IMPROVING SOFTWARE SECURITY USING STATIC AND RUNTIME ANALYSIS
ABSTRACT
Static analysis can detect a variety of defects and weaknesses in system source codes even before the code is ready to run. Runtime analysis on the other hand, looks at running software to detect problems as these occur, usually through sophisticated instrumentation. Static analysis prevents problems from entering the main code stream and ensures that any new code is up to standard. Static analysis tools can uncover security vulnerabilities, logic errors, implementation defects, and other problems, both at developer’s desktop and at system build time. Runtime analysis can be performed during module development and system integration to catch any problem missed by static analysis. In this research work, Vulnerability analysis was performed on some developed source codes with some security vulnerabilities. The analysis report supports the fact that one can expect certain number of false alarm in all vulnerability analysis tools. This research work therefore focuses on finding out a mathematical model on how to determine the probability of detection and the probability of false alarm for a given analysis tool. This information will guide the users of the tool to determine the authenticity of the detected bug. It will also help the developers to access and improve the performance of the analysis tool.