Due to its exceptional performance and memory security, Java is extensively employed in enterprise applications, thereby rendering any vulnerability in Java applications capable of causing significant repercussions. In recent years, due to the frequent occurrence of network attacks, new attack methods continue to emerge while software systems become increasingly intricate and unstable under the weight of historical burdens. Consequently, static analysis techniques are imperative for identifying security risks in code during the coding phase. The prevailing approach in static analysis involves transforming code into a standardized intermediate representation and conducting vulnerability detection, without code execution. However, this methodology often yields detection results accompanied by a considerable false positive rate. We propose VulnSlicer, a tool based on graph similarity matching and vulnerability subgraph slice technology. This tool not only enables efficient vulnerability retrieval but also effectively reduces the false positive rate by leveraging the slice mechanism to save historical vulnerabilities. Additionally, it facilitates rapid matching of accumulated vulnerabilities in the database and further mitigates false positives through the introduction of a keyframe mechanism. In the experiment, we conducted a comparative analysis of several existing static detection tools to assess their effectiveness in detecting vulnerabilities within the same codebase. Experiments show that VulnSlicer has decent accuracy and lower false positive rate.
原文链接
分享
引用
