A Static Analysis Platform for Investigating Security Trends in Repositories

TL;DR

This paper introduces a static analysis platform that integrates multiple tools with Git repositories, enabling continuous security monitoring, visualization of trends, and supporting machine learning applications for vulnerability detection.

Contribution

It presents an extensible framework that combines static analysis tools with version control to track security issues over time and visualize security hotspots.

Findings

Effective visualization of security trends and hotspots.

Supports large-scale data collection for machine learning.

Facilitates continuous security monitoring in software development.

Abstract

Static analysis tools come in many forms andconfigurations, allowing them to handle various tasks in a (secure) development process: code style linting, bug/vulnerability detection, verification, etc., and adapt to the specific requirements of a software project, thus reducing the number of false positives.The wide range of configuration options poses a hurdle in their use for software developers, as the tools cannot be deployed out-of-the-box. However, static analysis tools only develop their full benefit if they are integrated into the software development workflow and used on regular. Vulnerability management should be integrated via version history to identify hotspots, for example. We present an analysis platform that integrates several static analysis tools that enable Git-based repositories to continuously monitor warnings across their version history. The framework is easily extensible with other tools and programming languages. We provide a visualization component in the form of a dashboard to display security trends and hotspots. Our tool can also be used to create a database of security alerts at a scale well-suited for machine learning applications such as bug or vulnerability detection.