Idea: Measuring the Effect of Code Complexity on Static Analysis Results

Authors:
James Walden;Adam Messer;Alex Kuhl
Affiliations:
Department of Computer Science, Northern Kentucky University, Highland Heights, 41099;Department of Computer Science, Northern Kentucky University, Highland Heights, 41099;Department of Computer Science, Northern Kentucky University, Highland Heights, 41099
Venue:
ESSoS '09 Proceedings of the 1st International Symposium on Engineering Secure Software and Systems
Year:
2009

Citing 3
Cited 0

Can Source Code Auditing Software Identify Common Vulnerabilities and Be Used to Evaluate Software Security?

HICSS '04 Proceedings of the Proceedings of the 37th Annual Hawaii International Conference on System Sciences (HICSS'04) - Track 9 - Volume 9
Testing static analysis tools using exploitable buffer overflows from open source code

Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering
A Complexity Measure

IEEE Transactions on Software Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

To understand the effect of code complexity on static analysis, thirty-five format string vulnerabilities were studied. We analyzed two code samples for each vulnerability, one containing the vulnerability and one in which the vulnerability was fixed. We examined the effect of code complexity on the quality of static analysis results, including successful detection and false positive rates. Static analysis detected 63% of the format string vulnerabilities, with detection rates decreasing with increasing code complexity. When the tool failed to detect a bug, it was for one of two reasons: the absence of security rules specifying the vulnerable function or the presence of a bug in the static analysis tool. Complex code is more likely to contain complicated code constructs and obscure format string functions, resulting in lower detection rates.