Effect of static analysis tools on software security: preliminary investigation

Static analysis tools can handle large-scale software and find thousands of defects. But do they improve software security? We evaluate the effect of static analysis tool use on software security in open source projects. We measure security by vulnerability reports in the National Vulnerability Database. Categories and Subject Descriptors D.2.8 [Software Engineering]: Metrics – product metrics; D.2.4 [Software Engineering]: Software/Program Verification; K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms Measurement, Security Keywords Software Security, Static Analysis Tools, Vulnerability

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Vadim Okun, William F. Guthrie, Romain Gaucher, Paul E. Black
• Keywords: CCS 2007, Security Keywords Software, Security Privacy, Software Security, Static Analysis Tools