 |
The importance of software is increasing in countries, societies, and lives. Several agencies have defined the concept of software assurance, which includes the definitions of reliability and security. Now, software engineers should not look at software quality and security assurance separately.
In this paper, we analyze the binary search program and CWE-190 test case example and performed the static analysis. As a result, we conclude that all integer overflows generated by static analysis tools are true positives. It solves the difficulties of distinguishing true positive and false positive, which are the limitations of static analysis. After performing static analysis, the developer should modify the code to satisfy reliability and security.
In future research, we will expand our study to analyze all Juliet Test Suite for C/C++. We will propose that the performance indicators for comparing static analysis tools should be changed by analyzing false positives in the static analysis results. |
IEEE/ICACT20210212 Slide.21
[Big Slide]