Source Code Analysis Laboratory (SCALe)
Source Code Analysis Laboratory (SCALe)
复制标题
源代码分析实验室 (SCALe)
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
Jefferson Welch
中科院分区：
文献类型：
--
作者：
R. Seacord;Will Dormann;J. McCurley;Philip Miller;R. Stoddard;David Svoboda;Jefferson Welch
摘要：源代码分析实验室（SCALe）是一个概念验证演示，表明软件系统可以根据安全编码标准进行一致性测试。CERT的安全编码标准提供了导致常用软件开发语言漏洞的编码错误的详细列举。CERT项目（卡内基梅隆大学软件工程研究所的一部分）的SCALe团队分析开发人员的源代码，并提供详细的发现报告，以指导代码的修复。在开发人员解决了这些发现并且SCALe团队确定产品版本符合标准之后，CERT计划向开发人员颁发证书并将系统列在符合系统的注册表中。本报告详细介绍了SCALe过程，并对选定的软件系统进行了分析。
Abstract : The Source Code Analysis Laboratory (SCALe) is a proof-of-concept demonstration that software systems can be conformance tested against secure coding standards. CERT' secure coding standards provide a detailed enumeration of coding errors that have resulted in vulnerabilities for commonly used software development languages. The SCALe team at the CERT Program, part of Carnegie Mellon University's Software Engineering Institute, analyzes a developer's source code and provides a detailed report of findings to guide the code's repair. After the developer has addressed these findings and the SCALe team determines that the product version conforms to the standard, the CERT Program issues the developer a certificate and lists the system in a registry of conforming systems. This report details the SCALe process and provides an analysis of selected software systems.