Software Assurance Analysis and Visual Analytics

Software is a mature discipline, yet more than 98 percent of all PCs have one or more vulnerable programs, and in the US there are 2.7 billion programs open for attack. Efforts to address the problem at the source --during software development--are shockingly inadequate, with many commercial Software Assurance tools focused on detection rather than working to become part of the development process. More effective Software Testing and Vulnerability Analysis is required to identify and remediate vulnerabilities before systems are deployed. The Secure Decisions Division of Applied Visions Inc. proposes to design and develop a Software Assurance Analysis and Visual Analytics system that can be integrated into the Software Development Life Cycle to identify, confirm, and understand weaknesses and vulnerabilities in source code. No single Software Assurance tool is likely to identify all vulnerabilities: we do not propose to develop yet another vulnerability detection method, but to develop a platform for correlating the results of multiple analysis tools. Our approach is to leverage existing tools by providing a framework for linking disparate testing and vulnerability analysis tools, and to provide a visual analytics platform that embeds a mechanism for feedback from human analysis into automated analysis.