Static code testing method and device, equipment, storage medium and product

Abstract

The invention discloses a static code testing method and device, equipment, a storage medium and a product, and relates to the technical field of software security development, and the method comprises the steps: setting thresholds corresponding to monitoring indexes such as a false alarm rate index, a defect density index and an assembly line security node passing rate index, detecting the actual false alarm rate of the static code test tool to obtain the actual tool false alarm rate; monitoring the actual defect density and the actual pipeline safety node passing rate of the preset static code to obtain an actual code monitoring result; and comparing the actual tool false alarm rate and the actual code monitoring result with a threshold value corresponding to the monitoring index to obtain a static code test result. According to the method, the test tool and the static code are tested by presetting the monitoring indexes such as the false alarm rate, the defect density and the passing rate, so that a developer is prevented from consuming a large amount of time for testing, the test efficiency is improved, and the tool detection capability and the safety level of the tested static code are continuously improved.

Description

Technical Field

[0001] The present application relates to the field of software security development technology, and in particular to a static code testing method, device, equipment, storage medium and product. Background Art

[0002] Existing static code scanning tools do not have technical indicators for continuous detection of tool false positives and the overall security level of the tested software, and cannot achieve continuous improvement of tool detection capabilities and the security level of the tested software. Existing static code scanning tools lack technical indicators for continuous detection of false positives. Developers need to spend a lot of time to troubleshoot false positives each time, and use tool configuration and rule optimization to tune the tool to reduce false positives. Existing tools lack technical indicators for continuous detection of the security level of the tested software. Managers cannot grasp the overall security status of the source code of the tested software. It is difficult to make targeted improvements. Without continuous monitoring, it is difficult to achieve continuous improvement of software security. Summary of the invention

[0003] The main purpose of this application is to provide a static code testing method, device, equipment, storage medium and product, aiming to solve the technical problem that existing static code scanning tools are unable to continuously detect the false alarm rate of the tool and the overall security level of the tested software.

[0004] To achieve the above objectives, the present application proposes a static code testing method, the method comprising: Setting thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; Test the actual false alarm rate of static code testing tools to obtain the actual false alarm rate of the tools; Monitor the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring results; The actual tool false alarm rate and the actual code monitoring result are compared with the threshold value corresponding to the monitoring indicator to obtain a static code test result.

[0005] In one embodiment, the false alarm rate index includes the overall false alarm rate of the static code testing tool and the false alarm rate of each detection rule in the static code testing tool; the defect density index includes the enterprise defect density, the group defect density and the project defect density; the pipeline safety node pass rate index includes the enterprise pipeline safety node pass rate, the group pipeline safety node pass rate and the project pipeline safety node pass rate.

[0006] In one embodiment, the actual tool false alarm rate includes an actual overall false alarm rate and an actual false alarm rate of each detection rule; The step of detecting the actual false alarm rate of the static code testing tool to obtain the actual false alarm rate of the tool includes: Perform false positive rate detection on static code testing tools in the overall dimension and in each detection rule dimension; Collect the number of false positive defects marked by static code testing tools in the overall dimension to obtain the actual overall false positive rate; Collect the number of false positive defects marked by the static code testing tool in each detection rule dimension to obtain the actual false positive rate of each detection rule.

[0007] In one embodiment, the actual code monitoring result includes an actual defect density, and the actual defect density includes an actual enterprise defect density, an actual team defect density, and an actual project defect density; The step of monitoring the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result includes: Monitor the defect density of preset static codes in the enterprise, group and project dimensions to obtain the actual defect density; Collecting the number of enterprise defects and the number of project code lines of preset static codes in the enterprise dimension, and determining the actual enterprise defect density according to the number of enterprise defects and the number of project code lines; Collect the number of group defects of preset static codes in the group dimension, and determine the actual group defect density according to the number of group defects and the number of project code lines; The number of project defects of preset static codes in the project dimension is collected, and the actual project defect density is determined according to the number of project defects and the number of project code lines.

[0008] In one embodiment, the actual code monitoring result also includes an actual pipeline safety node pass rate, and the actual pipeline safety node pass rate includes an actual enterprise pipeline safety node pass rate, an actual group pipeline safety node pass rate, and an actual project pipeline safety node pass rate; The step of monitoring the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result includes: Monitor the pass rate of preset static codes in the enterprise, group and project dimensions to obtain the actual pass rate of pipeline security nodes; Collect the number of enterprise pipeline triggers and the number of enterprise security checkpoints passed by the preset static code in the enterprise dimension, and determine the actual enterprise pipeline security node pass rate according to the number of enterprise pipeline triggers and the number of enterprise security checkpoints passed; Collect the number of group pipeline triggers and the number of group security checkpoints passed by the preset static code in the group dimension, and determine the actual group pipeline security node pass rate according to the number of group pipeline triggers and the number of group security checkpoints passed; The number of project pipeline triggering times and the number of times the preset static code passes the project security checkpoints in the project dimension are collected, and the actual project pipeline security node pass rate is determined based on the number of project pipeline triggering times and the number of times the project security checkpoints are passed.

[0009] In one embodiment, after the step of comparing the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain the static code test result, the step further includes: When the actual tool false alarm rate exceeds the false alarm rate indicator, optimizing each detection rule in the static code testing tool; Searching for user-defined security filtering functions and functions that meet preset security conditions in the preset static code, configuring a function whitelist according to the security filtering functions and the functions that meet the preset security conditions, and adding the function whitelist to the static code testing tool; When the actual defect density and / or the actual pipeline safety node pass rate in the actual code monitoring results do not reach the defect density index and / or the pipeline safety node pass rate index, the static code test results are fed back to the coders to enable them to improve the coding standardization.

[0010] In addition, to achieve the above purpose, the present application also proposes a static code testing device, the static code testing device comprising: A monitoring indicator setting module, used to set thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; A test tool detection module is used to detect the actual false alarm rate of the static code test tool and obtain the actual tool false alarm rate; The static code monitoring module is used to monitor the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring results; The test result comparison module is used to compare the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain the static code test result.

[0011] In addition, to achieve the above objectives, the present application also proposes a static code testing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the static code testing method described above.

[0012] In addition, to achieve the above objectives, the present application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the static code testing method described above are implemented.

[0013] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the static code testing method described above are implemented.

[0014] The present application provides a static code testing method, which detects the actual false alarm rate of the static code testing tool by setting thresholds corresponding to monitoring indicators such as false alarm rate indicators, defect density indicators, and pipeline safety node pass rate indicators to obtain the actual tool false alarm rate; monitors the actual defect density and actual pipeline safety node pass rate of the preset static code to obtain the actual code monitoring result; compares the actual tool false alarm rate and the actual code monitoring result with the threshold corresponding to the monitoring indicator to obtain the static code test result. The present application sets the monitoring indicators in advance, then tests the test tool and the static code, and then compares the actual detection results with the thresholds corresponding to the monitoring indicators, thereby avoiding developers from spending a lot of time on testing, improving the testing efficiency, and further achieving continuous improvement in the tool detection capability and the security level of the tested static code. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0017] Figure 1 A schematic diagram of a flow chart provided for the first embodiment of the static code testing method of the present application; Figure 2 A schematic diagram of the process flow provided for the second embodiment of the static code testing method of the present application; Figure 3 A flowchart of the third embodiment of the static code testing method of the present application is provided; Figure 4 This is a schematic diagram of the module structure of the static code testing device according to an embodiment of the present application; Figure 5This is a schematic diagram of the device structure of the hardware operating environment involved in the static code testing method in the embodiment of the present application.

[0018] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0019] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0020] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0021] The main solution of the embodiment of the present application is: setting thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; detecting the actual false alarm rate of the static code testing tool to obtain the actual tool false alarm rate; monitoring the actual defect density and the actual pipeline safety node pass rate of the preset static code to obtain the actual code monitoring result; comparing the actual tool false alarm rate and the actual code monitoring result with the thresholds corresponding to the monitoring indicators to obtain the static code test result.

[0022] Since existing static code scanning tools do not have technical indicators for continuous detection of tool false positives and the overall security level of the tested software, it is impossible to achieve continuous improvement in tool detection capabilities and the security level of the tested software. Existing static code scanning tools lack technical indicators for continuous detection of false positives. Developers need to spend a lot of time to troubleshoot false positives each time, and use tool configuration and rule optimization to tune the tool to reduce false positives. Existing tools lack technical indicators for continuous detection of the security level of the tested software. Managers cannot grasp the overall security status of the source code of the tested software. It is difficult to make targeted improvements. Without continuous monitoring, it is difficult to achieve continuous improvement of software security.

[0023] The present application provides a solution, by setting thresholds corresponding to monitoring indicators such as false alarm rate index, defect density index and pipeline safety node pass rate index, the actual false alarm rate of the static code testing tool is detected to obtain the actual tool false alarm rate; the actual defect density and the actual pipeline safety node pass rate of the preset static code are monitored to obtain the actual code monitoring result; the actual tool false alarm rate and the actual code monitoring result are compared with the thresholds corresponding to the monitoring indicators to obtain the static code test result. This embodiment pre-sets the monitoring indicators, then tests the test tool and the static code, and then compares the actual detection results with the thresholds corresponding to the monitoring indicators, thereby avoiding developers from spending a lot of time on testing, improving the testing efficiency, and further achieving continuous improvement of the tool detection capability and the security level of the tested static code.

[0024] It should be noted that the execution subject of the method of this embodiment can be a computing service device with static code testing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc.; it can also be a static code testing device with the same or similar functions. This embodiment and the following embodiments will be described by taking the static code testing device as an example.

[0025] Based on this, the present application embodiment provides a static code testing method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the static code testing method of the present application.

[0026] In this embodiment, the static code testing method includes steps S10 to S40: Step S10, setting thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator.

[0027] It should be noted that the present application relates to the static code analysis stage in software development, specifically to improving the value of static code analysis tools through a continuous improvement based on PDCA. Existing static code scanning tools do not have technical indicators for continuous detection of the tool's false alarm rate and the overall security level of the software under test, resulting in developers being unable to understand the effect of tool tuning, and managers also having difficulty in grasping the overall security status of the source code of the software under test, making it impossible to achieve continuous improvement in tool detection capabilities and the security level of the software under test. In this embodiment, the Plan-Do-Check-Act (PDCA) continuous improvement concept is applied to static code scanning tools to improve the tool's detection capabilities and improve the quality of the software under test.

[0028] It is understandable that this embodiment adds a monitoring indicator setting module, a test tool detection module, a static code monitoring module and a test result comparison module on the basis of the original static code analysis tool. Among them, the monitoring indicator setting module supports the configuration of indicators corresponding to the improvement plan, including false alarm rate indicators, defect density indicators and pipeline safety node pass rate indicators. Through the monitoring indicator setting module, you can set the threshold corresponding to any improvement indicator, for example, set the overall false alarm rate of the tool ≤30%, the false alarm rate of the SQL injection detection rule ≤20%, and the project defect density ≤0.3‰, etc.

[0029] In a feasible implementation, the false alarm rate index includes the overall false alarm rate of the static code testing tool and the false alarm rate of each detection rule in the static code testing tool; the defect density index includes the enterprise defect density, the group defect density and the project defect density; the pipeline safety node pass rate index includes the enterprise pipeline safety node pass rate, the group pipeline safety node pass rate and the project pipeline safety node pass rate.

[0030] Here, each monitoring indicator is divided in detail. The false alarm rate indicator includes the overall false alarm rate of the static code testing tool and the false alarm rate of each detection rule in the static code testing tool; the defect density indicator includes the enterprise defect density, group defect density and project defect density; the pipeline safety node pass rate indicator includes the enterprise pipeline safety node pass rate, group pipeline safety node pass rate and project pipeline safety node pass rate.

[0031] Through the false alarm rate indicators of the above dimensions, the test tools can be continuously tested to reduce the false alarm troubleshooting time of developers, and the false alarms of the tools can be reduced through tuning methods such as tool configuration and rule optimization. The tool tuning effect is achieved based on the indicators of continuous detection of false alarm rates. Developers can comprehensively and accurately grasp the overall security status of the source code of the tested software through the above multi-dimensional defect density and multi-dimensional pipeline security node pass rate, and continuously monitor the indicators to achieve targeted improvements and continuous improvement of software security.

[0032] Step S20, detecting the actual false alarm rate of the static code testing tool to obtain the actual tool false alarm rate.

[0033] It is understandable that the actual false alarm rate of the static code testing tool can be detected through the testing tool detection module, specifically by collecting the number of false alarm defects marked in each dimension of the tool, so as to calculate the actual tool false alarm rate of each dimension, which is then used for subsequent comparison with the threshold value corresponding to the monitoring indicator in the monitoring indicator setting module to calculate the difference.

[0034] Step S30, monitoring the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result.

[0035] It should be understood that the overall security level of the project under test can be monitored through the static code monitoring module, specifically by collecting the defect density of each dimension in the static code of the project to be tested and the pass rate of the pipeline security nodes in each dimension, so that developers can fully grasp the overall security status of the source code of the software under test.

[0036] It is understandable that defect density is used to quantify the error rate of software code, thereby helping to evaluate the quality of software code. In the field of security management, it can be used to pay special attention to security defects, which can help developers understand the distribution of code problems and improve the development process. The pipeline safety node pass rate is the probability of passing the safety checkpoint after the pipeline is triggered.

[0037] Step S40, comparing the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain a static code test result.

[0038] It is understandable that the test result comparison module can be used to compare the actual monitored data with the thresholds corresponding to the monitoring indicators, and the comparison results and gap analysis can be presented in the form of dashboards, charts, etc., as well as whether the set improvement indicators have been achieved. The developed security status monitoring tools and the security status dashboards provided to managers enable security issues to be discovered in a timely manner and targeted measures to be taken, which is conducive to the continuous improvement of software quality.

[0039] The present embodiment provides a static code testing method, which detects the actual false alarm rate of the static code testing tool by setting thresholds corresponding to monitoring indicators such as the false alarm rate index, the defect density index, and the pipeline safety node pass rate index to obtain the actual tool false alarm rate; monitors the actual defect density and the actual pipeline safety node pass rate of the preset static code to obtain the actual code monitoring result; compares the actual tool false alarm rate and the actual code monitoring result with the thresholds corresponding to the monitoring indicators to obtain the static code test result. The present embodiment sets the monitoring indicators in advance, then tests the test tool and the static code, and then compares the actual detection results with the thresholds corresponding to the monitoring indicators, thereby avoiding developers from spending a lot of time on testing, improving the testing efficiency, and further achieving continuous improvement in the tool detection capability and the security level of the tested static code.

[0040] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2, the actual tool false alarm rate includes the actual overall false alarm rate and the actual false alarm rate of each detection rule; step S20, the static code testing method also includes steps S201~S203: Step S201 , performing false alarm rate detection on the static code testing tool in the overall dimension and in each detection rule dimension.

[0041] It can be understood that the static code testing tool tests the code by setting multiple detection rules. Therefore, in this embodiment, the false alarm rate of the static code testing tool can be detected in the overall dimension and the dimensions of each detection rule, so as to achieve a more comprehensive false alarm rate of the detection tool.

[0042] Step S202, collecting the number of defects marked as false positives by the static code testing tool in the overall dimension to obtain an actual overall false positive rate.

[0043] It should be understood that the actual overall false alarm rate corresponding to the overall dimension can be calculated by collecting the number of defects marked as false alarms by the static code testing tool in the overall dimension through the testing tool detection module.

[0044] Step S203, collecting the number of defects marked as false positives by the static code testing tool in each detection rule dimension, and obtaining the actual false positive rate of each detection rule.

[0045] It should be understood that the testing tool detection module can collect the number of defects marked as false positives by the static code testing tool in each detection rule dimension to obtain the actual false positive rate of each detection rule.

[0046] In a feasible implementation, the actual code monitoring result includes an actual defect density, and the actual defect density includes an actual enterprise defect density, an actual team defect density, and an actual project defect density; step S30 may include steps S301 to S304: Step S301 , monitoring the defect density of the preset static code in the enterprise dimension, the team dimension and the project dimension to obtain the actual defect density.

[0047] It should be noted that, in order to more comprehensively and meticulously grasp the overall security status of the source code of the tested software, in this embodiment, defect density monitoring is performed from multiple dimensions to obtain the actual defect density, including enterprise dimension, group dimension and project dimension, where a group can be different departments or groups and other units administratively divided in an enterprise, and a project can be a specific project developed by different groups in the enterprise. A group can develop multiple projects, and a project can also be developed by multiple groups.

[0048] Step S302 , collecting the number of enterprise defects and the number of project code lines of preset static codes in the enterprise dimension, and determining the actual enterprise defect density according to the number of enterprise defects and the number of project code lines.

[0049] It is understandable that defect density can be calculated by the number of defects and the number of lines of code, which can help developers understand the distribution of code problems. For example, with 1,000 lines of code (KLOC, i.e., 1,000 lines of code) as the denominator, the calculation formula is: Security defect density = (number of security defects / number of valid lines of code) * 1,000. Here, in order to obtain more accurate results, the statistics of the number of valid lines of code can exclude blank lines, comments, and document strings, etc. Therefore, the actual enterprise defect density can be obtained by dividing the number of collected enterprise defects by the number of project code lines and multiplying it by 1,000, where the number of project code lines is the number of valid code lines in the project where the preset static code is located.

[0050] Step S303, collecting the number of group defects of the preset static code in the group dimension, and determining the actual group defect density according to the number of group defects and the number of project code lines.

[0051] Similarly, we can collect the actual number of defects detected by static code in the group dimension of the preset static code (excluding the number of defects marked as false positives), and then multiply the quotient of the collected number of group defects divided by the number of project code lines by 1000 to obtain the actual group defect density.

[0052] Step S304 , collecting the number of project defects of preset static codes in the project dimension, and determining the actual project defect density according to the number of project defects and the number of project code lines.

[0053] Similarly, the actual number of defects detected by static code in the project dimension of the preset static code can be collected (excluding the number of defects marked as false positives), and then the actual project defect density can be obtained by dividing the collected number of project defects by the number of project code lines and multiplying it by 1000.

[0054] In a feasible implementation manner, the actual code monitoring result also includes an actual pipeline safety node pass rate, and the actual pipeline safety node pass rate includes an actual enterprise pipeline safety node pass rate, an actual group pipeline safety node pass rate, and an actual project pipeline safety node pass rate; step S30 may also include steps S305~S308: Step S305 , monitoring the pass rate of the preset static code in the enterprise dimension, group dimension and project dimension to obtain the actual pipeline security node pass rate.

[0055] It is understandable that when monitoring the pass rate of pipeline safety nodes, the pass rate can also be monitored according to the enterprise dimension, group dimension and project dimension to obtain the actual pass rate of pipeline safety nodes.

[0056] Step S306, collect the number of enterprise pipeline triggering times and the number of times the preset static code passes the enterprise security checkpoint in the enterprise dimension, and determine the actual enterprise pipeline security node pass rate based on the number of enterprise pipeline triggering times and the number of times the enterprise security checkpoint passes.

[0057] It should be understood that the number of enterprise pipeline triggers and the number of times the preset static code passes the enterprise security checkpoint in the enterprise dimension can be collected, and then the number of times the enterprise security checkpoint is passed is divided by the number of enterprise pipeline triggers to obtain the actual enterprise pipeline security node pass rate.

[0058] Step S307, collect the number of group pipeline triggering times and the number of times the preset static code passes the group security checkpoint in the group dimension, and determine the actual group pipeline security node pass rate based on the number of group pipeline triggering times and the number of times the group security checkpoint is passed.

[0059] It should be understood that the number of group pipeline triggers and the number of times the preset static code passes the group security checkpoints in the group dimension can be collected, and then the number of times the group security checkpoints are passed can be divided by the number of group pipeline triggers to obtain the actual group pipeline security node pass rate.

[0060] Step S308, collect the number of project pipeline triggers and the number of times the preset static code passes the project security checkpoint in the project dimension, and determine the actual project pipeline security node pass rate based on the number of project pipeline triggers and the number of times the project security checkpoint is passed.

[0061] It should be understood that the number of project pipeline triggers and the number of times the preset static code passes the project security checkpoints in the project dimension can be collected, and then the number of times the project security checkpoints are passed can be divided by the number of project pipeline triggers to obtain the actual project pipeline security node pass rate.

[0062] In this embodiment, by collecting the number of false positive defects of the project markers in the overall dimension of the detection tool and the dimension of each detection rule, the actual false positive rate of the tool in each dimension is calculated, and the false positive rate of the tool can be more accurately and comprehensively monitored to optimize and improve the tool. This embodiment also monitors the defect density of static code in the three dimensions of enterprise, group, and project, and also monitors the pass rate of pipeline security nodes from three dimensions, so that developers can more comprehensively grasp the multi-dimensional security status of the code, so that developers can grasp the distribution of problems in the code and make better improvements.

[0063] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 3 After step S40, the static code testing method further includes steps S50 to S70: Step S50, when the actual tool false alarm rate exceeds the false alarm rate indicator, optimizing each detection rule in the static code testing tool.

[0064] It is understandable that the optimization content of the tool and code is described in this embodiment. Tool developers are required to further optimize the detection rules of the tool, such as analyzing the code features of the detection scenario and adding them to the original detection scenario, so that it can more accurately identify potential problems and risks, thereby reducing the false alarm rate of the tool.

[0065] It should be noted that the false alarm rate of static code detection tools can be reduced by continuously optimizing detection rules and supplementing the coverage of detection scenarios. For example, the SQL injection detection rules of the tool must cover the following scenarios to reduce the false alarm rate, including: 1) Check whether the code uses the parameterized API interface (i.e. PreparedStatement) method to prevent SQL injection; 2) Review whether the code uses input validation (i.e. whitelist) methods to prevent SQL injection; 3) Review whether the code uses input filtering methods to prevent SQL injection. If the detection tool does not cover the above three detection scenarios, there will be a certain amount of false alarms in the detection results. Therefore, it is necessary to continuously monitor the false alarm rate indicator and continuously optimize the false alarm rules to supplement the detection scenarios.

[0066] Step S60, searching for user-defined security filtering functions and functions that meet preset security conditions in the preset static code, configuring a function whitelist according to the security filtering functions and the functions that meet preset security conditions, and adding the function whitelist to the static code testing tool.

[0067] It is understandable that the function whitelist is a type of security policy that lists a series of functions or methods that are considered safe. These functions or methods have been manually reviewed and proven to be able to correctly process data and prevent security vulnerabilities (such as SQL injection, cross-site scripting, etc.). You can search for user-defined security filtering functions in the preset static code, and search for functions that meet preset security conditions (for example, certain known safe or proven necessary functions), set a function whitelist for them, and avoid being mistakenly marked as potential security issues.

[0068] Step S70, when the actual defect density and / or the actual pipeline safety node pass rate in the actual code monitoring result does not reach the defect density index and / or the pipeline safety node pass rate index, the static code test result is fed back to the coder to enable the coder to improve the coding standardization.

[0069] It is understandable that tool managers can conduct in-depth auxiliary analysis based on the rich data analysis details provided by the test result comparison module. For indicators that do not meet the standards, the reasons are thoroughly explored and more targeted improvement plans are formulated. If the defect density corresponding to the software source code does not meet the standards or the pipeline safety node pass rate does not meet the indicator requirements, the static code test results need to be fed back to the coders so that the development coders can further update the security coding knowledge base, strengthen training, and improve the level of security coding of developers, thereby reducing the defect density of software projects.

[0070] In this embodiment, when the actual tool false positive rate exceeds the false positive rate indicator, each detection rule in the static code testing tool is optimized; and a whitelist is set for the tool, so as to avoid certain known safe or necessary functions from being mistakenly marked as potential security issues, improve the accuracy of the tool, and reduce the false positive rate of the tool. The static code test results are fed back to the coders, so that the development coders can further update the security coding knowledge base, strengthen training, and improve the level of security coding of developers.

[0071] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the static code testing method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0072] This application also provides a static code testing device, please refer to Figure 4 , the static code testing device comprises: A monitoring indicator setting module 10, used to set thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; The test tool detection module 20 is used to detect the actual false alarm rate of the static code test tool to obtain the actual tool false alarm rate; The static code monitoring module 30 is used to monitor the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result; The test result comparison module 40 is used to compare the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain a static code test result.

[0073] The static code testing device provided by the present application adopts the static code testing method in the above embodiment to solve the technical problem. Compared with the prior art, the beneficial effects of the static code testing device provided by the present application are the same as the beneficial effects of the static code testing method provided by the above embodiment, and other technical features in the static code testing device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0074] The present application provides a static code testing device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the static code testing method in the above-mentioned embodiment 1.

[0075] Reference below Figure 5 , which shows a schematic diagram of the structure of a static code test device suitable for implementing an embodiment of the present application. The static code test device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The static code testing device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0076] like Figure 5As shown, the static code testing device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the static code testing device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the static code test device to communicate with other devices wirelessly or by wire to exchange data. Although the static code test device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided alternatively.

[0077] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0078] The static code testing device provided by the present application adopts the static code testing method in the above embodiment, which can solve the technical problems of static code testing. Compared with the prior art, the beneficial effects of the static code testing device provided by the present application are the same as the beneficial effects of the static code testing method provided by the above embodiment, and the other technical features in the static code testing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0079] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0080] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0081] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the static code testing method in the above-mentioned embodiment.

[0082] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0083] The computer-readable storage medium may be included in the static code testing device; or may exist independently without being assembled into the static code testing device.

[0084] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the static code testing device, the static code testing device: sets thresholds corresponding to monitoring indicators, wherein the monitoring indicators include false alarm rate indicators, defect density indicators and pipeline safety node pass rate indicators; detects the actual false alarm rate of the static code testing tool to obtain the actual tool false alarm rate; monitors the actual defect density and the actual pipeline safety node pass rate of the preset static code to obtain the actual code monitoring result; compares the actual tool false alarm rate and the actual code monitoring result with the thresholds corresponding to the monitoring indicators to obtain the static code testing result.

[0085] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, C++, C#, Python, Go, etc., and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0086] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0087] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0088] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned static code testing method, and can solve technical problems. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the static code testing method provided in the above-mentioned embodiment, and will not be described in detail here.

[0089] The present application also provides a computer program product, including a computer program, which implements the steps of the static code testing method as described above when executed by a processor.

[0090] The computer program product provided by the present application can solve the technical problem. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the static code testing method provided by the above embodiment, which will not be described in detail here.

[0091] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A static code testing method, characterized in that: The method includes: Setting thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; Test the actual false alarm rate of static code testing tools to obtain the actual false alarm rate of the tools; Monitor the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring results; The actual tool false alarm rate and the actual code monitoring result are compared with the threshold value corresponding to the monitoring indicator to obtain a static code test result.

2. The method according to claim 1, characterized in that The false alarm rate index includes the overall false alarm rate of the static code testing tool and the false alarm rate of each detection rule in the static code testing tool; the defect density index includes enterprise defect density, group defect density and project defect density; The pipeline safety node pass rate indicators include enterprise pipeline safety node pass rate, group pipeline safety node pass rate and project pipeline safety node pass rate.

3. The method according to claim 1, characterized in that The actual tool false alarm rate includes the actual overall false alarm rate and the actual false alarm rate of each detection rule; The step of detecting the actual false alarm rate of the static code testing tool to obtain the actual false alarm rate of the tool includes: Perform false positive rate detection on static code testing tools in the overall dimension and in each detection rule dimension; Collect the number of false positive defects marked by static code testing tools in the overall dimension to obtain the actual overall false positive rate; Collect the number of false positive defects marked by the static code testing tool in each detection rule dimension to obtain the actual false positive rate of each detection rule.

4. The method according to claim 1, characterized in that The actual code monitoring result includes actual defect density, and the actual defect density includes actual enterprise defect density, actual team defect density and actual project defect density; The step of monitoring the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result includes: Monitor the defect density of preset static codes in the enterprise, group and project dimensions to obtain the actual defect density; Collecting the number of enterprise defects and the number of project code lines of preset static codes in the enterprise dimension, and determining the actual enterprise defect density according to the number of enterprise defects and the number of project code lines; Collect the number of group defects of preset static codes in the group dimension, and determine the actual group defect density according to the number of group defects and the number of project code lines; The number of project defects of preset static codes in the project dimension is collected, and the actual project defect density is determined according to the number of project defects and the number of project code lines.

5. The method according to claim 1, characterized in that The actual code monitoring result also includes an actual pipeline safety node pass rate, and the actual pipeline safety node pass rate includes an actual enterprise pipeline safety node pass rate, an actual group pipeline safety node pass rate, and an actual project pipeline safety node pass rate; The step of monitoring the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring result includes: Monitor the pass rate of preset static codes in the enterprise, group and project dimensions to obtain the actual pass rate of pipeline security nodes; Collect the number of enterprise pipeline triggers and the number of enterprise security checkpoints passed by the preset static code in the enterprise dimension, and determine the actual enterprise pipeline security node pass rate according to the number of enterprise pipeline triggers and the number of enterprise security checkpoints passed; Collect the number of group pipeline triggers and the number of group security checkpoints passed by the preset static code in the group dimension, and determine the actual group pipeline security node pass rate according to the number of group pipeline triggers and the number of group security checkpoints passed; The number of project pipeline triggering times and the number of times the preset static code passes the project security checkpoints in the project dimension are collected, and the actual project pipeline security node pass rate is determined based on the number of project pipeline triggering times and the number of times the project security checkpoints are passed.

6. The method according to claim 5, characterized in that After the step of comparing the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain the static code test result, the method further includes: When the actual tool false alarm rate exceeds the false alarm rate indicator, optimizing each detection rule in the static code testing tool; Searching for user-defined security filtering functions and functions that meet preset security conditions in the preset static code, configuring a function whitelist according to the security filtering functions and the functions that meet the preset security conditions, and adding the function whitelist to the static code testing tool; When the actual defect density and / or the actual pipeline safety node pass rate in the actual code monitoring results do not reach the defect density index and / or the pipeline safety node pass rate index, the static code test results are fed back to the coders to enable them to improve the coding standardization.

7. A static code testing device, characterized in that: The static code testing device comprises: A monitoring indicator setting module, used to set thresholds corresponding to monitoring indicators, wherein the monitoring indicators include a false alarm rate indicator, a defect density indicator, and a pipeline safety node pass rate indicator; A test tool detection module is used to detect the actual false alarm rate of the static code test tool and obtain the actual tool false alarm rate; The static code monitoring module is used to monitor the actual defect density of the preset static code and the actual pipeline safety node pass rate to obtain the actual code monitoring results; The test result comparison module is used to compare the actual tool false alarm rate and the actual code monitoring result with the threshold value corresponding to the monitoring indicator to obtain the static code test result.

8. A static code testing device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the static code testing method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the static code testing method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the static code testing method according to any one of claims 1 to 6 are implemented.

Images