Security methods for WeAkNess detection
SWAN is a machine-learning approach used to detect of security relevant methods in Java libraries. SWAN should be used in combination with other static analyses tools and it helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis. The tool currently detects four types of security relevant methods: source, sink, sanitizer, and authentication methods. The detected methods are further categorized according to relevant vulnerabilities from the Common Weakness Enumeration (CWE). Currently, SWAN supports the following CWEs: CWE78 OS Command Injection, CWE79 Cross-site Scripting, CWE89 SQL Injection, CWE306 Missing Authentication, CWE601 Open Redirect, CWE862 Missing Authorisation, and CWE863 Incorrect Authorisation.
The project contains the following modules:
- swan-pipeline: core machine-learning approach implementation for SWAN. Application can be run using CLI.
- swan-assist: GUI support for SWAN implemented as an IntelliJ plugin.
- swan-javadoc-exporter: Doclet for exporting doc comments to XML files
- swan-javadoc-coverage: Doclet to calculate the documentation coverage of Java programs
The easiest way to get started with SWAN is to use the pre-built binary from the newest Release. After downloading the necessary files, we can run the JAR file with this command:
java -jar swan-pipeline/target/swan--jar-with-dependencies.jar -output
This command runs the application and stores the application's output in the specified output directory. Below are some of the most common command line options. The complete list of command line options can be viewed by providing the -h or -help command line option.
| Parameter | Description |
|---|---|
-train or -train-data |
Path to training JAR/class files. Default: Path to /input/train-data |
-d or -dataset |
Path to JSON file that contains training examples. Default: Path to swan-dataset.json |
-s or -srm |
List of security-relevant types that should be classified. Options: all, source, sink, sanitizer, authentication. Default: all |
-c or -cwe |
List of CWE types that should be classified. Options: cwe078, cwe079, scwe089, cwe306, cwe601, cwe862 and cwe863. Default: all |
If you downloaded SWAN as a compressed release (e.g. .zip or .tar.gz), you can use mvn package to package the project. Alternatively, you can import the project directly into your IDE from the repository and package the project via the terminal or the Maven plugin in your IDE.
The following persons have contributed to SWAN: Goran Piskachev (goran.piskachev@iem.fraunhofer.de), Lisa Nguyen (lisa.nguyen@uni-paderborn.de), Oshando Johnson (oshando@iem.fraunhofer.de), Eric Bodden (eric.bodden@uni-paderborn.de)