PRACTICAL ASPECTS OF USING CRYPTOGRAPHIC METHODS TO PROTECT DATABASES FROM UNAUTHORIZED ACCESS

Abstract

This paper analyzes the current state of static application security testing (SAST), a key component of DevSecOps practices. It provides an overview of the fundamental methodologies underlying SAST tools: from rule-based and pattern-based syntactic analysis that works with abstract syntax trees (ASTs) to more complex semantic approaches such as data flow analysis (DFA) on control flow graphs (CFGs), abstract interpretation, and symbolic execution. The central element of the study is an empirical comparison of three leading open source tools: SonarQube, which evolved from a code quality control platform; Semgrep, which focuses on speed and ease of integration into CI/CD; and GitHub CodeQL, which takes an innovative approach to representing code as a relational database for deep semantic analysis. To objectively assess their performance, a standardized set of OWASP Benchmark tests was used, which allowed us to measure key metrics: Precision, Recall, F1-Score, and False Positive Rate (FPR). The results of the quantitative analysis revealed significant differences: CodeQL demonstrated the highest balanced efficiency (F1-Score = 87.8%) due to its high completeness in detecting complex vulnerabilities associated with data flows, albeit at the expense of long scanning times; Semgrep provided the optimal ratio of speed and accuracy (F1-Score = 70.3%), making it suitable for rapid iterations in CI/CD pipelines; instead, SonarQube showed the lowest efficiency (F1-Score = 49.8%), missing more than 60% of real vulnerabilities, which confirms the limitations of non-specialized solutions in security tasks. The study proves that choosing a SAST tool is not only a technical but also a strategic decision that requires careful analysis of the trade-offs between depth of analysis, level of "noise", and speed of integration to form an effective and balanced web application security program.