论文标题
嗅探代码库的秘密泄漏，并在行业中有已知的生产秘密
Sniffing for Codebase Secret Leaks with Known Production Secrets in Industry
论文作者
论文摘要
代码库中泄漏的秘密（例如密码和API密钥）造成了许多安全漏洞。存在现有的启发式技术，例如模式匹配，熵分析和机器学习，以检测和提醒开发人员此类泄漏。然而，启发式方法自然会表现出误报，这需要分盘，并可能导致开发人员的挫败感。我们建议将已知的生产秘密作为地面真相的来源，以嗅探代码库中的秘密泄漏。我们开发了使用已知秘密来嗅探整个代码库并不断嗅探差分代码修订的技术。在工业环境中，在这两种情况下嗅探已知秘密时，我们会发现不同的绩效和安全需求。
Leaked secrets, such as passwords and API keys, in codebases were responsible for numerous security breaches. Existing heuristic techniques, such as pattern matching, entropy analysis, and machine learning, exist to detect and alert developers of such leaks. Heuristics, however, naturally exhibit false positives, which require triaging and can lead to developer frustration. We propose to use known production secrets as a source of ground truth for sniffing secret leaks in codebases. We develop techniques for using known secrets to sniff whole codebases and continuously sniff differential code revisions. We uncover different performance and security needs when sniffing for known secrets in these two situations in an industrial environment.
