| Title | SecuCheck: Engineering configurable taint analysis for software developers |
| Publication Type | Conference Paper |
| Year of Publication | 2021 |
| Authors | Piskachev, Goran, Krishnamurthy, Ranjith, Bodden, Eric |
| Conference Name | 2021 IEEE 21st International Working Conference on Source Code Analysis and Manipulation (SCAM) |
| Keywords | composability, Conferences, domain-specific languages, integrated development environment, Java, Metrics, pubcrawl, Runtime, security, Software, static analysis, taint analysis, Tools |
| Abstract | Due to its ability to detect many frequently occurring security vulnerabilities, taint analysis is one of the core static analyses used by many static application security testing (SAST) tools. Previous studies have identified issues that software developers face with SAST tools. This paper reports on our experience in building a configurable taint analysis tool, named SecuCheck, that runs in multiple integrated development environments. SecuCheck is built on top of multiple existing components and comes with a Java-internal domain-specific language fluentTQL for specifying taint-flows, designed for software developers. We evaluate the applicability of SecuCheck in detecting eleven taint-style vulnerabilities in microbench programs and three real-world Java applications with known vulnerabilities. Empirically, we identify factors that impact the runtime of SecuCheck. |
| DOI | 10.1109/SCAM52516.2021.00012 |
| Citation Key | piskachev_secucheck_2021 |
SecuCheck: Engineering configurable taint analysis for software developers