View in EDS PDF Full Text

AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts.

Saved in:
Bibliographic Details
Title: AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts.
Authors: Basak, Setu Kumar1 sbasak4@ncsu.edu, English, K. Virgil1 kvenglis@ncsu.edu, Ogura, Ken1 kogura@ncsu.edu, Kambara, Vitesh1 vkkambar@ncsu.edu, Reaves, Bradley1 bgreaves@ncsu.edu, Williams, Laurie1 lawilli3@ncsu.edu
Source: ICSE: International Conference on Software Engineering. 2025, p1416-1428. 13p.
Subjects: Data flow computing, False alarms, Data extraction, Computer software security
Abstract: GitGuardian monitored secrets exposure in public GitHub repositories and reported that developers leaked over 12 million secrets (database and other credentials) in 2023, indicating a 113% surge from 2021. Despite the availability of secret detection tools, developers ignore the tools' reported warnings because of false positives (25%-99%). However, each secret protects assets of different values accessible through asset identifiers (a DNS name and a public or private IP address). The asset information for a secret can aid developers in filtering false positives and prioritizing secret removal from the source code. However, existing secret detection tools do not provide the asset information, thus presenting difficulty to developers in filtering secrets only by looking at the secret value or finding the assets manually for each reported secret. The goal of our study is to aid software practitioners in prioritizing secrets removal by providing the assets information protected by the secrets through our novel static analysis tool. We present AssetHarvester, a static analysis tool to detect secret-asset pairs in a repository. Since the location of the asset can be distant from where the secret is defined, we investigated secret-asset co-location patterns and found four patterns. To identify the secret-asset pairs of the four patterns, we utilized three approaches (pattern matching, data flow analysis, and fast-approximation heuristics). We curated a benchmark of 1,791 secret-asset pairs of four database types extracted from 188 public GitHub repositories to evaluate the performance of AssetHarvester. AssetHarvester demonstrates precision of (97%), recall (90%), and F1-score (94%) in detecting secret-asset pairs. Our findings indicate that data flow analysis employed in Asset-Harvester detects secret-asset pairs with 0% false positives and aids in improving the recall of secret detection tools. Additionally, AssetHarvester shows 43% increase in precision for database secret detection compared to existing detection tools through the detection of assets, thus reducing developer's alert fatigue. [ABSTRACT FROM AUTHOR]
Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database: Engineering Source
FullText Links:
  – Type: pdflink
Text:
  Availability: 0
Header DbId: egs
DbLabel: Engineering Source
An: 194043460
AccessLevel: 6
PubType: Conference
PubTypeId: conference
PreciseRelevancyScore: 0
IllustrationInfo
Items – Name: Title
  Label: Title
  Group: Ti
  Data: AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts.
– Name: Author
  Label: Authors
  Group: Au
  Data: <searchLink fieldCode="AR" term="%22Basak%2C+Setu+Kumar%22">Basak, Setu Kumar</searchLink><relatesTo>1</relatesTo><i> sbasak4@ncsu.edu</i><br /><searchLink fieldCode="AR" term="%22English%2C+K%2E+Virgil%22">English, K. Virgil</searchLink><relatesTo>1</relatesTo><i> kvenglis@ncsu.edu</i><br /><searchLink fieldCode="AR" term="%22Ogura%2C+Ken%22">Ogura, Ken</searchLink><relatesTo>1</relatesTo><i> kogura@ncsu.edu</i><br /><searchLink fieldCode="AR" term="%22Kambara%2C+Vitesh%22">Kambara, Vitesh</searchLink><relatesTo>1</relatesTo><i> vkkambar@ncsu.edu</i><br /><searchLink fieldCode="AR" term="%22Reaves%2C+Bradley%22">Reaves, Bradley</searchLink><relatesTo>1</relatesTo><i> bgreaves@ncsu.edu</i><br /><searchLink fieldCode="AR" term="%22Williams%2C+Laurie%22">Williams, Laurie</searchLink><relatesTo>1</relatesTo><i> lawilli3@ncsu.edu</i>
– Name: TitleSource
  Label: Source
  Group: Src
  Data: <searchLink fieldCode="JN" term="%22ICSE%3A+International+Conference+on+Software+Engineering%22">ICSE: International Conference on Software Engineering</searchLink>. 2025, p1416-1428. 13p.
– Name: Subject
  Label: Subjects
  Group: Su
  Data: <searchLink fieldCode="DE" term="%22Data+flow+computing%22">Data flow computing</searchLink><br /><searchLink fieldCode="DE" term="%22False+alarms%22">False alarms</searchLink><br /><searchLink fieldCode="DE" term="%22Data+extraction%22">Data extraction</searchLink><br /><searchLink fieldCode="DE" term="%22Computer+software+security%22">Computer software security</searchLink>
– Name: Abstract
  Label: Abstract
  Group: Ab
  Data: GitGuardian monitored secrets exposure in public GitHub repositories and reported that developers leaked over 12 million secrets (database and other credentials) in 2023, indicating a 113% surge from 2021. Despite the availability of secret detection tools, developers ignore the tools' reported warnings because of false positives (25%-99%). However, each secret protects assets of different values accessible through asset identifiers (a DNS name and a public or private IP address). The asset information for a secret can aid developers in filtering false positives and prioritizing secret removal from the source code. However, existing secret detection tools do not provide the asset information, thus presenting difficulty to developers in filtering secrets only by looking at the secret value or finding the assets manually for each reported secret. The goal of our study is to aid software practitioners in prioritizing secrets removal by providing the assets information protected by the secrets through our novel static analysis tool. We present AssetHarvester, a static analysis tool to detect secret-asset pairs in a repository. Since the location of the asset can be distant from where the secret is defined, we investigated secret-asset co-location patterns and found four patterns. To identify the secret-asset pairs of the four patterns, we utilized three approaches (pattern matching, data flow analysis, and fast-approximation heuristics). We curated a benchmark of 1,791 secret-asset pairs of four database types extracted from 188 public GitHub repositories to evaluate the performance of AssetHarvester. AssetHarvester demonstrates precision of (97%), recall (90%), and F1-score (94%) in detecting secret-asset pairs. Our findings indicate that data flow analysis employed in Asset-Harvester detects secret-asset pairs with 0% false positives and aids in improving the recall of secret detection tools. Additionally, AssetHarvester shows 43% increase in precision for database secret detection compared to existing detection tools through the detection of assets, thus reducing developer's alert fatigue. [ABSTRACT FROM AUTHOR]
– Name: AbstractSuppliedCopyright
  Label:
  Group: Ab
  Data: <i>Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.)
PLink https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=194043460
RecordInfo BibRecord:
  BibEntity:
    Languages:
      – Code: eng
        Text: English
    PhysicalDescription:
      Pagination:
        PageCount: 13
        StartPage: 1416
    Subjects:
      – SubjectFull: Data flow computing
        Type: general
      – SubjectFull: False alarms
        Type: general
      – SubjectFull: Data extraction
        Type: general
      – SubjectFull: Computer software security
        Type: general
    Titles:
      – TitleFull: AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts.
        Type: main
  BibRelationships:
    HasContributorRelationships:
      – PersonEntity:
          Name:
            NameFull: Basak, Setu Kumar
      – PersonEntity:
          Name:
            NameFull: English, K. Virgil
      – PersonEntity:
          Name:
            NameFull: Ogura, Ken
      – PersonEntity:
          Name:
            NameFull: Kambara, Vitesh
      – PersonEntity:
          Name:
            NameFull: Reaves, Bradley
      – PersonEntity:
          Name:
            NameFull: Williams, Laurie
    IsPartOfRelationships:
      – BibEntity:
          Dates:
            – D: 01
              M: 01
              Text: 2025
              Type: published
              Y: 2025
          Titles:
            – TitleFull: ICSE: International Conference on Software Engineering
              Type: main
ResultId 1