Static Analysis Tool Exposition (SATE) 2008

Published

June 22, 2009

Author(s)

Vadim Okun, Romain Gaucher, Paul E. Black

Abstract

The NIST SAMATE project conducted the first Static Analysis Tool Exposition (SATE) in 2008 to advance research in static analysis tools that find security defects in source code. The main goals of SATE were to enable empirical research based on large test sets and to encourage improvement and speed adoption of tools. The exposition was planned to be an annual event. Briefly, participating tool makers ran their tool on a set of programs. Researchers led by NIST performed a partial analysis of tool reports. The results and experiences were reported at the Static Analysis Workshop in Tucson, AZ, in June, 2008. The tool reports and analysis were made publicly available in early 2009. This special publication consists of the following papers. "Review of the First Static Analysis Tool Exposition (SATE 2008)" by Vadim Okun, Romain Gaucher, and Paul E. Black, describes the SATE procedure, provides observations based on the data collected, and critiques the exposition, including the lessons learned that may help future expositions. Paul Anderson's "Commentary on CodeSonar's SATE Results" has comments by one of the participating tool makers. Steve Christey presents his experiences in analysis of tool reports and discusses the SATE issues in "SATE Lessons Learned and Future Directions".

Citation

Special Publication (NIST SP) - 500-279

Report Number

500-279

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

Local Download

Keywords

Software security, static analysis tools, security weaknesses, vulnerability

Citation

Okun, V. , Gaucher, R. and Black, P. (2009), Static Analysis Tool Exposition (SATE) 2008, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=902679 (Accessed April 24, 2024)