Digital Commons Network^™

Surmounting Challenges In Aggregating Results From Static Analysis Tools, Dr. Ann Marie Reinhold, Brittany Boles, A. Redempta Manzi Muneza, Thomas Mcelroy, Dr. Clemente Izurieta

Military Cyber Affairs

Aggregation poses a significant challenge for software practitioners because it requires a comprehensive and nuanced understanding of raw data from diverse sources. Suites of static-analysis tools (SATs) are commonly used to assess organizational security but simultaneously introduce significant challenges. Challenges include unique results, scales, configuration environments for each SAT execution, and incompatible formats between SAT outputs. Here, we document our experiences addressing these issues. We highlight the problem of relying on a single vendor's SAT version and offer a solution for aggregating findings across multiple SATs, aiming to enhance software security practices and deter threats early with robust defensive operations.