title: Supporting secure programming in web applications through interactive static analysis.
abstract: Many security incidents are caused by software developers' failure to adhere to secure programming practices. Static analysis tools have been used to detect software vulnerabilities. However, their wide usage by developers is limited by the special training required to write rules customized to application-specific logic. Our approach is interactive static analysis, to integrate static analysis into Integrated Development Environment (IDE) and provide in-situ secure programming support to help developers prevent vulnerabilities during code construction. No additional training is required nor are there any assumptions on ways programs are built. Our work is motivated in part by the observation that many vulnerabilities are introduced due to failure to practice secure programming by knowledgeable developers. We implemented a prototype interactive static analysis tool as a plug-in for Java in Eclipse. Our technical evaluation of our prototype detected multiple zero-day vulnerabilities in a large open source project. Our evaluations also suggest that false positives may be limited to a very small class of use cases.
authors: Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC 28223, USA.
authors: Jun
authors: J
authors: Zhu
authors: Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC 28223, USA.
authors: Jing
authors: J
authors: Xie
authors: Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC 28223, USA.
authors: Heather Richter
authors: HR
authors: Lipford
authors: Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC 28223, USA.
authors: Bill
authors: B
authors: Chu
keywords: Interactive static analysis; Secure programming; Software vulnerabilities; Static analysis