Using Test Suites for Static Analysis Alert Classifiers
• Podcast
Publisher
Software Engineering Institute
Listen
Watch
Abstract
Static analysis tools used to identify potential vulnerabilities in source code produce a large number of alerts with high false-positive rates that engineers must painstakingly examine to find legitimate flaws. Researchers in the SEI’s CERT Division have developed the SCALe (Source Code Analysis Laboratory) tool to help analysts be more efficient and effective at auditing static analysis alerts. In this podcast, CERT researchers Lori Flynn and Zach Kurtz discuss ongoing research using test suites as a source of labeled training data to create classifiers for static analysis alerts.
About the Speaker
Lori Flynn
Lori Flynn is a Software Security Engineer at CERT, in the Software Engineering Institute of Carnegie Mellon University. Flynn's ongoing work includes the development of new secure coding rules and composable static analysis of apps to check for compliance with data flow rules on Android platforms. Past experience includes network …
Read more
Zachary Kurtz
Dr. Zach Kurtz is an SEI alumni employee.
Dr. Zach Kurtz is a data scientist with experience on projects in fields as diverse as cybersecurity, public transit, psychology, marketing analytics, ecology, medicine, human rights, and international capital flows. Kurtz’s dissertation built on capture-recapture theory to introduce a new method for …
Read more