使用SonarCloud代码分析进行易受攻击源代码检测
Vulnerable Source Code Detection using SonarCloud Code Analysis
AI总结：
本文研究利用SonarCloud代码分析指标为UMI销售点应用构建机器学习漏洞检测器，实验检测到3,285条易受攻击规则，以降低误报并聚焦测试资源。
摘要：
在软件开发生命周期（SDLC）中，安全漏洞是构建阶段引入的问题之一。在产品发布到市场后未能及早发现软件缺陷，会导致公司修复成本升高。因此，这会降低公司声誉、侵犯用户隐私，并给应用程序带来无法修复的问题。引入漏洞检测能够减少误报数量，从而将有限的测试工作集中在可能存在漏洞的文件上。UMKM Masa Kini（UMI）是一个销售各类微型、小型和中型企业（UMKM）产品的销售点（Point of Sales）应用程序。因此，在当前工作中，我们分析了这些指标是否适合为UMI应用程序构建基于机器学习（Machine Learning）的软件漏洞检测器。代码使用商业工具SonarCloud生成。实验结果表明，共检测到3,285条易受攻击规则。
英文摘要：
In Software Development Life Cycle (SDLC), security vulnerabilities are one of the points introduced during the construction stage. Failure to detect software defects earlier after releasing the product to the market causes higher repair costs for the company. So, it decreases the company's reputation, violates user privacy, and causes an unrepairable issue for the application. The introduction of vulnerability detection enables reducing the number of false alerts to focus the limited testing efforts on potentially vulnerable files. UMKM Masa Kini (UMI) is a Point of Sales application to sell any Micro, Small, and Medium Enterprises Product (UMKM). Therefore, in the current work, we analyze the suitability of these metrics to create Machine Learning based software vulnerability detectors for UMI applications. Code is generated using a commercial tool, SonarCloud. Experimental result shows that there are 3,285 vulnerable rules detected.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
