火龙果软件-漏洞发掘技术趋势—贾春福.pptVIP

* Vulnerability Identification Identification Identify Violations of Security Specification and Verify Software’s Security Properties. Security Specification Test cases * Vulnerability Identification—Static Analysis Static analysis checks violations of security specification from the program text. Comprehensive: cover entire codes Lightweight: test cases are not required and no need to guess or interpret software’s behavior. * Vulnerability Identification—Static Analysis Examples of Static Analysis Tools FindBugs (Java) PMD (Java) FxCop(.NET) XSSDetect (.NET) * Vulnerability Identification—S