible risks without manually reviewing the warnings. In addition, this work shows that pattern-matching static analysis technique is a very powerful method when combined with other advanced analysis methods.

BibTeX:

@article{bushraaloraini2019aesoswfsastt,
    author = "Bushra Aloraini and Meiyappan Nagappan and Daniel M. German and Shinpei Hayashi and Yoshiki Higo",
    title = "An Empirical Study of Security Warnings from Static Application Security Testing Tools",
    year = "2019",
    pages = "110427",
    journal = "Journal of Systems and Software",
    volume = "158"
}

Plain Text:

Bushra Aloraini, Meiyappan Nagappan, Daniel M. German, Shinpei Hayashi, and Yoshiki Higo, "An Empirical Study of Security Warnings from Static Application Security Testing Tools," Journal of Systems and Software, pp. 110427