Evaluation of Static Analysis tools for Finding Vulnerabilities in C Programs

Software security is a critical topic that has been the focus of attention of many researchers and professionals over the years. Software security has evolved into an essential component of the software development process. An organization must maintain software security to assure the integrity, validity, and availability of the software product. One of the most important tasks in ensuring software security is identifying vulnerabilities in the source code before the product is released. Detecting vulnerabilities early in the software development cycle makes the process of resolving those vulnerabilities considerably easier for software engineers. Vulnerability detection can be done either during the production phase, when the software is still being produced, by statically auditing the source code, or dynamically during run time. Static code analysis tools detect vulnerabilities in code by identifying potential security problems and providing examples of how to fix them, some may even change the code to erase the vulnerability. This paper describes the analysis of many static code analysis tools and techniques available for vulnerability detection in C source code, as well as the analysis of some C static code analysis tools.