利用工业中已知的生产秘密嗅探代码库秘密泄漏
Sniffing for Codebase Secret Leaks with Known Production Secrets in Industry
摘要：
代码库中的密码和API密钥等泄露的秘密导致了许多安全漏洞。存在诸如模式匹配、熵分析和机器学习之类的现有启发式技术来检测和警告开发人员这种泄漏。然而，启发式方法自然会表现出误报，这需要分类，并可能导致开发人员沮丧。我们建议使用已知的生产秘密作为嗅探代码库中的秘密泄漏的基础事实的来源。我们开发的技术，使用已知的秘密嗅探整个代码库和不断嗅探差分代码修订。我们发现不同的性能和安全需求时，嗅探已知的秘密在这两种情况下，在工业环境中。
英文摘要：
Leaked secrets, such as passwords and API keys, in codebases were responsible for numerous security breaches. Existing heuristic techniques, such as pattern matching, entropy analysis, and machine learning, exist to detect and alert developers of such leaks. Heuristics, however, naturally exhibit false positives, which require triaging and can lead to developer frustration. We propose to use known production secrets as a source of ground truth for sniffing secret leaks in codebases. We develop techniques for using known secrets to sniff whole codebases and continuously sniff differential code revisions. We uncover different performance and security needs when sniffing for known secrets in these two situations in an industrial environment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
