To detect security vulnerabilities, static analysis tools need to be configured with security-relevant methods (SRM). Machine learning (ML) can help identify such methods. However, current ML approaches ignore dependencies among SRM labels and This may lead to poor performance in practice. Additionally, experts currently need to configure static analysis tools manually with SRMs detected by machine learning approaches.
In this paper, we present Dev-Assist, an improved IntelliJ IDEA plugin that detects SRMs using a multi-label ML approach that considers dependencies among labels. Dev-Assist allows users to generate configurations for SAST tools automatically, and to detect security vulnerabilities directly within the Integrated Development Environment (IDE). Our experiments reveal that the multi-label approach has a higher F1-Measure than related approaches. Dev-Assist’s source code and documentation are available online.
Attila Szatmári Szegedi Tudományegyetem, Qusay Idrees Sarhan Department of Software Engineering, University of Szeged, Péter Attila Soha Department of Software Engineering, University of Szeged, Gergő Balogh Department of Software Engineering, University of Szeged, Árpád Beszédes Department of Software Engineering, University of Szeged
Niklas Krieger Institute of Software Engineering, University of Stuttgart, Sandro Speth Institute of Software Engineering, University of Stuttgart, Steffen Becker University of Stuttgart
Tim Kräuter Western Norway University of Applied Sciences, Patrick Stünkel Western Norway University of Applied Sciences, Adrian Rutle Western Norway University of Applied Sciences, Yngve Lamo Western Norway University of Applied Sciences
