VULNERABILITY DETECTION IN SOFTWARE APPLICATIONS USING STATIC CODE ANALYSIS

Abstract

In this modern era of technology where data and its integrity are vital for organizations, software security has become a major area to focus on in the software life cycle. Organizations must preserve the program's security to ensure the computer program's availability, authenticity, and data integrity delivered to the clients. The major focus in software security processes is to find the vulnerabilities displayed in source code prior to the production phase of the software product. Recognizing the bugs present in the code in the early stages of the software lifecycle may help resolve the vulnerability findings in the computer program and help the software developers settle those bugs. This detection process is effective at runtime, but can also be performed in the production phase where the computer program is under development and partially implemented. A static code analysis process is used to detect vulnerabilities. It can be done computerized or evaluated physically by development and testing teams. The use of source code scanning tools that are mostly automated for detecting vulnerabilities is utilized in this paper. These tools review the source code for its quality based on several code metrics and identify bugs present in the program. Unlike dynamic analysis methods, static code analysis helps find the security vulnerabilities in the initial stages of the software life cycle, where the software product is in the production phase and static analysis does not require code to be in the execution state.