论文标题
基于OWASP-SANS的漏洞映射：静态应用程序安全测试的调查（SAST）
Vulnerabilities Mapping based on OWASP-SANS: a Survey for Static Application Security Testing (SAST)
论文作者
论文摘要
对于应用程序开发团队，将安全团队集成到其开发生命周期中是真正的价值，尤其是当移动或Web应用程序超越扫描阶段并越来越重点放在基于静态应用程序安全性测试（SAST）的补救或缓解阶段时。 For the first time, to the author's knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings.进行了案例研究，以扫描概念证明移动恶意软件检测应用程序。用CheckMarx漏洞查询，缺陷和漏洞来映射OWASP/SANS，以提高效率可以缓解。
The delivery of a framework in place for secure application development is of real value for application development teams to integrate security into their development life cycle, especially when a mobile or web application moves past the scanning stage and focuses increasingly on the remediation or mitigation phase based on static application security testing (SAST). For the first time, to the author's knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings. A case study is conducted for vulnerabilities scanning of a proof-of-concept mobile malware detection app. Mapping the OWASP/SANS with Checkmarx vulnerabilities queries, flaws and vulnerabilities are demonstrated to be mitigated with improved efficiency.
