EASE 2024
Tue 18 - Fri 21 June 2024 Salerno, Italy
Thu 20 Jun 2024 14:12 - 14:25 at Room Vietri - Security (1) Chair(s): Giuseppe Scanniello

Context: Static Application Security Testing Tools (SASTTs) identify software vulnerabilities to support the security and reliability of software applications. Interestingly, several studies have suggested that alternative solutions may be more effective than SASTTs due to their tendency to generate false alarms, commonly referred to as low Precision.

Aim: We aim to comprehensively evaluate SASTTs, setting a reliable benchmark for assessing and finding gaps in vulnerability identification mechanisms based on SASTTs or alternatives.

Method: Our SASTTs evaluation is based on a controlled, though synthetic, Java codebase, it involves an assessment of 1.5 million test executions, and it features innovative methodological features such as effort-aware accuracy metrics and method-level analysis.

Results: Our findings reveal that SASTTs detect a tiny range of vulnerabilities. In contrast to prevailing wisdom, SASTTs exhibit high Precision while falling short in Recall. Conclusions: The paper suggests that enhancing Recall, alongside expanding the spectrum of detected vulnerability types, should be the primary focus for improving SASTTs or alternative approaches, such as machine learning-based vulnerability identification solutions.

Thu 20 Jun

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

14:00 - 15:30
14:00
12m
Talk
Analyzing Prerequisites of known Deserialization Vulnerabilities on Java Applications
Research Papers
Bruno Kreyssig Umeå University, Alexandre Bartel Umeå University
14:12
12m
Talk
An Extensive Comparison of Static Application Security Testing Tools
Research Papers
Matteo Esposito University of Rome Tor Vergata, Valentina Falaschi University of Rome Tor Vergata, Davide Falessi University of Rome Tor Vergata, Italy
Pre-print
14:25
12m
Talk
Detecting Security Fixes in Open-Source Repositories using Static Code Analyzers
Industry
Therese Fehrer JADS, Tilburg University صs-Hertogenbosch, Rocio Cabrera Lozoya SAP Security Research, Antonino Sabetta SAP Labs, Dario Di Nucci University of Salerno, Damian Andrew Tamburri TU/e
14:38
12m
Talk
Analyzing the Accessibility of GitHub Repositories for PyPI and NPM Libraries
Short Papers, Vision and Emerging Results
DOI Pre-print
14:51
12m
Talk
Unveiling iOS Scamwares through Crowdturfing Reviews
Short Papers, Vision and Emerging Results
Zhipeng Xu Shanghai Jiao Tong University
15:04
12m
Talk
Mining REST APIs for Potential Mass Assignment Vulnerabilities
Short Papers, Vision and Emerging Results
Arash Mazidi , Davide Corradini University of Verona, Mohammad Ghafari TU Clausthal
15:17
12m
Talk
Negative Complement of a Set of Vulnerability-Fixing Commits: Method and Dataset
Industry
Rocio Cabrera Lozoya SAP Security Research, Antonino Sabetta SAP Labs, Tommaso Aiello SAP Security Research