在代码行之间阅读：关于利用自认技术债务进行安全分析的使用
Reading Between the Code Lines: On the Use of Self-Admitted Technical Debt for Security Analysis
AI总结：
本文研究了自认技术债务在静态分析工具辅助安全分析中的补充作用，发现其能有效弥补 SATs 的局限性。
摘要：
静态分析工具（SATs）在安全工程活动中至关重要，因为它们能够无需执行即可早期识别代码中的缺陷。然而，其有效性常受到高假阳性率和对漏洞类别的覆盖不完整性的限制。同时，开发人员经常在软件 artifacts 中，如代码注释中，记录安全相关的快捷方式和妥协作为自认技术债务（SATD）。尽管先前的工作已经认识到 SATD 是一个丰富的安全信息源，但仍然不清楚 SATD 在 SAT 辅助安全分析中是如何被利用的。目标：本研究探讨安全相关的 SATD 在多大程度上补充 SATs 产生的输出，并帮助弥补 SATs 的已知限制。方法：我们采用混合方法方法，包括（i）分析一个 SATD 注释的漏洞数据集，使用三种最先进的 SATs，以及（ii）对 72 名安全从业者进行在线调查。结果：所有 SATs 的联合使用标记了 135 个安全相关的 SATD 实例中的 114 个，涵盖 24 个不同的常见弱点枚举（CWE）标识符。对 SATD 注释的手动映射揭示了 33 种独特的 CWE 类型，其中 6 种对应于 SATs 常常忽视或难以检测的类别（例如，竞态条件）。调查结果进一步表明，开发人员经常将 SAT 输出与 SATD 观点相结合，以更好地理解安全缺陷的影响和根本原因，并识别合适的修复方法。意义：我们的发现表明，这种 SATD 编码的信息可以成为 SAT 驱动的安全分析的有意义补充，同时帮助克服 SATs 的实际不足。
英文摘要：
Static Analysis Tools (SATs) are central to security engineering activities, as they enable early identification of code weaknesses without requiring execution. However, their effectiveness is often limited by high false-positive rates and incomplete coverage of vulnerability classes. At the same time, developers frequently document security-related shortcuts and compromises as Self-Admitted Technical Debt (SATD) in software artifacts, such as code comments. While prior work has recognized SATD as a rich source of security information, it remains unclear whether -and in what ways- it is utilized during SAT-aided security analysis. OBJECTIVE: This work explores whether and how the security-related information encoded in SATD provides complementary security insights to SATs. METHOD: We followed a mixed-methods approach comprising (i) the analysis of a manually curated, SATD-annotated vulnerability dataset using three SATs and (ii) an online survey involving 72 security-aware software practitioners. RESULTS: The selected SATs flagged 114 of the 135 validated Security-related SATD instances (SSATD), yet the overlap between SAT-derived and manually mapped Common Weakness Enumeration (CWE) identifiers was only 6.42%, indicating that both sources often expose different kinds of security information. In particular, SSATD captured several dynamic and context-dependent weakness types that SATs commonly overlook or struggle to detect. Survey responses further indicate that practitioners rely on SSATD to contextualize SAT findings by understanding their impact, root causes, and potential fixes. IMPLICATIONS: Our findings suggest that SSATD constitutes a valuable and cost-effective source of complementary security knowledge that can support the interpretation, prioritization, and further assessment of SAT findings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
