title: ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¸ÑÑ Ð¾Ð´Ð½ÑÑ ÑÐµÐºÑÑÐ¾Ð² Ð¸ ÑÐºÑÐ¸Ð¿ÑÐ¾Ð² Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ñ Ð² Ð½Ð¸Ñ Ð¿ÑÐ±Ð»Ð¸ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Automation scanning of source texts and scripts for the presence of public vulnerabilities in them
Creators: name: ÐÐ¸Ð³ÑÐ»ÑÑÐºÐ¸Ð¹, ÐÐ°Ð½Ð¸Ð¸Ð»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ
Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾Ñ
ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
scanning
vulnerability search
static analyzer
vulnerability testing

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ÑÑÐ¾Ð´Ð½ÑÑ ÑÐµÐºÑÑÐ¾Ð² Ð¸ ÑÐºÑÐ¸Ð¿ÑÐ¾Ð² Ð½Ð° Ð½Ð°Ð»Ð¸ÑÐ¸Ðµ Ð² Ð½Ð¸Ñ Ð¿ÑÐ±Ð»Ð¸ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹Â». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð¸ÑÐº Ð¿ÑÐ±Ð»Ð¸ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼ ÐºÐ¾Ð´Ðµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ñ Ð¸Ð»Ð¸ Ð¸ÑÑÐ¾Ð´Ð½ÑÑ ÐºÐ¾Ð´Ð¾Ð² ÑÐºÑÐ¸Ð¿ÑÐ¾Ð². ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¸ÑÑÐ¾Ð´Ð½ÑÑ ÑÐµÐºÑÑÐ¾Ð² Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ñ Ð² Ð½Ð¸Ñ Ð¿ÑÐ±Ð»Ð¸ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ:ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ Ð¸ Ð¸Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ.ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼.Ð¡ÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ¾Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð°.Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ñ Ð² Ð½Ð¸Ñ Ð¿ÑÐ±Ð»Ð¸ÑÐ½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. ÐÑÐµÐ½ÐºÐ° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð¹ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ñ.Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¸ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° Ð½Ð° Ð½Ð°Ð»Ð¸ÑÐ¸Ðµ Ð² Ð½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð½Ð° Ð½Ð°Ð»Ð¸ÑÐ¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸ÑÑÐ¾Ð´Ð½Ð¾Ð¼ ÐºÐ¾Ð´Ðµ, Ð±ÑÐ»Ð° Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð° ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ, Ð¸ Ð±ÑÐ» ÑÐ´ÐµÐ»Ð°Ð½ Ð²ÑÐ²Ð¾Ð´, ÑÑÐ¾ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ ÑÑÐµÐ´ÑÑÐ²Ð° Ð´Ð°ÑÑ Ð¼Ð½Ð¾Ð³Ð¾ Ð»Ð¾Ð¶Ð½ÑÑ ÑÑÐ°Ð±Ð°ÑÑÐ²Ð°Ð½Ð¸Ð¹ Ð¿Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð½ÑÐ¼ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÑÐ¾Ð´Ð½ÑÑ ÑÐµÐºÑÑÐ¾Ð² Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼.
description: The topic of the final qualification work: "Automation of scanning source texts and scripts for the presence of public vulnerabilities in them."The purpose of the work is to search for public vulnerabilities in the program source code or script source codes. The subject of research is modern methods of automating the scanning of source texts for the presence of public vulnerabilities in them. Tasks to be solved during the study:Research of software vulnerabilities and their classification.Study of methods for static analysis of program source code. Comparative analysis of static source code analyzers. Development of a tool for automated scanning of the source code of programs for the presence of public vulnerabilities in them. Evaluation of the developed program.In the course of the work, methods for detecting and classifying vulnerabilities were investigated. Modern approaches to scanning source code for vulnerabilities were analyzed. As a result of the work, a tool for automated scanning for vulnerabilities in the source code was developed, its effectiveness was demonstrated, and it was concluded that modern tools give a lot of false positives for detected vulnerabilities.The results obtained can be used as a basis for designing systems for automated analysis of program source text.