Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
Serena E. Ponta, Henrik Plate, Antonino Sabetta
备注：
To appear in the Proc. of the 2018 IEEE International Conference on Software Maintenance and Evolution (ICSME) Added: - acknowledgements - citation to Dashevskyi et al. (TSE 2018), DOI: 10.1109/TSE.2018.2816033
The use of open-source software (OSS) is ever-increasing, and so is the number of open-source vulnerabilities being discovered and publicly disclosed. The gains obtained from the reuse of community-developed libraries may be offset by the cost of detecting, assessing, and mitigating their vulnerabilities in a timely fashion.
In this paper we present a novel method to detect, assess and mitigate OSS vulnerabilities that improves on state-of-the-art approaches, which commonly depend on metadata to identify vulnerable OSS dependencies. Our solution instead is code-centric and combines static and dynamic analysis to determine the reachability of the vulnerable portion of libraries used (directly or transitively) by an application. Taking this usage into account, our approach then supports developers in choosing among the existing non-vulnerable library versions.
VULAS, the tool implementing our code-centric and usage-based approach, is officially recommended by SAP to scan its Java software, and has been successfully used to perform more than 250000 scans of about 500 applications since December 2016. We report on our experience and on the lessons we learned when maturing the tool from a research prototype to an industrial-grade solution.
Cross-Ecosystem Vulnerability Analysis for Python Applications
University of Athens（雅典大学）；National Infrastructures for Research and Technology（国家研究与技术基础设施）；Athens University of Economics and Business（雅典经济与商业大学）；ETH Zurich（苏黎世联邦理工学院）；Technical University of Crete（克里特理工大学）
The Hidden Risks of LLM-Generated Web Application Code: A Security-Centric Evaluation of Code Generation Capabilities in Large Language Models
Department of IT IIIT Allahabad（信息技术系，印度阿拉哈巴德IIIT）；Department of ECE IIIT Allahabad（电子工程系，印度阿拉哈巴德IIIT）；Department of CSE IIT Kanpur（计算机科学与工程系，印度坎purIIT）
