A Novel Java Source Code Security Analysis System

In the modern software industry where large and complex software are developed and deployed, security is becoming one of the most critical factors that assess the software's quality. However, due to the educational lack of information security and unintentional code flaws of source code implementors, lots of security related vulnerabilities are buried deep in the source code and can not be detected by conventional source code quality assurance methodology. On the other hand, manual check of security loopholes is obviously far from efficient and accurate when the size of the source code reaches tens of thousands of lines or even more. So the needs for automatic source code security analysis tools are urgent.In the thesis we propose a novel system that automatically analyzes Java source code security vulnerabilities and provide modification guidance. The system employs efficient data flow and control flow analysis techniques and uses a systematic approach for recognizing security loopholes. The author's main work includes:1) Make major modification upon open source tool, ANTLR, to accelerate Java syntax parsing. In this paper, a symbol table data structure is added to ANTLR to increase the efficiency of flow processing; new functions are also added to support Java 1.5 features.2) Propose a scalable approach based on xml for maintaining vulnerabilities' rule database. We summarize a few loophole style types according to Java language characteristics; we also designed the format and constraint of each rule. In the system, an up to 150-entry rule set is carefully devised and more user-defined rules can be conveniently added.3) Design and implement the source code security system. In this thesis the system architecture, main algorithms, primary data structures and processing flow are explained detailedly.4) By Scanning the source code of webgoat5.1 and samate-java, the test result shows that not only the running speed of the system is fast, but also it can achieve quite high scanning accuracy. Both the false positive and false negative rate is below 20%.