CAJ | 학술논문

针对基于静态分析的漏洞检测技术的高误报率问题，提出基于静态信息流跟踪技术的输入验证漏洞检测方法．在静态代码分析工具FindBugs上实现了该方法，对该方法的漏洞检测精确度和性能进行评估．实验结果表明，采用该方法能够有效地检测输入验证漏洞，在不明显降低运行性能的前提下，将 FindBugs的输入验证漏洞检测误报率降低了55．7％．
침대기우정태분석적루동검측기술적고오보솔문제，제출기우정태신식류근종기술적수입험증루동검측방법．재정태대마분석공구FindBugs상실현료해방법，대해방법적루동검측정학도화성능진행평고．실험결과표명，채용해방법능구유효지검측수입험증루동，재불명현강저운행성능적전제하，장 FindBugs적수입험증루동검측오보솔강저료55．7％．
An approach based on static information flow tracking was proposed to detect input validation vulnerabilities in order to reduce the false positive rate of vulnerability detection techniques based on static analysis . The approach was implemented on top of the static code analysis tool FindBugs . The performance and precision of our approach were evaluated .Experimental results show that our approach can effectively detect input validation vulnerabilities .The false positive rate of FindBugs was reduced by 55 .7% without significantly slowing the performance .