A Code Security Evaluation Method Based on Defect Analysis

Abstract

The invention provides a code safety evaluating method based on defect analysis. The code safety evaluating method comprises the step 1 of acquiring the threat degree DW of code debt WA, the step 2 of constructing a code debt library, the step 3 of carrying out quantitative analysis on codes, and the step 4 of acquiring the safety values TA of the codes. Compared with the prior art, the code safety evaluating method based on the defect analysis can comprehensively quantize and evaluate code safety from code debt writing generation, code debt writing prevention and results of writing personnel quality in code environment coefficients EVA. Thus, the accuracy of code safety evaluation is improved, code safety is improved, and the whole safety of application systems is enhanced.

Description

technical field [0001] The invention relates to a code security evaluation method, in particular to a code security evaluation method based on defect analysis. Background technique [0002] With the gradual deepening of informatization construction, the trend of information security attacks has also changed, from attacking systems and networks in the past to attacking application systems. According to the statistics of Gartner, an international authoritative consulting organization, 75% of information security attacks currently occur at the application system level rather than at the system and network levels. Common attacks in the network have gradually evolved from traditional system vulnerability attacks to attacks on the application's own weaknesses. attack. Among them, the weaknesses and defects of the application system itself are mainly caused by developers not paying attention to the safety of writing codes when coding. [0003] As the types and functions of applic...

AI Technical Summary

Problems solved by technology

The tools for detecting code security in the prior art are more about detecting the number of defects in the code, and do not evaluate the security of the entire code. For example, although the Fortify code security detection tool can prompt the security level of the code , but it only includes three security levels of high, medium and low

[0004] At the same time, different code security defect research organizations, such as CWE, Nist, OWASP, etc., have different description methods for code security defects, and there is no unified code security defect classification method, which increases the complexity of the overall code security assessment of the application system and difficulty

[0005] Therefore, in order to improve the existing code security evaluation method, it is particularly important to provide a code security evaluation method due to the limitations that the evaluation of code security is too generalized and the evaluation factors introduced are too lacking.

Images