# An Empirical Study of Rule-Based and Learning-Based Approaches for Static Application Security Testing

arXiv: https://arxiv.org/abs/2107.01921 · HTML: https://mlsanity.com/paper/2107.01921/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Jul 2021.

## Built on by (most cited first, 7 of 7)

- [Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection](https://mlsanity.com/paper/2407.16235/) (2024)
- [Automatic Data Labeling for Software Vulnerability Prediction Models: How Far Are We?](https://mlsanity.com/paper/2407.17803/) (2024)
- [Data Quality Issues in Vulnerability Detection Datasets](https://mlsanity.com/paper/2410.06030/) (2024)
- [AI for DevSecOps: A Landscape and Future Opportunities](https://mlsanity.com/paper/2404.04839/) (2024)
- [How to Find Actionable Static Analysis Warnings: A Case Study with FindBugs](https://mlsanity.com/paper/2205.10504/) (2022)
- [MVD: A Multi-Lingual Software Vulnerability Detection Framework](https://mlsanity.com/paper/2412.06166/) (2024)
- [Learning to Quantize Vulnerability Patterns and Match to Locate Statement-Level Vulnerabilities](https://mlsanity.com/paper/2306.06109/) (2023)

## Abstract (arXiv)

Background: Static Application Security Testing (SAST) tools purport to assist developers in detecting security issues in source code. These tools typically use rule-based approaches to scan source code for security vulnerabilities. However, due to the significant shortcomings of these tools (i.e., high false positive rates), learning-based approaches for Software Vulnerability Prediction (SVP) are becoming a popular approach. Aims: Despite the similar objectives of these two approaches, their comparative value is unexplored. We provide an empirical analysis of SAST tools and SVP models, to identify their relative capabilities for source code security analysis. Method: We evaluate the detection and assessment performance of several common SAST tools and SVP models on a variety of vulnerability datasets. We further assess the viability and potential benefits of combining the two approaches. Results: SAST tools and SVP models provide similar detection capabilities, but SVP models exhibit better overall performance for both detection and assessment. Unification of the two approaches is difficult due to lacking synergies. Conclusions: Our study generates 12 main findings which provide insights into the capabilities and synergy of these two approaches. Through these observations we provide recommendations for use and improvement.