hub / github.com/alipay/ant-application-security-testing-benchmark

github.com/alipay/ant-application-security-testing-benchmark @iasttest1.0

repository ↗ · DeepWiki ↗ · release iasttest1.0 ↗ · + Follow

1,675 symbols 3,824 edges 387 files 184 documented · 11%

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

背景

  目前工业界和学术界均无安全能力的测试评价标准，都是通过在若干样本集上的测试结果对应用安全工具进行评价的。样本集的设计
没有标准，差异很大，无法全面客观的反映全貌，且评价结果只能得出一个总体的检出率、遗漏率和误报率数据，无法直观反映安全能
力的优势和不足。
  为了能全面而客观的对安全能力进行评价，蚂蚁安全团队从2021年开始探索建立安全能力的评价体系。通过应用安全评价体系项目，
希望可以衡量出应用安全产品的技术优劣，指引应用安全产品的发展方向，并可辅助用于商业化安全产品采购的技术选型，详见wiki。
  项目主要包括两部分，一部分是分语言的评价体系，另一部分是基于评价体系的Benchmark。此项目一期首先发布的是Java 
IAST引擎能力评价体系V1.0和Benchmark。如果您有任何好的想法，欢迎与我们团队联系

项目结构

├── dast-java(dast工程目录）
├── floder-img(静态资源)
├── iast-java(iast工程目录）
└── sast-java(sast工程目录）

操作说明

《dast操作说明》

《iast操作说明》

联系我们

钉钉

Image text

License

This project is licensed under the Apache License 2.0

Extension points exported contracts — how you extend this code

DataAnalysisService (Interface)

用于检查结果分析，以及分析结果存储返回ID用户报告下载 [2 implementers]

iast-java/src/main/java/com/iast/astbenchmark/analyser/service/DataAnalysisService.java

ThingInterface (Interface)

(no doc) [4 implementers]

dast-java/src/main/java/com/alipay/antbenchmark/tools/ThingInterface.java

ConfigService (Interface)

(no doc) [2 implementers]

iast-java/src/main/java/com/iast/astbenchmark/analyser/service/ConfigService.java

SampleService (Interface)

(no doc) [2 implementers]

dast-java/src/main/java/com/alipay/antbenchmark/service/SampleService.java

ISimpleService (Interface)

(no doc) [2 implementers]

iast-java/src/main/java/com/iast/astbenchmark/cases/dubbo/service/ISimpleService.java

Core symbols most depended-on inside this repo

toString

called by 317

iast-java/src/main/java/com/iast/astbenchmark/cli/tree/CaseNode.java

getMessage

called by 124

dast-java/src/main/java/com/alipay/antbenchmark/controller/User.java

getInputStream

called by 32

iast-java/src/main/java/com/iast/astbenchmark/config/wapper/MultiReadHttpServletRequest.java

printOSCommandResults

called by 27

dast-java/src/main/java/com/alipay/antbenchmark/tools/Utils.java

toString

called by 22

iast-java/src/main/java/com/iast/astbenchmark/cases/bean/big/BigSizeBean.java

format

called by 19

iast-java/src/main/java/com/iast/astbenchmark/cli/FormatResultUtil.java

collect

called by 14

iast-java/src/main/java/com/iast/astbenchmark/analyser/factory/CaseDataTransferStategyFactory.java

getName

called by 13

iast-java/src/main/java/com/iast/astbenchmark/cases/bean/big/BigOneBean.java

Shape

Method 1,259

Class 391

Function 16

Interface 5

Enum 4

Languages

Java99%

Python1%

Modules by API surface

iast-java/src/main/java/com/iast/astbenchmark/common/longd/LongChainUtil.java202 symbols

iast-java/src/test/java/com/iast/astbenchmark/AstbenchmarkApplicationTests.java175 symbols

iast-java/src/main/java/com/iast/astbenchmark/cli/test/CopyTestCaseForRun.java172 symbols

iast-java/src/main/java/com/iast/astbenchmark/cases/AstTaintCase002.java94 symbols

iast-java/src/main/java/com/iast/astbenchmark/cases/AstTaintCase004.java82 symbols

iast-java/src/main/java/com/iast/astbenchmark/cases/bean/big/BigOneBean.java52 symbols

iast-java/src/main/java/com/iast/astbenchmark/cases/AstTaintCase001.java43 symbols

iast-java/src/main/java/com/iast/astbenchmark/cases/AstTaintCase003.java18 symbols

iast-java/src/test/java/com/iast/astbenchmark/AstbenchmarkPrefTests.java14 symbols

iast-java/src/main/java/com/iast/astbenchmark/cli/FormatResultUtil.java13 symbols

dast-java/src/main/java/com/alipay/antbenchmark/tools/CrawlerSingle.java12 symbols

dast-java/src/main/java/com/alipay/antbenchmark/controller/ScannerStat/StatApiController.java11 symbols

Datastores touched

(mysql)Database · 1 repos

benchmarkDataBaseDatabase · 1 repos

For agents

$ claude mcp add ant-application-security-testing-benchmark \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact