Using the Juliet Test Suite to Compare Static Security Scanners

Andreas Wagner, Johannes Sametinger

2014

Abstract

Security issues arise permanently in different software products. Making software secure is a challenging endeavour. Static analysis of the source code can help eliminate various security bugs. The better a scanner is, the more bugs can be found and eliminated. The quality of security scanners can be determined by letting them scan code with known vulnerabilities. Thus, it is easy to see how much they have (not) found. We have used the Juliet Test Suite to test various scanners. This test suite contains test cases with a set of security bugs that should be found by security scanners. We have automated the process of scanning the test suite and of comparing the generated results. With one exception, we have only used freely available source code scanners. These scanners were not primarily targeted at security, yielding disappointing results at first sight. We will report on the findings, on the barriers for automatic scanning and comparing, as well as on the detailed results.

Paper Citation

in Harvard Style

Wagner A. and Sametinger J. (2014). Using the Juliet Test Suite to Compare Static Security Scanners . In Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014) ISBN 978-989-758-045-1, pages 244-252. DOI: 10.5220/0005032902440252

in Bibtex Style

@conference{secrypt14,
author={Andreas Wagner and Johannes Sametinger},
title={Using the Juliet Test Suite to Compare Static Security Scanners},
booktitle={Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014)},
year={2014},
pages={244-252},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005032902440252},
isbn={978-989-758-045-1},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014)
TI - Using the Juliet Test Suite to Compare Static Security Scanners
SN - 978-989-758-045-1
AU - Wagner A.
AU - Sametinger J.
PY - 2014
SP - 244
EP - 252
DO - 10.5220/0005032902440252