{"id":{"repo_id":"vt","oai_identifier":"oai:vtechworks.lib.vt.edu:10919/119154"},"canonical_url":"https://search.dev.ndltd.org/etd/vt/oai:vtechworks.lib.vt.edu:10919/119154","repository":{"repo_id":"vt","name":"Virginia Tech","base_url":"https://vtechworks.lib.vt.edu/oai/request"},"display":{"title":"J-WAVE: A Java Web Application for Vulnerability Education","abstract":"Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course.","abstract_html":"Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course.","abstract_has_math":false,"creators":["Kyer, Michael Alexander"],"institution":"Virginia Tech","degree_name":"Master of Science","degree_level":"masters","degree_discipline":"Computer Science & Applications","degree_department":"Computer Science and#38; Applications","school":null,"contributors":[],"advisors":[],"committee_chairs":["Edwards, Stephen H."],"committee_members":["Gray, David Todd","Kulczycki, Gregory W."],"year":2024,"date_issued":"2024-05-28","date_published":"2024-05-28","updated_at":"2026-07-22T22:20:11Z","subjects":["Vulnerability education","SAST","vulnerability analysis"],"languages":["en"],"rights":["In Copyright"],"rights_urls":["http://rightsstatements.org/vocab/InC/1.0/"],"identifier_entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:39878"],"render_values":[{"text":"vt_gsexam:39878","href":null,"code":true}]}]},"links":{"outbound_url":"https://hdl.handle.net/10919/119154","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.committeechair","label":"Committee Chair","values":["Edwards, Stephen H."]},{"key":"dc:contributor.committeemember","label":"Committee Member","values":["Gray, David Todd","Kulczycki, Gregory W."]},{"key":"dc:contributor.department","label":"Department","values":["Computer Science and#38; Applications"]},{"key":"dc:creator","label":"Author","values":["Kyer, Michael Alexander"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2024-05-29T08:02:18Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2024-05-29T08:02:18Z"]},{"key":"dc:date.issued","label":"Date","values":["2024-05-28"]},{"key":"dc:publisher","label":"Institution","values":["Virginia Tech"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science & Applications"]},{"key":"thesis:degree_level","label":"Degree Level","values":["masters"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master of Science"]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["Virginia Polytechnic Institute and State University"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Vulnerability education","SAST","vulnerability analysis"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["In Copyright"]},{"key":"dc:rights.uri","label":"Rights URI","values":["http://rightsstatements.org/vocab/InC/1.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:39878"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/10919/119154"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course."]},{"key":"dc:description.abstractgeneral","label":"General Abstract","values":["Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["Master of Science"]},{"key":"dc:format.medium","label":"Dc Format Medium","values":["ETD"]},{"key":"dc:title","label":"Title","values":["J-WAVE: A Java Web Application for Vulnerability Education"]}]}],"canonical_facts":{"dc:contributor.committeechair":["Edwards, Stephen H."],"dc:contributor.committeemember":["Gray, David Todd","Kulczycki, Gregory W."],"dc:contributor.department":["Computer Science and#38; Applications"],"dc:creator":["Kyer, Michael Alexander"],"dc:date.accessioned":["2024-05-29T08:02:18Z"],"dc:date.available":["2024-05-29T08:02:18Z"],"dc:date.issued":["2024-05-28"],"dc:description.abstract":["Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course."],"dc:description.abstractgeneral":["Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube. Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems. However, different tools should be prioritized depending on what files are being scanned. PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course."],"dc:description.degree":["Master of Science"],"dc:format.medium":["ETD"],"dc:identifier.other":["vt_gsexam:39878"],"dc:identifier.uri":["https://hdl.handle.net/10919/119154"],"dc:language.iso":["en"],"dc:publisher":["Virginia Tech"],"dc:rights":["In Copyright"],"dc:rights.uri":["http://rightsstatements.org/vocab/InC/1.0/"],"dc:subject":["Vulnerability education","SAST","vulnerability analysis"],"dc:title":["J-WAVE: A Java Web Application for Vulnerability Education"],"dc:type":["Thesis"],"thesis:degree_discipline":["Computer Science & Applications"],"thesis:degree_level":["masters"],"thesis:degree_name":["Master of Science"],"thesis:institution_name":["Virginia Polytechnic Institute and State University"]},"updated_at":"2026-07-22T22:20:11Z"}