Complementing Secure Code Review with Automated Program Analysis

Code review is an important activity in software en-gineering process to reduce software defects before the production phase. It is crucial that software defects are identified as soon as they are introduced because their impact can be amplified if they are discovered in the later stages. However, previous studies have observed that vulnerability, a software weakness that could be exploited by an attacker, can slip through the code review process because of the limited resources and security awareness of reviewers. Approaches such as automated program analysis have been recommended to assist this problem. Yet, it is unclear about the capability of automated program analysis to augment human reviewers on the security aspects. This research project aims to investigate to what extent, and how, can different automated program analysis approaches complement human reviewers in the code review process.