CN104008057A - Code safety evaluating method based on defect analysis - Google Patents

Abstract

The invention provides a code safety evaluating method based on defect analysis. The code safety evaluating method comprises the step 1 of acquiring the threat degree DW of code debt WA, the step 2 of constructing a code debt library, the step 3 of carrying out quantitative analysis on codes, and the step 4 of acquiring the safety values TA of the codes. Compared with the prior art, the code safety evaluating method based on the defect analysis can comprehensively quantize and evaluate code safety from code debt writing generation, code debt writing prevention and results of writing personnel quality in code environment coefficients EVA. Thus, the accuracy of code safety evaluation is improved, code safety is improved, and the whole safety of application systems is enhanced.

Description

A kind of code safety evaluation method based on defect analysis

Technical field

The present invention relates to a kind of code safety evaluation method, be specifically related to a kind of code safety evaluation method based on defect analysis.

Background technology

Along with going deep into gradually of informatization, information security is attacked trend variation has also been occurred, and changes to attacking application system from attacking system and network in the past.Add up according to internal authority advisory organization Gartner, current 75% information security is attacked and is all occurred in application system aspect and not in System and Network aspect, and in network, common attack is attacked development gradually by traditional system vulnerability and developed into the attack to applying self weakness.Wherein, the weakness of application system self and defect are mainly because developer does not notice that the safety of writing code causes in the time encoding.

Because kind and the function of application system are more and more various, cause its code size also increasing, the security of code becomes the safety issue becoming increasingly conspicuous.The instrument in prior art, code safety being detected is more the detection that code is existed to how many defects, the security of whole code is not assessed, for example: although Fortify code security testing tool can be pointed out out the safe class of code, it only comprises high, normal, basic three kinds of safe classes.

Simultaneously different code security Study of Defects tissues, as CWE, Nist, OWASP etc., to the describing method difference of code security defect, do not have unified code security defect classification method, thereby increased the complexity and difficulties of the safety evaluation of application system overall code.

Therefore, in order to improve existing code safety evaluation method, evaluate too extensively for code safety, the limitation that the evaluation factor of introduction too lacks, provides a kind of code safety evaluation method to seem particularly important.

Summary of the invention

In order to meet the needs of prior art, the invention provides a kind of code safety evaluation method based on defect analysis, described method comprises the steps:

Step 1: the threaten degree DW that obtains code defect WA;

Step 2: build code defect storehouse;

Step 3: code is carried out to quantitative analysis;

Step 4: the security value T that obtains described code _a.

Preferably, according to code classification of defects, code defect threaten degree attribute Damage is set, thereby obtains described threaten degree DW; Described code defect WA={A ₁, A ₂... A _i... A _n; Described threaten degree DW={D ₁, D ₂... D _i... D _n; Corresponding one by one between described threaten degree DW and described code defect WA;

Preferably, set up code classification of defects by Fortify, comprise serious risk class defect Critical, excessive risk class defect Hight, risk class defect Medium and low-risk class defect Low;

Preferably, build code defect storehouse according to described threaten degree DW and artificial affecting indices P EA;

The influence value of the described artificial affecting indices P EA processing mode that to be programming personnel adopt described code defect to described threaten degree DW; Described artificial affecting indices P EA={PEA ₁, PEA ₂... PEA _i... PEA _n; Corresponding one by one between described artificial affecting indices P EA and described code defect WA;

Preferably, the size of code fractional analysis in described step 3 comprises:

Step 3-1: the quantitative value C that obtains described serious risk class defect Critical _n, described excessive risk class defect Hight quantitative value H _n, described risk class defect Medium quantitative value M _nquantitative value L with described low-risk class defect Low _n;

Step 3-2: by described threaten degree DW, described artificial affecting indices P EA, described quantitative value C _n, described quantitative value H _n, described quantitative value M _nwith described quantitative value L _ncalculate respectively the threat quantized value T of described serious risk class defect Critcal _c, described excessive risk class defect Hight threat quantized value T _h, described risk class defect Medium threat quantized value T _mthreat quantized value T with described low-risk class defect Low _l;

$T_C=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{C_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

$T_H=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{H_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

$T_M=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{M_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

wherein α, β are the coefficient that impact threatens quantized value general trend;

Preferably, in described step 4, obtain the security value T of code _acomprise:

Step 4-1: obtain described programming personnel's influence coefficient PT; Described wherein, described WT _ifor programming personnel's working time, described WQ _ifor programming personnel's work qualification, described N are programming personnel's sum;

Step 4-2: obtain described code context coefficient EVA; Described wherein, described ET is that executable code line number, described VT are that valid code line number, described FT are that the sum of Function function, described CT are the sum of Class class;

Step 4-3: by described threat quantized value T _c, threaten quantized value T _h, threaten quantized value T _m, low threat quantized value T _lcalculate described security value with code context coefficient EVA

Compared with immediate prior art, excellent effect of the present invention is:

1,, in technical solution of the present invention, building code defect storehouse can better classify code defect, objective appraisal code safety more;

2,, in technical solution of the present invention, the processing mode that adopts artificial affecting indices P EA programming personnel can be adopted code defect adds code safety to the influence value of threaten degree DW;

3,, in technical solution of the present invention, adopt code context coefficient EVA in code safety, to add its impact of code size factor pair evaluating;

4,, in technical solution of the present invention, adopt programming personnel influence coefficient PT in code safety, to add its impact of programming personnel's working time and work qualification factor pair evaluating;

5, a kind of code safety evaluation method based on defect analysis provided by the invention, can be comprehensively from code defect is write generation, the result of writing the writer's quality prevention and code context coefficient EVA is carried out quantitative evaluation code security; Thereby improve the overall security of the degree of accuracy of code safety evaluation and the security enhancing application system of code.

Brief description of the drawings

Below in conjunction with accompanying drawing, the present invention is further described.

Fig. 1 is: a kind of code safety evaluation method process flow diagram based on defect analysis in the embodiment of the present invention.

Embodiment

Describe embodiments of the invention below in detail, the example of described embodiment is shown in the drawings, and wherein same or similar label represents same or similar element or has the element of identical or similar functions from start to finish.Be exemplary below by the embodiment being described with reference to the drawings, be intended to for explaining the present invention, and can not be interpreted as limitation of the present invention.

A kind of code safety evaluation method based on defect analysis provided by the invention, concrete steps as shown in Figure 1:

Step 1: the threaten degree DW that obtains code defect WA:

1.: set up code classification of defects by Fortify, comprise serious risk class defect Critical, excessive risk class defect Hight, risk class defect Medium and low-risk class defect Low;

Code classification of defects: AttributeSet={Critical, Hight, Medium, Low};

Code classification of defects collection: AttributeSets={CriticalWSet, HightWSet, MediumWSet, LowWSet}; .

2.: according to code classification of defects, code defect threaten degree attribute Damage is set, thereby obtains threaten degree DW; Code defect WA={A ₁, A ₂... A _i... A _n; Threaten degree DW={D ₁, D ₂... D _i... D _n; Corresponding one by one between threaten degree DW and code defect WA; In the present embodiment, the value of threaten degree DW is as shown in the table:

Step 2: build code defect storehouse;

1.: set artificial affecting indices P EA: described PEA is the influence value of programming personnel's processing mode that code defect WA is adopted to threaten degree DW; Described PEA={PEA ₁, PEA ₂... PEA _i... PEA _nwith code defect WA between corresponding one by one; The obtaining value method of described setting artificial affecting indices P EA is as shown in the table:

Kind	Artificial affecting indices P EA
		Code defect is not modified	1
Code defect is modified, but not exclusively	2
		Code defect is rectified and improved completely	3

2.: build code defect storehouse according to threaten degree DW and artificial affecting indices P EA.

Step 3: code is carried out to quantitative analysis:

1.: the quantitative value C that obtains serious risk class defect Critical _n, excessive risk class defect Hight quantitative value H _n, risk class defect Medium quantitative value M _nquantitative value L with low-risk class defect Low _n;

2.: by threaten degree DW, artificial affecting indices P EA, quantitative value C _n, quantitative value H _n, quantitative value M _nwith quantitative value L _ncalculate respectively:

The threat quantized value of serious risk class defect Critical

The threat quantized value of excessive risk class defect Hight

The threat quantized value of risk class defect Medium

The threat quantized value of low-risk class defect Low

Wherein α, β are the coefficient that impact threatens quantized value general trend, in process of the test, and can be by regulating the numerical value adjustment of α, β to threaten the precision of quantized value operation result.

Step 4: the security value T that obtains code _a;

1.: by the total FT of executable code line number ET, valid code line number VT, Function function, total CT and programming personnel's influence coefficient PT Accounting Legend Code environmental coefficient EVA of Class class,

Wherein, the numerical value of described PT is calculated by programming personnel's working time WT and work qualification WQ, $\mathrm{PT}({\mathrm{\Σ}}_{i=1}^N{\mathrm{WT}}_i*{\mathrm{WQ}}_i)/N;$ Wherein N is programming personnel's sum.

In the present embodiment, the obtaining value method of programming personnel's influence coefficient PT is as shown in the table:

Working time (year)	WT	Work qualification	WQ
				0-3	0.1	≤ company	0.1
3-5	0.3	City-level	0.3
				5-8	0.5	Provincial	0.5
8-10	0.8	National	0.8
				More than 10	1	>=international	1

2.: by threatening quantized value T _c, threaten quantized value T _h, threaten quantized value T _m, low threat quantized value T _lwith code context coefficient EVA computational security value T _a,

Finally should be noted that: described embodiment is only some embodiments of the present application, instead of whole embodiment.Based on the embodiment in the application, those of ordinary skill in the art are not making the every other embodiment obtaining under creative work prerequisite, all belong to the scope of the application's protection.

Claims (6)

1. the code safety evaluation method based on defect analysis, is characterized in that, described method comprises the steps:

Step 1: the threaten degree DW that obtains code defect WA;

Step 2: build code defect storehouse;

Step 3: code is carried out to quantitative analysis;

Step 4: the security value TA that obtains described code.

2. a kind of code safety evaluation method based on defect analysis as claimed in claim 1, is characterized in that, according to code classification of defects, code defect threaten degree attribute Damage is set, thereby obtains described threaten degree DW; Described code defect WA={A ₁, A ₂... A _i... A _n; Described threaten degree DW={D ₁, D ₂... D _i... D _n; Corresponding one by one between described threaten degree DW and described code defect WA.

3. a kind of code safety evaluation method based on defect analysis as claimed in claim 1, it is characterized in that, set up code classification of defects by Fortify, comprise serious risk class defect Critical, excessive risk class defect Hight, risk class defect Medium and low-risk class defect Low.

4. a kind of code safety evaluation method based on defect analysis as claimed in claim 1, is characterized in that, builds code defect storehouse according to described threaten degree DW and artificial affecting indices P EA;

The influence value of the described artificial affecting indices P EA processing mode that to be programming personnel adopt described code defect to described threaten degree DW; Described artificial affecting indices P EA={PEA ₁, PEA ₂... PEA _i... PEA _n; Corresponding one by one between described artificial affecting indices P EA and described code defect WA.

5. a kind of code safety evaluation method based on defect analysis as claimed in claim 1, is characterized in that, the size of code fractional analysis in described step 3 comprises:

Step 3-1: the quantitative value C that obtains described serious risk class defect Critical _n, described excessive risk class defect Hight quantitative value H _n, described risk class defect Medium quantitative value M _nquantitative value L with described low-risk class defect Low _n;

Step 3-2: by described threaten degree DW, described artificial affecting indices P EA, described quantitative value C _n, described quantitative value H _n, described quantitative value M _nwith described quantitative value L _ncalculate respectively the threat quantized value T of described serious risk class defect Critical _c, described excessive risk class defect Hight threat quantized value T _h, described risk class defect Medium threat quantized value T _mthreat quantized value T with described low-risk class defect Low _l;

$T_C=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{C_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

$T_H=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{H_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

$T_M=\mathrm{\αEXP}\{{\mathrm{\Σ}}_{i=0}^{M_N}\frac{D_i}{{\mathrm{PEA}}_i}/\mathrm{\β}\};$

wherein α, β are the coefficient that impact threatens quantized value general trend.

6. a kind of code safety evaluation method based on defect analysis as claimed in claim 1, is characterized in that, obtains the security value T of code in described step 4 _acomprise:

Step 4-1: obtain described programming personnel's influence coefficient PT; Described wherein, described WT _ifor programming personnel's working time, described WQ _ifor programming personnel's work qualification, described N are programming personnel's sum;

Step 4-2: obtain described code context coefficient EVA; Described wherein, described ET is that executable code line number, described VT are that valid code line number, described FT are that the sum of Function function, described CT are the sum of Class class;

Step 4-3: by described threat quantized value T _c, threaten quantized value T _h, threaten quantized value T _m, low threat quantized value T _lcalculate described security value with code context coefficient EVA