rtm

Effectiveness of Static vs Dynamic Code Analysis Tools in Detecting Software Vulnerabilities

This project is a research study comparing static and dynamic code analysis tools — specifically SonarQube and OWASP ZAP — in their ability to detect software vulnerabilities. The evaluation was conducted using the OWASP WebGoat benchmark application and assessed tools across accuracy, false positive rate, vulnerability coverage, OWASP Top 10 detection, and scan speed. The research paper and findings are included in this repository. Course: CSS 410 — Research Tools and Methods | SDU University, 2026 Author: Arystan Sadyr | Student ID: 230107042