Skip to content

Commit 5b213d7

Browse files
oshandooshando
oshando
authored and
oshando
committed
Update documentation and dependencies
1 parent fb77a80 commit 5b213d7

File tree

4 files changed

+74
-48
lines changed

4 files changed

+74
-48
lines changed

‎README.md‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,43 @@
11
# swan
22
Security methods for WeAkNess detection
33

4-
Description:
4+
What is SWAN?
55
-------------
6-
SWAN is a machine-learning approach for detection of methods of interest for security in Java libraries.
7-
SWAN should be used in combination with other static analyses tools. It helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
8-
SWAN detects four types of methods: source, sink, sanitizer, and authentication method.
9-
The found methods are further cathegorized according to relevant vulnerabilities (Common Weakness Enummeration - CWE). Curretntly SWAN supports the following CWEs: CWE78, CWE79, CWE89, CWE306, CWE601, CWE862, and CWE863.
6+
SWAN is a machine-learning approach used to detect of security relevant methods in Java libraries.
7+
SWAN should be used in combination with other static analyses tools and it helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
8+
The tool currently detects four types of security relevant methods: source, sink, sanitizer, and authentication methods.
9+
The detected methods are further categorized according to relevant vulnerabilities from the [Common Weakness Enumeration (CWE)](https://cwe.mitre.org/). Currently, SWAN supports the following CWEs: [CWE78 OS Command Injection](https://cwe.mitre.org/data/definitions/78.html), [CWE79 Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html), [CWE89 SQL Injection](https://cwe.mitre.org/data/definitions/89.html), [CWE306 Missing Authentication](https://cwe.mitre.org/data/definitions/306.html), [CWE601 Open Redirect](https://cwe.mitre.org/data/definitions/601.html), [CWE862 Missing Authorisation](https://cwe.mitre.org/data/definitions/862.html), and
10+
[CWE863 Incorrect Authorisation](https://cwe.mitre.org/data/definitions/863.html).
1011

11-
SWAN_Assist provides a GUI support for SWAN. The user is able to interact with the learning process by giving feedback on the methods of interest.
12-
The tool helps users that write static analyses to create list of SWAN for their specific Java libraries.
13-
Moreover, users can manually inspect the proper usage of the methods detected by SWAN.
12+
The project contains the following modules:
13+
* **swan-pipeline**: core machine-learning approach implementation for SWAN. Application can be run using CLI.
14+
* **swan-assist**: GUI support for SWAN implemented as an IntelliJ plugin.
15+
* **swan-javadoc-exporter**: Doclet for exporting doc comments to XML files
16+
* **swan-javadoc-coverage**: Doclet to calculate the documentation coverage of Java programs
1417

15-
Contributors:
16-
* Goran Piskachev (goran.piskachev@iem.fraunhofer.de)
17-
* Lisa Nguyen (lisa.nguyen@uni-paderborn.de)
18-
* Oshando Johnson (oshando@iem.fraunhofer.de)
19-
* Eric Bodden (eric.bodden@uni-paderborn.de)
18+
How do I get started with SWAN?
19+
-------------
20+
The easiest way to get started with SWAN is to use the pre-built binary from the newest Release. After downloading the necessary files, we can run the JAR file with this command:
21+
22+
<code>java -jar swan-pipeline/target/swan-<version>-jar-with-dependencies.jar -output <output-directory></code>
23+
24+
This command runs the application and stores the application's output in the specified output directory. Below are some of the most common command line options. The complete list of command line options can be viewed by providing the <code>-h</code> or <code>-help</code> command line option.
25+
26+
27+
| Parameter | Description |
28+
| -------------------------- |:---------------------------------------|
29+
| <code>-train</code> or <code>-train-data</code> | Path to training JAR/class files. Default: Path to [/input/train-data](./swan-pipeline/src/main/resources/input/train-data)|
30+
| <code>-d</code> or <code>-dataset</code> | Path to JSON file that contains training examples. Default: Path to [swan-dataset.json](./swan-pipeline/src/main/resources/input/swan-dataset.json) |
31+
| <code>-s</code> or <code>-srm</code> | List of security-relevant types that should be classified. Options: <code>all</code>, <code>source</code>, <code>sink</code>, <code>sanitizer</code>, <code>authentication</code>. Default: <code>all</code> |
32+
| <code>-c</code> or <code>-cwe</code> | List of CWE types that should be classified. Options: <code>cwe078</code>, <code>cwe079</code>, s<code>cwe089</code>, <code>cwe306</code>, <code>cwe601</code>, <code>cwe862</code> and <code>cwe863</code>. Default: <code>all</code> |
2033

2134

22-
Contact:
35+
How do I build SWAN?
2336
-------------
24-
Goran Piskachev (Fraunhofer IEM, Zukunftsmeile 1, 33102 Paderborn)
37+
If you downloaded SWAN as a compressed release (e.g. .zip or .tar.gz), you can use <code>mvn package</code> to package the project. Alternatively, you can import the project directly into your IDE from the repository and package the project via the terminal or the Maven plugin in your IDE.
38+
39+
40+
Contributors
41+
-------------
42+
The following persons have contributed to SWAN: Goran Piskachev (goran.piskachev@iem.fraunhofer.de), Lisa Nguyen (lisa.nguyen@uni-paderborn.de), Oshando Johnson (oshando@iem.fraunhofer.de), Eric Bodden (eric.bodden@uni-paderborn.de)
43+

‎swan-assist/README.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,6 @@ IntelliJ IDEA Plug-in for the Security methods for WeAkNess detection (SWAN) too
33

44
Description:
55
-------------
6-
SWAN is a machine-learning approach for detection of methods of interest for security in Java libraries.
7-
SWAN should be used in combination with other static analyses tools. It helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
8-
SWAN detects four types of methods: source, sink, sanitizer, and authentication method.
9-
The found methods are further cathegorized according to relevant vulnerabilities (Common Weakness Enummeration - CWE). Curretntly SWAN supports the following CWEs: CWE78, CWE79, CWE89, CWE306, CWE601, CWE862, and CWE863.
10-
116
SWAN_Assist provides a GUI support for SWAN. The user is able to interact with the learning process by giving feedback on the methods of interest.
127
The tool helps users that write static analyses to create list of SWAN for their specific Java libraries.
138
Moreover, users can manually inspect the proper usage of the methods detected by SWAN.

core/README.md renamed to swan-pipeline/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Description
66
SWAN is a machine-learning approach for detection of methods of interest for security in Java libraries.
77
SWAN should be used in combination with other static analyses tools. It helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
88
SWAN detects four types of methods: source, sink, sanitizer, and authentication method.
9-
The found methods are further categorized according to relevant vulnerabilities (Common Weakness Enumeration - CWE). Curretntly SWAN supports the following CWEs: CWE078, CWE079, CWE089, CWE306, CWE601, CWE862, and CWE863.
9+
The found methods are further categorized according to relevant vulnerabilities (Common Weakness Enumeration - CWE). Currently, SWAN supports the following CWEs: CWE078, CWE079, CWE089, CWE306, CWE601, CWE862, and CWE863.
1010

1111
Main contributors:
1212
* Goran Piskachev (goran.piskachev@iem.fraunhofer.de)

core/pom.xml renamed to swan-pipeline/pom.xml

Lines changed: 39 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
<groupId>de.upb.cs.swt</groupId>
77
<artifactId>swan</artifactId>
8-
<version>2.0.0</version>
8+
<version>3.0.0</version>
99
<packaging>jar</packaging>
1010

1111

@@ -63,14 +63,25 @@
6363

6464
<dependencies>
6565
<dependency>
66+
<groupId>org.openjfx</groupId>
67+
<artifactId>javafx-base</artifactId>
68+
<version>16</version>
69+
<type>pom</type>
70+
</dependency>
71+
<!--dependency>
6672
<groupId>ca.mcgill.sable</groupId>
6773
<artifactId>soot</artifactId>
6874
<version>3.2.0</version>
75+
</dependency-->
76+
<dependency>
77+
<groupId>org.soot-oss</groupId>
78+
<artifactId>soot</artifactId>
79+
<version>4.2.1</version>
6980
</dependency>
7081
<dependency>
7182
<groupId>nz.ac.waikato.cms.weka</groupId>
7283
<artifactId>weka-stable</artifactId>
73-
<version>3.8.4</version>
84+
<version>3.8.5</version>
7485
</dependency>
7586
<dependency>
7687
<groupId>com.googlecode.json-simple</groupId>
@@ -85,35 +96,35 @@
8596
<dependency>
8697
<groupId>org.apache.commons</groupId>
8798
<artifactId>commons-lang3</artifactId>
88-
<version>3.10</version>
99+
<version>3.12.0</version>
89100
</dependency>
90101
<dependency>
91102
<groupId>edu.stanford.nlp</groupId>
92103
<artifactId>stanford-corenlp</artifactId>
93-
<version>4.0.0</version>
104+
<version>4.3.0</version>
94105
</dependency>
95106
<dependency>
96107
<groupId>edu.stanford.nlp</groupId>
97108
<artifactId>stanford-corenlp</artifactId>
98-
<version>4.0.0</version>
109+
<version>4.3.0</version>
99110
<classifier>models</classifier>
100111
</dependency>
101112
<dependency>
102113
<groupId>org.jsoup</groupId>
103114
<artifactId>jsoup</artifactId>
104-
<version>1.13.1</version>
115+
<version>1.14.3</version>
105116
</dependency>
106117
<dependency>
107118
<groupId>org.reflections</groupId>
108119
<artifactId>reflections</artifactId>
109-
<version>0.9.12</version>
120+
<version>0.10.1</version>
110121
</dependency>
111122
<dependency>
112123
<groupId>dev.jeka</groupId>
113124
<artifactId>jeka-core</artifactId>
114125
<version>0.9.0.M10</version>
115126
</dependency>
116-
<!-- deeplearning4j-core: contains main functionality and neural networks -->
127+
<!-- deeplearning4j-core: contains swanPipeline functionality and neural networks -->
117128
<dependency>
118129
<groupId>org.deeplearning4j</groupId>
119130
<artifactId>deeplearning4j-core</artifactId>
@@ -152,19 +163,30 @@
152163
<dependency>
153164
<groupId>ai.libs</groupId>
154165
<artifactId>hasco-core</artifactId>
155-
<version>0.2.3</version>
166+
<version>0.2.5</version>
156167
</dependency>
157168
<!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-api -->
158169
<dependency>
159170
<groupId>org.slf4j</groupId>
160171
<artifactId>slf4j-api</artifactId>
161-
<version>1.7.30</version>
172+
<version>1.7.32</version>
162173
</dependency>
163174
<!-- https://mvnrepository.com/artifact/org.slf4j/slf4j-simple -->
164175
<dependency>
165176
<groupId>org.slf4j</groupId>
166177
<artifactId>slf4j-simple</artifactId>
167-
<version>1.7.30</version>
178+
<version>1.7.32</version>
179+
</dependency>
180+
<dependency>
181+
<groupId>info.picocli</groupId>
182+
<artifactId>picocli</artifactId>
183+
<version>4.6.1</version>
184+
</dependency>
185+
<dependency>
186+
<groupId>commons-io</groupId>
187+
<artifactId>commons-io</artifactId>
188+
<version>2.6</version>
189+
<scope>compile</scope>
168190
</dependency>
169191
</dependencies>
170192

@@ -198,7 +220,7 @@
198220
</repository>
199221
<repository>
200222
<id>imagej.public</id>
201-
<url>http://maven.imagej.net/content/groups/public</url>
223+
<url>https://maven.imagej.net/content/groups/public</url>
202224
</repository>
203225
</repositories>
204226

@@ -226,6 +248,7 @@
226248
<plugin>
227249
<groupId>org.apache.maven.plugins</groupId>
228250
<artifactId>maven-source-plugin</artifactId>
251+
<version>3.2.1</version>
229252
<executions>
230253
<execution>
231254
<id>attach-sources</id>
@@ -250,8 +273,8 @@
250273
<archive>
251274
<manifest>
252275
<mainClass>
253-
de.fraunhofer.iem.swan.Main
254-
</mainClass>
276+
de.fraunhofer.iem.swan.Main
277+
</mainClass>
255278
</manifest>
256279
</archive>
257280
<descriptorRefs>
@@ -261,20 +284,9 @@
261284
</execution>
262285
</executions>
263286
</plugin>
264-
<plugin>
265-
<groupId>org.apache.maven.plugins</groupId>
266-
<artifactId>maven-compiler-plugin</artifactId>
267-
<configuration>
268-
<source>8</source>
269-
<target>8</target>
270-
</configuration>
271-
</plugin>
272287
</plugins>
273288
</build>
274289

275-
276-
277-
278290
<!-- release build command: mvn clean install -Prelease -->
279291
<profiles>
280292
<profile>
@@ -284,7 +296,7 @@
284296
<plugin>
285297
<groupId>org.apache.maven.plugins</groupId>
286298
<artifactId>maven-javadoc-plugin</artifactId>
287-
<version>3.0.0</version>
299+
<version>3.3.1</version>
288300
<executions>
289301
<execution>
290302
<id>attach-javadocs</id>
@@ -297,7 +309,7 @@
297309
<plugin>
298310
<groupId>org.apache.maven.plugins</groupId>
299311
<artifactId>maven-source-plugin</artifactId>
300-
<version>3.0.1</version>
312+
<version>3.2.1</version>
301313
<executions>
302314
<execution>
303315
<id>attach-sources</id>

0 commit comments

Comments
 (0)