Analyse statique de code : Réduction des fausses alertes par apprentissage machine

Abstract

Security vulnerabilities in web applications are extremely dangerous, especially nowadays, when anyone with a bit of knowledge and the right tools can successfully exploit them. This can have bad consequences: theft of sensitive data, denial of service, etc. Therefore, it is crucial for a developer to detect these vulnerabilities before committing changes. Among the methods used to do that, static code analysis is the most common. The concept is to analyze the code without executing it, in order to find specific vulnerability patterns: overall, this process is very effective and efficient. However, this method generates a lot of false reports, called false positives: the developer has no other choice but to manually sort these alerts, which can be very time-consuming, and thus lead to errors. The goal here is to overcome this problem by using machine learning technic: by automating the sorting of reports, the developer will save a considerable amount of time, and the risk of errors will be reduced. Our study is based on Find Security Bugs, a static analyzer for Java code. First, we selected some features that represent precisely each alert, so that the machine learning algorithm can make a difference between true vulnerabilities and false positives. Then, we extracted those features from the analyzer’s reports and a graphic representation of the code, and we trained different algorithms to eliminate false positives. We tested our solution on the Juliet test suite, which contains a lot of already labeled vulnerabilities. The results were good: more than 85% of false reports were detected by the machine learning algorithms. We also showed that there is not an optimal algorithm in our context, but it is possible to combine some of them to optimize the results. Finally, our solution is flexible, and integrates seamlessly with Find Security Bugs, without additional complexity: the developer is free to use it the way he wants.

Date	30 Jul 2018
Original language	French
Awarding Institution	École de technologie supérieure
Supervisor	Jean-Marc Robert (Supervisor)