| Title | SWAN\_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Piskachev, Goran, Nguyen Quang Do, Lisa, Johnson, Oshando, Bodden, Eric |
| Conference Name | 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) |
| Keywords | active machine learning, authentication, authentication methods, Automated Secure Software Engineering, bug detection, code-specific methods, composability, graphical user interfaces, IntelliJ plugin, Java, learning (artificial intelligence), Libraries, machine learning, machine-learning, novel automated machine-learning approach SWAN, pattern classification, program analysis, program debugging, program diagnostics, pubcrawl, public domain software, Resiliency, security, security-relevant methods, semiautomated detection, software maintenance, software metrics, software quality, SRM, static analysis tools, SWAN\_ASSIST aids developers, SWAN\_ASSIST tool, time exactly those methods whose classification best impact, Training, vulnerability detection |
| Abstract | To detect specific types of bugs and vulnerabilities, static analysis tools must be correctly configured with security-relevant methods (SRM), e.g., sources, sinks, sanitizers and authentication methods-usually a very labour-intensive and error-prone process. This work presents the semi-automated tool SWAN\_ASSIST, which aids the configuration with an IntelliJ plugin based on active machine learning. It integrates our novel automated machine-learning approach SWAN, which identifies and classifies Java SRM. SWAN\_ASSIST further integrates user feedback through iterative learning. SWAN\_ASSIST aids developers by asking them to classify at each point in time exactly those methods whose classification best impact the classification result. Our experiments show that SWAN\_ASSIST classifies SRM with a high precision, and requires a relatively low effort from the user. A video demo of SWAN\_ASSIST can be found at https://youtu.be/fSyD3V6EQOY. The source code is available at https://github.com/secure-software-engineering/swan. |
| DOI | 10.1109/ASE.2019.00110 |
| Citation Key | piskachev_swan_assist_2019 |
SWAN\_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods