SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods

摘要: To detect specific types of bugs and vulnerabilities, static analysis tools must be correctly configured with security-relevant methods (SRM), e.g., sources, sinks, sanitizers authentication methods–usually a very labour-intensive error-prone process. This work presents the semi-automated tool SWAN_ASSIST, which aids configuration an IntelliJ plugin based on active machine learning. It integrates our novel automated machine-learning approach SWAN, identifies classifies Java SRM. SWAN_ASSIST further user feedback through iterative developers by asking them to classify at each point in time exactly those whose classification best impact result. Our experiments show that SRM high precision, requires relatively low effort from user. A video demo can found https://youtu.be/fSyD3V6EQOY. The source code is available https://github.com/secure-software-engineering/swan.