论文标题
我真的需要所有这些工作才能找到漏洞吗？一个经验案例研究，比较了Java应用程序上的脆弱性检测技术
Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application
论文作者
论文摘要
上下文：应用漏洞检测技术是使用软件项目有限资源的众多任务之一。 目的：这项研究的目的是通过实证研究对基于Java的Web应用程序的效率和有效性进行实证研究，以帮助管理人员和其他决策者对使用软件漏洞检测技术的使用明智的选择。 方法：我们应用四个不同类别的脆弱性检测技术\ TextEndash〜系统手动渗透测试（SMPT），探索性手动渗透测试（FAMT），动态应用程序安全测试（DAST）和静态应用程序安全测试（SAST）\ TextEndEndash \ to TextEndEndash \ to开放式医疗记录系统。 结果：我们使用SAST发现了最大的漏洞。但是，空的发现更严重的漏洞。使用每种技术，我们发现使用其他技术找不到独特的漏洞。就每小时脆弱性（VPH）而言，手动技术（空，SMPT）的效率与自动技术（Dast，Sast）的效率相当或更好。 结论：脆弱性检测技术应根据项目的目标和可用资源来选择。如果组织的目标是在项目中找到“所有”漏洞，则需要使用与资源允许的尽可能多的技术。
CONTEXT: Applying vulnerability detection techniques is one of many tasks using the limited resources of a software project. OBJECTIVE: The goal of this research is to assist managers and other decision-makers in making informed choices about the use of software vulnerability detection techniques through an empirical study of the efficiency and effectiveness of four techniques on a Java-based web application. METHOD: We apply four different categories of vulnerability detection techniques \textendash~ systematic manual penetration testing (SMPT), exploratory manual penetration testing (EMPT), dynamic application security testing (DAST), and static application security testing (SAST) \textendash\ to an open-source medical records system. RESULTS: We found the most vulnerabilities using SAST. However, EMPT found more severe vulnerabilities. With each technique, we found unique vulnerabilities not found using the other techniques. The efficiency of manual techniques (EMPT, SMPT) was comparable to or better than the efficiency of automated techniques (DAST, SAST) in terms of Vulnerabilities per Hour (VpH). CONCLUSIONS: The vulnerability detection technique practitioners should select may vary based on the goals and available resources of the project. If the goal of an organization is to find "all" vulnerabilities in a project, they need to use as many techniques as their resources allow.
