[WASC-SATEC] Runtime Analysis Tools
james.mcgovern at hp.com
Thu Apr 24 09:16:25 EDT 2014
With that being said, I believe there are two action items:
1. We should attempt to describe for readers when static analysis approaches run out of steam and when they need to consider sensor models.
2. We can add new criteria specifically for sensor-based approaches
From: Sherif Koussa [mailto:sherif.koussa at gmail.com]
Sent: Wednesday, April 23, 2014 1:52 PM
To: McGovern, James
Subject: Re: Runtime Analysis Tools
Yup exactly, like Contrast Security from Aspect.
On Wednesday, April 23, 2014, McGovern, James <james.mcgovern at hp.com<mailto:james.mcgovern at hp.com>> wrote:
By hybrid-analyzers, are you referring to the new breed of tools that inject “sensors”?
Sent: Sunday, April 20, 2014 6:19 PM
To: Alec Shcherbakov
Subject: Re: [WASC-SATEC] Runtime Analysis Tools
I guess my question would be: does our criteria help users choose the right "hybrid analyzer" or does it help them choose between pure static code analyzers and "hybrid" analyzers? I am not sure we had the "hybrid" analyzers in mind when we designed the criteria, therefore, I am just concerned that referencing these would confuse users more so than help them.
Some of these tools reverse-engineer the code being executed at the moment and then scan it, but the scope of the scan may be limited compared to the more complex often multistage process most static analyzers employ. A more accurate category for these tools could be “hybrid analyzers”. Perhaps we could list them in a separate category on the tools page.
The information in this email is intended for the addressee. Any other use of this information is unauthorized and prohibited.
Sent: Friday, April 18, 2014 9:23 AM
Subject: [WASC-SATEC] Runtime Analysis Tools
I received a request from one of the "runtime analysis tools" providers (www.contrastsecurity.com<http://www.contrastsecurity.com>) to list it on the Static Analysis Tools List page associated with SATEC.
The challenge with these tools is that they provide results that are similar to static analysis but they don't actually scan the code.
Interested to know what you guys think?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the wasc-satec