The project in five facts.
Challenge, approach and results.
The diploma thesis addresses the field of static code analysis (SAST) as an important mechanism for early detection of security vulnerabilities in software. For the first part of the tool comparison, the standardised OWASP Benchmark Java test suite was used, as this approach enables more structured and comparable evaluation of results on the same set of test cases. As the second part of the comparison, a custom Java application was created in which the impact and functionality of the tools were tested during the development process.
Solution and Method
The diploma thesis addresses the field of static code analysis (SAST) as an important mechanism for early detection of security vulnerabilities in software. The purpose of the research is to compare the performance of two open-source static analysis tools, SonarQube CE and Semgrep CE, and to evaluate their effectiveness in detecting typical security vulnerabilities in Java applications. The theoretical part examines the general importance of cybersecurity, static code analysis, and the description and documentation of both code analysis tools.
In the practical part, the tools Semgrep CE and SonarQube CE are tested in the Java programming language, and vulnerabilities such as SQL injection, XSS (Cross-Site Scripting), and Path Traversal type vulnerability are deliberately implemented in the application.
Results
For the first part of the tool comparison, the standardised OWASP Benchmark Java test suite was used, as this approach enables more structured and comparable evaluation of results on the same set of test cases. As the second part of the comparison, a custom Java application was created in which the impact and functionality of the tools were tested during the development process. This division of the practical part enabled the tools to be tested both on a more standardised test set and on a smaller custom development example.
This allowed the comparison to be carried out from the perspective of detection success and from the perspective of actual use of the tools when working with source code. The tools were prepared in a uniform test environment, followed by analysis and systematic comparison of detected results. Special attention was paid to detection accuracy, the number of false positive results, and the user experience when using the tools, particularly from a beginner's perspective.
The aim of the diploma thesis was to assess the suitability of both approaches for use in an educational environment and for developers with less experience in the field of cybersecurity. The diploma thesis thus contributes to understanding the practical usability of modern SAST tools and their limitations in detecting security vulnerabilities.
Module, programme and stories.
Your diploma project for a real company.
A diploma thesis at Academia solves a challenge from a company – often the one where you do your 800 hours of placement. Read about the Programsko inženirstvo module or book a consultation.