Securing java code: Heuristics and an evaluation of static analysis tools

Proceedings of the Static Analysis Workshop, SAW 2008

Volumn , Issue , 2008, Pages 12-21

  Ware, Michael S ^a   Fox, Christopher J ^a  

^a JAMES MADISON UNIVERSITY   (United States)

Author keywords

Design principles; Secure code; Static analysis; Taxonomy

Indexed keywords

DESIGN PRINCIPLES; JAVA CODES; SECURE CODE; SECURE CODING;

ACOUSTIC SURFACE WAVE DEVICES; ACOUSTIC SURFACE WAVE FILTERS; ACOUSTIC WAVE VELOCITY; CARBON DIOXIDE ARC WELDING; CODES (SYMBOLS); COMPUTER PROGRAMMING LANGUAGES; HEURISTIC METHODS; IMAGE CODING; PROGRAMMING THEORY; TAXONOMIES; TECHNICAL PRESENTATIONS;

STATIC ANALYSIS;

EID: 57449101131     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1394504.1394506     Document Type: Conference Paper

References (35)

1. R. Alexander, J. Bieman, and J. Viega, "Coping with Java Programming Stress," IEEE Computer, vol. 33, no. 4, pp. 30-38, April 2000.
2. N. Ayewah, W. Pugh, J. Morgenthaler, J. Penix, Y. Zhou, "Evaluating Static Analysis Defect Warnings On Production Software," in Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering, 2007, pp. 1-8.
3. S. Barnum and M Gegick, "Reluctance to Trust," Build Security In: Setting a Higher Standard for Software Assurance, Cigital Inc., 2005. [Online]. Available: https://buildsecurityin.us-cert.gov/daisy/bsi/articles/ knowledge/principles/355.html. [Accessed: January 17, 2008].
4. T. V. Benzel, C. E. Irvine, T. E. Levin, G. Bhaskara, and P. C. Nguyen, "Design Principles for Security," Naval Postgraduate School: Monterey, California, Tech Rep. NPS-CS-05-010, September 2005. Available: http://handle.dtic.mil/100.2/ADA437854. [Accessed: Sept. 5, 2007].
5. J. Bloch, Effective Java Programming Language Guide. Prentice Hall, 2001.
6. O. Burn, "Checkstyle 4.4," [Online]. Available: http://checkstyle.sourceforge.net. [Accessed: March 1, 2008].
7. CERT, "Secure Coding," Software Engineering Institute: Carnegie Mellon, [Online]. Available: https://www.cert.org/secure-coding. [Accessed: February, 16, 2008].
8. B. Chess and J. West, Secure Programming with Static Analysis. Boston, MA: Addison-Wesley, 2007.
9. CLASP, "Comprehensive Lightweight Application Security Process," Secure Software, Inc., Version 2.0, 2006. [Online]. Available: http://searchsoftwarequality.techtarget.com/searchAppSecurit y/downloads/clasp-v20.pdf. [Accessed December 5, 2007].
10. Fortify Software Inc., "Fortify Source Code Analysis (SCA)," Fortify Software Inc. [Online]. Available: http://www.fortify.com/ products/sca.
11. C. Fox, Introduction to Software Engineering Design: Processes, Principles, and Patterns with UML2. Boston, MA: Addison-Wesley, 2006.
12. L. Gong, G. Ellison, and M. Dageforde, Inside Java 2 Platform Security: Architecture, API Design, and Implementation, 2nd ed. Boston, MA: Addison-Wesley, 2003.
13. S. Gutz and O. Marquez, "TPTP Static Analysis Tutorial Part 1: A Consistent Analysis Interface," [Online], Available: http://www.eclipse. org/tptp/home/documents/process/develo pment/static-analysis/TPTP-static- analysis-tutorial-partl.html. [Accessed: February 10, 2008].
14. D. Hovemeyer and W. Pugh, "Finding Bugs is Easy," in SIGPLAN Notices, vol. 39, no. 12, December 2004, pp. 92-206.
15. M. Howard and D. Lipner, Writing Secure Code, 2nd ed. Redmond, Washington: Microsoft Press, 2003.
16. InfoEther, "PMD," [Online]. Available: http://pmd.sourceforge. net.
17. Jlint, "About Jlint," [Online]. Available: http://jlint. sourceforge.net.
18. C. Lai, "Java Insecurity: Accounting for Subtleties That Can Compromise Code," IEEE Software, vol. 25, no. 1, pp. 13-19, January/February 2008.
19. G. McGraw and E. Felton, Securing Java: Getting Down to Business with Mobile Code. John Wiley & Sons, Inc., 1998. [Online], Available: http://www.securingjava.com. [Accessed: March 13, 2008].
20. National Institute of Standards and Technology, "SAMATE: Software Assurance Metrics and Tool Evaluation," National Institute of Standards and Technology. [Online]. Available: http://samate.nist.gov. [Accessed: February 5, 2008],
21. D. L. Parnas, "On the Criteria To Be Used in Decomposing Systems into Modules," in Communications of the ACM, vol. 15, no. 12, 1972, pp. 1053-1058.
22. QJ-Pro, "Code Analyzer for Java," [Online]. Available: http://qjpro.sourceforge.net.
23. S. Redwine, Jr., Ed., Software Assurance: A Guide to the Common Body of Knowledge to Produce, Acquire, and Sustain Secure Software, Workforce Education and Training Working Group, U.S. Department of Homeland Security, Draft Version 1.1, September 2006.
24. S. Redwine Jr., "Towards an Organization for Software System Security Principles and Guidelines," Institute for Infrastructure and Information Assurance, James Madison University: Harrisonburg, VA, Tech. Rep. 08-01, Version 1.0, February 2008.
25. N. Rutar, C. Almazan, and J. Foster, "A Comparison of Bug Finding Tools for Java," in Proceedings of the 15th IEEE International Symposium on Software Reliability Engineering, France, November 2004.
26. M. D. Schroeder, and J. H. Saltzer, "The Protection of Information in Computer Systems," in Proceedings of the IEEE, vol. 63, no. 9, 1975, pp. 1278-1308. Available: http://web.mit.edu/Saltzer/www/publications/protection.
27. R. Seacord, "Secure Coding Standards," in Proceedings of the Static Analysis Summit, NIST Special Publication 500-262, July 2006. Available: http://samate.nist.gov/docs/NIST-Special-Publication-500-262.pdf.
28. Sun Microsystems, Inc., "Secure Coding Guidelines for the Java Programming Language, version 2.0," Sun Microsystems, Inc. [Online]. Available: http://java.sun.com/security/seccodeguide.html, [Accessed: Aug. 30, 2007].
29. The MITRE Corporation, "Common Weaknesses Enumeration: A Community-Developed Dictionary of Software Weakness Types," Draft 7, The MITRE Corporation, 2007. [Online]. Available: http://cwe.mitre.org. [Accessed: October 28, 2007].
30. K. Tsipenyuk, B. Chess, G. McGraw, "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors," in NIST Workshop on Software Security Assurance Tools, Techniques, and Metrics, Long Beach, CA, November 2005.
31. utils.com, "Lint4j," [Online]. Available: http://www.jutils. com.
32. J. Viega and G. McGraw, Building Secure Software: How to Avoid Security Problems the Right Way. Indianapolis, IN: Addison-Wesley, 2002.
33. S. Wagner, J. Jurjens, C. Koller, P. Trischberger, "Comparing Bug Finding Tools with Reviews and Tests," in Proceedings of the 17th International Conference on Testing of Communication Systems, 2005, pp. 40-55.
34. S. Wagner, F. Deissenboeck, J. Wimmer, M. Aichner, M. Schwab, "An Evaluation of Two Bug Pattern Tools for Java," to appear in Proceedings of the 1st IEEE International Conference on Software Testing, Verification and Validation, 2008.
35. M. S. Ware, "Writing secure Java code: taxonomy of heuristics and an evaluation of static analysis tools," M.S. Thesis, James Madison University, 2008. Available: http://peregrin.jmu.edu/-warems.