Causes and optimization of the false alarm rate of code review system

Yuanying XIAO; Yaodong YOU; Lixi XIANG

doi:10.11959/j.issn.1000-0801.2020324

您当前的位置：

首页 >

文章列表页 >

Causes and optimization of the false alarm rate of code review system

Topic:Application and Terminal Security | 更新时间：2024-06-05

- Causes and optimization of the false alarm rate of code review system
- Telecommunications Science Vol. 36, Issue 12, Pages: 155-162(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000-0801.2020324
  CLC： TN915.9
- Published Online：2020-12，
  
  Published：20 December 2020
- 稿件说明：
移动端阅览
Yuanying XIAO, Yaodong YOU, Lixi XIANG. Causes and optimization of the false alarm rate of code review system[J]. Telecommunications science, 2020, 36(12): 155-162.
DOI：

Yuanying XIAO, Yaodong YOU, Lixi XIANG. Causes and optimization of the false alarm rate of code review system[J]. Telecommunications science, 2020, 36(12): 155-162. DOI： 10.11959/j.issn.1000-0801.2020324.

摘要

目前，代码审计已经成为网络安全建设中举足轻重的环节，基于自动化源代码检测的代码审计系统已经得到了广泛的应用，但仍存在诸多缺点。总结了当前代码审计系统的不足之处，简述了不同静态源代码检测算法的原理，并分析检测报告中出现误报的原因，提出了相应的优化思路，描述了优化方案的技术原理及其应用场景。

Abstract

Code review technology has become a pivotal part in the construction of network security.Analysis of the test reports obtained by the current code auditing system shows that there are many false positives in the report.The shortcomings in the development of the code audit system were summarized

the principles of different detection algorithms were briefly described

the causes of false alarm rates were analyzed

corresponding optimization ideas were proposed

the technical principles of optimization were explained

and the application scenarios of optimization schemes were described.

关键词

Keywords

references

罗琴灵 . 基于静态检测的代码审计技术研究 [D ] . 贵阳:贵州大学 , 2015 .

LUO Q L . Research on code audit technology based on static detection [D ] . Guizhou:Guizhou University , 2015 .

王优楠 . 一种 XSS 漏洞灰盒检测方案的设计与实现 [D ] . 成都:电子科技大学 , 2017 .

WANG Y N . Design and implementation of a XSS vulnerability grey box detection scheme [D ] . Chengdu:University of Electronic Science and Technology of China , 2017 .

何斌颖 , 杨林海 . Web 代码安全人工审计内容的研究 [J ] . 江西科学 , 2014 , 32 ( 4 ): 536 - 537 .

HE B Y , YANG L H . A study of Web artificial code security audit [J ] . Jiangxi Science , 2014 , 32 ( 4 ): 536 - 537 .

梁业裕 , 徐坦 , 宁建创 , 等 . 代码审计工作在整个安全保障体系中的重要价值 [J ] . 计算机安全 , 2012 ( 12 ): 32 - 34 .

LIANG Y Y , XU T , NING J C , et al . The important value of code audit work in the whole security system [J ] . Network and Computer Security , 2012 ( 12 ): 32 - 34 .

柳毅 , 洪俊斌 . 基于网络爬虫与页面代码行为的XSS漏洞动态检测方法 [J ] . 电信科学 , 2016 , 32 ( 3 ): 87 - 91 .

LIU Y , HONG J B . A dynamic detection method based on Web crawler and page code behavior for XSS vulnerability [J ] . Telecommunications Science , 2016 , 32 ( 3 ): 87 - 91 .

乔涛 . 跨站脚本漏洞检测与防御技术研究 [D ] . 扬州:扬州大学 , 2017 .

QIAO T . Research on cross-site scripting vulnerability detection and defense technology [D ] . Yangzhou:Yangzhou University , 2017 .

许波 . 代码安全审计工作之我见 [J ] . 信息科技探索 , 2020 ( 5 ): 130 - 132 .

XU B . My view on code security audit [J ] . Public Communication of Science ＆ Technology , 2020 ( 5 ): 130 - 132 .

王晓萌 . 深度学习源代码缺陷检测方法 [J ] . 北京理工大学学报 , 2019 ( 11 ): 1155 - 1156 .

WANG X M . Source code defect detection based on deep learning [J ] . Transactions of Beijing Institute of Technology , 2019 ( 11 ): 1155 - 1156 .

李珍 , 邹德清 , 王泽丽 , 等 . 面向源代码的软件漏洞静态检测综述 [J ] . 网络与信息安全学报 , 2019 ( 2 ): 2 - 4 .

LI Z , ZOU D Q , WANG Z L , et al . Survey on static software vulnerability detection for source code [J ] . Chinese Journal of Network and Information Security , 2019 ( 2 ): 2 - 4 .

黄显果 , 王鹏 , 刘静静 , 等 . 基于工具检测的源代码静态测试技术研究 [J ] . 软件研发与应用 , 2019 ( 5 ): 17 - 19 .

HUANG X G , WANG P , LIU J J , et al . Research on source code static testing technology based on tool detection [J ] . Computer Programming Skills ＆ Maintenance , 2019 ( 5 ): 17 - 19 .

Views

586

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on the application of quantum-secure algorithms in 5G network

Research on new energy station network security assessment method based on improved LSTM network

Application research on network security operation automation practice based on RPA technology

Challenges and innovative solutions of space-ground integrated network security

Development trends of information and communication technology

Related Author

WANG Congli

LI Jinhui

WANG Jingran

XUE Weijia

WANG Jinhua

WANG Qianran

LIU Shan

LI Rui

Related Institution

National Engineering Research Center of Cloud and Network Infrastructure Security

China Telecom Research Institute

State Grid Shanxi Electric Power Company

State Grid Shanxi Electric Power Research Institute

Software Research Institute of China United Network Co., Ltd.

⁰