The SEI Source Code Analysis Integrated Framework Environment (SCAIFE) is a modular architecture designed to enable a wide variety of tools, systems, and users to use artificial intelligence (AI) classifiers …

December 14, 2020 • By Lori Flynn

This blog post describes a new repository of labeled data that CERT is making publicly available for many code-flaw conditions. Researchers can use this dataset along with the associated code …

November 2, 2020 • By Lori Flynn

In Secure Development

Static analysis tools analyze code without executing it to identify potential flaws in source code. Since alerts may be false positives, engineers must painstakingly examine them to adjudicate if they …

September 14, 2020 • By Lori Flynn

In this post, we describe the Source Code Analysis Integrated Framework Environment (SCAIFE) application programming interface (API). SCAIFE is an architecture for classifying and prioritizing static analysis alerts.

July 21, 2019 • By Lori Flynn, Ebonie McNeil

In Secure Development

Static analysis tools analyze code without executing it, to identify potential flaws in source code. These tools produce a large number of alerts with high false-positive rates that an engineer …

December 16, 2018 • By Lori Flynn, Ebonie McNeil

In Secure Development

Experience shows that most software contains code flaws that can lead to vulnerabilities. Static analysis tools used to identify potential vulnerabilities in source code produce....

September 23, 2018 • By Lori Flynn

In Secure Development

Numerous tools exists to help detect flaws in code. Some of these are called flaw-finding static analysis (FFSA) tools because they identify flaws by analyzing code without running it....

April 29, 2018 • By Lori Flynn, Zachary Kurtz

In Secure Development

Exfiltration of sensitive data on mobile devices is a major concern for the DoD, other organizations, and individuals. Colluding apps in public use have been discovered by security researchers. The …

November 19, 2017 • By Lori Flynn, Will Klieber

Federal agencies and other organizations face an overwhelming security landscape. The arsenal available to these organizations for securing software includes static analysis tools, which search code for flaws, including those …

January 22, 2017 • By Lori Flynn

In Secure Development

In 2015, the National Vulnerability Database (NVD) recorded 6,488 new software vulnerabilities, and the NVD documents a total of 74,885 software vulnerabilities discovered between 1988-2016. Static analysis tools examine code …

June 5, 2016 • By Lori Flynn

In Secure Development