Journal of University of Chinese Academy of Sciences >
Lexical analysis in source code analysis
Received date: 2008-06-28
Revised date: 2008-11-06
Online published: 2009-05-15
Source code analysis means detecting and correcting the security vulnerabilities of these software in time during the coding stage, and lexical analysis is one of the important techniques in it. In this paper, we manage to detailedly analyze the implement process of lexical analysis, improve dangerous function database, optimize the method of features analysis,and particularly introduce Bayesian theory to the lexical analysis. In addition, a lexical analysis tool SSCAN is designed and implemented successfully, which is proved to have higher integrity and accuracy than mainstream open-source lexical analysis software Flawfinder and Rats by several tests.
Key words： source code analysis; lexical analysis; features analysis; Bayesian theory
XIAO Feng , ZHANG Yu-Qing . Lexical analysis in source code analysis[J]. Journal of University of Chinese Academy of Sciences, 2009 , 26(3) : 408 -414 . DOI: 10.7523/j.issn.2095-6134.2009.3.016
[1] Heffley J, Meunier P. Can source code auditing software identify common vulnerabilities and beused to evaluate software security. In: HICSS 2004. Hawaii, Jan, 2004
[2] Davide Pozza, Luca Durante. Comparing lexical analysis tools for buffer overflow detection in ne-twork software. In: First International Conference on Communication System Software and Middleware(Comsware 2006). 2006.1~7
[3] FlawFinder Home Page. http://www.dwheeler.com/flawfinder/. 2008-6-25
[4] ITS4: A static vulnerability scanner for C and C+ + code. http://www.cigital.com/papers/downlo-ad/its4.pdf. 2008-6-25
[5] James, Berger. 贾乃光译.统计决策论及贝叶斯分析.北京: 中国统计出版社, 1998
/
| 〈 |
|
〉 |