Loading...
Publication
VULNFUSION: PLATAFORMA DE INTEGRAÇÃO DE FERRAMENTAS OPEN- SOURCE SAST
Authors
Abstract(s)
Ciclos de desenvolvimento acelerados e o uso de bibliotecas de terceiros aumentam a
probabilidade de existirem lacunas de segurança no código, agravada pela insuficiente
formação em segurança dos programadores. A análise de segurança manual é
lenta e cara, o que torna as ferramentas de análise de segurança estática, static
application security testing (SAST), essenciais para identificar vulnerabilidades de
forma eficiente.
Contudo, as ferramentas SAST geram muitos falsos positivos, exigindo verificação
manual. Este projeto propõe uma plataforma, intitulada VulnFusion, que integra
múltiplas ferramentas SAST para melhorar a robustez da análise de segurança,
e que utiliza técnicas de inteligência artificial (IA) para enriquecer os resultados
obtidos.
A plataforma VulnFusion visa reduzir os falsos positivos e aumentar a eficiência
na deteção de vulnerabilidades e auxiliar na prioritização dos esforços de mitigação,
adaptando-se às necessidades dos programadores e organizações.
O presente documento inclui uma breve revisão de ferramentas SAST open-source
existentes, o desenvolvimento da plataforma VulnFusion e dos processos de agregação
de resultados e enriquecimento dos mesmos, e apresenta os testes realizados e os
resultados obtidos.
Os resultados demonstraram uma melhoria na cobertura e precisão da deteção de
vulnerabilidades face à utilização de uma única ferramenta, com ganhos no F1-score
para categorias como command injection (47,8%) e SQL injection (36,5%) após a
integração de múltiplas ferramentas SAST e enriquecimento por IA.
Accelerated development cycles and the use of third-party libraries increase the likelihood of security gaps in the code, exacerbated by the insufficient security training of developers. Manual security analysis are slow and expensive, making static application security testing (SAST) tools essential for efficiently identifying vulnerabilities. However, SAST tools generate many false positives, requiring manual verification. This project proposes a platform, titled VulnFusion, that integrates multiple SAST tools to improve the robustness of security analysis and uses artificial intelligence (AI) techniques to enrich the results produced. The platform VulnFusion aims to reduce false positives, increase the efficiency of vulnerability detection, and assist in prioritizing mitigation efforts, adapting to the needs of developers and organizations. This document includes a brief review of existing open-source SAST tools, the development of the platform and the processes for aggregating and enriching results, and presents the tests performed and the results obtained. The results obtained demonstrated an improvement in both coverage and accuracy of vulnerability detection compared to the use of a single tool, with F1-score gains for categories such as command injection (47.8%) and SQL injection (36.5%) following the integration of multiple SAST tools and AI-based enrichment.
Accelerated development cycles and the use of third-party libraries increase the likelihood of security gaps in the code, exacerbated by the insufficient security training of developers. Manual security analysis are slow and expensive, making static application security testing (SAST) tools essential for efficiently identifying vulnerabilities. However, SAST tools generate many false positives, requiring manual verification. This project proposes a platform, titled VulnFusion, that integrates multiple SAST tools to improve the robustness of security analysis and uses artificial intelligence (AI) techniques to enrich the results produced. The platform VulnFusion aims to reduce false positives, increase the efficiency of vulnerability detection, and assist in prioritizing mitigation efforts, adapting to the needs of developers and organizations. This document includes a brief review of existing open-source SAST tools, the development of the platform and the processes for aggregating and enriching results, and presents the tests performed and the results obtained. The results obtained demonstrated an improvement in both coverage and accuracy of vulnerability detection compared to the use of a single tool, with F1-score gains for categories such as command injection (47.8%) and SQL injection (36.5%) following the integration of multiple SAST tools and AI-based enrichment.
Description
Keywords
Engenharia Informática Cibersegurança Informática Forense Ferramentas de Open- Source Sast Plataforma VulnFusion Ferramentas de Static Application Security Testing (SAST)