Skip to content

Commit ef93b63

Browse files
committed
Update Readme.md
1 parent 62e42b0 commit ef93b63

File tree

1 file changed

+17
-25
lines changed

1 file changed

+17
-25
lines changed

README.md

Lines changed: 17 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,35 @@
1-
# swan
2-
Security methods for WeAkNess detection
1+
# SWAN (Security methods for WeAkNess detection)
32

4-
What is SWAN?
3+
What is SWAN?
54
-------------
6-
SWAN is a machine-learning approach used to detect of security relevant methods in Java libraries.
7-
SWAN should be used in combination with other static analyses tools and it helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
8-
The tool currently detects four types of security relevant methods: source, sink, sanitizer, and authentication methods.
9-
The detected methods are further categorized according to relevant vulnerabilities from the [Common Weakness Enumeration (CWE)](https://cwe.mitre.org/). Currently, SWAN supports the following CWEs: [CWE78 OS Command Injection](https://cwe.mitre.org/data/definitions/78.html), [CWE79 Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html), [CWE89 SQL Injection](https://cwe.mitre.org/data/definitions/89.html), [CWE306 Missing Authentication](https://cwe.mitre.org/data/definitions/306.html), [CWE601 Open Redirect](https://cwe.mitre.org/data/definitions/601.html), [CWE862 Missing Authorisation](https://cwe.mitre.org/data/definitions/862.html), and
5+
SWAN is a machine-learning approach used to detect of security-relevant methods (SRM) in Java programs.
6+
SWAN should be used in combination with other static analyses tools and it helps the users to create a set of relevant methods required as an input for static analyses, e.g. taint- and type-state analysis.
7+
The tool currently detects four types of security relevant methods, namely: source, sink, sanitizer, and authentication methods.
8+
The detected methods are further categorized according to relevant vulnerabilities from the [Common Weakness Enumeration (CWE)](https://cwe.mitre.org/). The following CWEs are currently supported: [CWE78 OS Command Injection](https://cwe.mitre.org/data/definitions/78.html), [CWE79 Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html), [CWE89 SQL Injection](https://cwe.mitre.org/data/definitions/89.html), [CWE306 Missing Authentication](https://cwe.mitre.org/data/definitions/306.html), [CWE601 Open Redirect](https://cwe.mitre.org/data/definitions/601.html), [CWE862 Missing Authorisation](https://cwe.mitre.org/data/definitions/862.html), and
109
[CWE863 Incorrect Authorisation](https://cwe.mitre.org/data/definitions/863.html).
1110

12-
The project contains the following modules:
13-
* **swan-pipeline**: core machine-learning approach implementation for SWAN. Application can be run using CLI.
14-
* **swan-assist**: GUI support for SWAN implemented as an IntelliJ plugin.
15-
* **swan-javadoc-exporter**: Doclet for exporting doc comments to XML files
16-
* **swan-javadoc-coverage**: Doclet to calculate the documentation coverage of Java programs
11+
The project contains the following modules:
12+
* **swan-pipeline**: core machine learning implementation for SWAN with components for data collection and preparation, feature engineering and model selection phases
13+
* **swan-assist**: IntelliJ plugin provides GUI support for SWAN and enables active machine learning.
14+
* **swan-javadoc-exporter**: Doclet exports doc comments to XML files so that they can be analyzed by the Natural Language Processing (NLP) module
15+
* **swan-javadoc-coverage**: Doclet calculates the software documentation coverage of Java programs based on the presence of doc comments for classes, methods, and other objects.
1716

1817
How do I get started with SWAN?
1918
-------------
20-
The easiest way to get started with SWAN is to use the pre-built binary from the newest Release. After downloading the necessary files, we can run the JAR file with this command:
19+
The easiest way to get started with SWAN is to use the pre-built binary from the newest release. To run SWAN, we provide a path to the Java project to be analyzed (JAR files or compiled classes) as well an output directory where SWAN will export its results.
2120

22-
<code>java -jar swan-pipeline/target/swan-<version>-jar-with-dependencies.jar -output <output-directory></code>
21+
After downloading the necessary files from the most recent release, SWAN can be executed on the command line with the following command:
2322

24-
This command runs the application and stores the application's output in the specified output directory. Below are some of the most common command line options. The complete list of command line options can be viewed by providing the <code>-h</code> or <code>-help</code> command line option.
25-
26-
27-
| Parameter | Description |
28-
| -------------------------- |:---------------------------------------|
29-
| <code>-train</code> or <code>-train-data</code> | Path to training JAR/class files. Default: Path to [/input/train-data](./swan-pipeline/src/main/resources/input/train-data)|
30-
| <code>-d</code> or <code>-dataset</code> | Path to JSON file that contains training examples. Default: Path to [swan-dataset.json](./swan-pipeline/src/main/resources/input/swan-dataset.json) |
31-
| <code>-s</code> or <code>-srm</code> | List of security-relevant types that should be classified. Options: <code>all</code>, <code>source</code>, <code>sink</code>, <code>sanitizer</code>, <code>authentication</code>. Default: <code>all</code> |
32-
| <code>-c</code> or <code>-cwe</code> | List of CWE types that should be classified. Options: <code>cwe078</code>, <code>cwe079</code>, s<code>cwe089</code>, <code>cwe306</code>, <code>cwe601</code>, <code>cwe862</code> and <code>cwe863</code>. Default: <code>all</code> |
23+
<code>java -jar swan-<swan-version>.jar -test <java-project-path> -output <output-directory></code>
3324

25+
This command runs the application and exports the detected security-relevant methods to a JSON file in the provided output directory. The available command line options can be found in the Wiki or by using the <code>-help</code> command line option.
3426

3527
How do I build SWAN?
3628
-------------
37-
If you downloaded SWAN as a compressed release (e.g. .zip or .tar.gz), you can use <code>mvn package</code> to package the project. Alternatively, you can import the project directly into your IDE from the repository and package the project via the terminal or the Maven plugin in your IDE.
29+
If you downloaded SWAN as a compressed release (e.g. .zip or .tar.gz), you can use <code>mvn package</code> to package the project. The commands provided above can then be used to run the generated JAR file. Alternatively, you can import the project directly into your IDE from the repository and package the project via the terminal or the Maven plugin in your IDE.
3830

3931

40-
Contributors
32+
Contributors
4133
-------------
4234
The following persons have contributed to SWAN: Goran Piskachev (goran.piskachev@iem.fraunhofer.de), Lisa Nguyen (lisa.nguyen@uni-paderborn.de), Oshando Johnson (oshando@iem.fraunhofer.de), Eric Bodden (eric.bodden@uni-paderborn.de)
4335

0 commit comments

Comments
 (0)