一种基于三维树模型的源代码安全缺陷分类方法.pdfVIP

Vol. 43 No. 5 计算机科学 第 43 卷第5 期 2016 年 5 月 Computer Science May 2016 一种基于三维树模型的源代码安全缺陷分类方法 张龚1.2 李舟军l 董国伟3 马殿富1 (北京航空航天大学计算机学院 北京 100191) 1 (湖北大学计算机与信息工程学院 武汉 430062)2 (中国信息安全测评中心 北京 100085)3 摘 要提出了一种基于三维树模型的源代码缺陷分类方法，该方法综合考虑了缺陷产生的原因、造成的结果及其表 现形式 3 方面的信息。实例分析结果表明:使用基于三维树模型的缺陷分类法得到的缺陷类别比 CWE 和 Fortify 中 的缺陷分类更为精确和详细。该工作不仅有助于建立一种比较完善的源代码缺陷分类体系，而且对于缺陷检测规则 的细化也具有实际的指导意义。 关键词 三维树模型，源代码，安全缺陷，分类法 中固法分类号 TP309 文献标t只码 A 回到 10. 11896/j. issn. 1002-137X. 2016. 5. 014 Novel Taxonomy of Security Weakness in Source Code Based on Three-dimension Tree Model l 2 l 3 l ZHANG Yan • LI Zhou-jun OONG Guσwei MA Dian-fu (School of Computer Science and Engineering. Beihang University. Beijing 100191.China) 1 (Sch∞1 of Computer Science and Information Engineering. Hubei University. Wuhan 430062.China)2 (China Information Technology Security Evaluation Center. Beijing 100085.China)3 Abstract We presented a novel taxonomy of security weakness in source code based on three-dimension tree model , which synthetically considers the three aspects: the causes of the defect , the results and its form of expression. Case studies show that compared with CWE and Fortify ,the taxonomy in this paper is more accurate and detailed. This paper is not only helpful to establish a kind of re!ative!y comp!ete source code defect classification system ,but a!so very signi- ficant in practice to refine the rules of the security weakness detect