静态分析结果交换格式在CogniCrypt中的集成
Integration of the Static Analysis Results Interchange Format in CogniCrypt
摘要：
背景-软件公司越来越依赖于静态分析工具来检测其软件产品中的潜在错误和安全漏洞。在过去的十年中，越来越多的商业和开源静态分析工具被开发和维护。每种工具都有自己的报告格式，这就妨碍了在单个界面中轻松集成多个分析工具，例如静态分析服务器协议（SASP）。2017年，包括微软和GrammaTech在内的行业合作提出了静态分析结果交换格式（SARIF）来解决这个问题。SARIF是一种标准化格式，可以对静态分析警告进行编码，以允许在不同工具之间导入和导出分析报告。目的-本文通过示例解释了SARIF格式，并提供了连接器的概念证明，该连接器允许静态分析工具CogniCrypt以SARIF格式生成和导出其结果。设计/方法-在详细介绍连接器的实现之前，我们对SARIF格式和CogniCrypt的输出格式进行了横截面研究。该研究旨在找到SARIF导出模块可以完成的CogniCrypt中感兴趣的组件。独创性/价值-本文所述的集成到CogniCrypt的SARIF可以重复使用到其他静态分析工具集成SARIF。结论-在详细介绍了SARIF格式之后，我们提出了一个将SARIF集成到CogniCrypt的初步实现。在利用SARIF提供的所有功能后，CogniCrypt将能够支持SASP。
英文摘要：
Background - Software companies increasingly rely on static analysis tools to detect potential bugs and security vulnerabilities in their software products. In the past decade, more and more commercial and open-source static analysis tools have been developed and are maintained. Each tool comes with its own reporting format, preventing an easy integration of multiple analysis tools in a single interface, such as the Static Analysis Server Protocol (SASP). In 2017, a collaborative effort in industry, including Microsoft and GrammaTech, has proposed the Static Analysis Results Interchange Format (SARIF) to address this issue. SARIF is a standardized format in which static analysis warnings can be encoded, to allow the import and export of analysis reports between different tools. Purpose - This paper explains the SARIF format through examples and presents a proof of concept of the connector that allows the static analysis tool CogniCrypt to generate and export its results in SARIF format. Design/Approach - We conduct a cross-sectional study between the SARIF format and CogniCrypt's output format before detailing the implementation of the connector. The study aims to find the components of interest in CogniCrypt that the SARIF export module can complete. Originality/Value - The integration of SARIF into CogniCrypt described in this paper can be reused to integrate SARIF into other static analysis tools. Conclusion - After detailing the SARIF format, we present an initial implementation to integrate SARIF into CogniCrypt. After taking advantage of all the features provided by SARIF, CogniCrypt will be able to support SASP.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
