Predicting vulnerable software components

By Stephan Neuhaus, Thomas Zimmermann, Christian Holler, Andreas Zeller. Conference on Computer and Communications Security, 2007

450 citations recorded by the source corpus.

Subfields: Information Systems, Software

View Paper: https://www.semanticscholar.org/paper/c345afb7e360ba33d735cefca73fb56561381954

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

Citations in the corpus

An extensive comparison of bug prediction approaches (2010, unknown): “used a variety of features of Mozilla (past bugs, package imports, call structure) to detect vulnerabilities [21].”
Fair and balanced?: bias in bug-fix datasets (2009, unknown): “Consequently, this type of data is at the core of much work on bug prediction [36] [43] [25] [37].”
Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks (2019, unknown): “In these early methods [9–11], features or patterns hand-crafted by human experts are taken as inputs by machine learning algorithms to detect vulnerabilities.”
Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, background): “Researchers have applied source-code-based features such as imports (e.g., header ﬁles), function calls [73], software complexity metrics, and code changes [94]–[96] as indicators for identifying potentially vulnerable ﬁles or code snippets.”
Vulnerability detection with fine-grained interpretations (2021, background): “Various ML-based approaches have been built on top of distinct metrics, such as terms and their occurrence frequencies [29], imports and function calls [23], complexity, code churn, and developer activity [31], dependency relation [22], API symbols and subtrees [34, 35].”
VUDDY: A Scalable Approach for Vulnerable Code Clone Discovery (2017, background): “In addition, even if we succeed to replicate the working environment, the source code may not be complete or may contain syntax errors, which blights the whole parsing procedure [36], [37].”
Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities (2011, background): “[30] predicted vulnerabilities on the entire Mozilla open-source project (not specific to Firefox) by analyzing the import (header file inclusion) and function call relationship between components.”
Evaluating defect prediction approaches: a benchmark and an extensive comparison (2011, unknown): “Neuhaus et al. (2007) used a variety of features of Mozilla (past bugs, package imports, call structure) to detect vulnerabilities.”
SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities (2018, methodology): “, imports and function calls [8], complexity [44], [45], code churn and developer activity [45], [46]), but predict vulnerabilities at a coarse granularity (e.”
Fuzzing with Code Fragments (2012, background): “In web browsers, the JavaScript interpreter is particularly prone to security issues; in Mozilla Firefox, for instance, it encompasses the majority of vulnerability fixes [13].”
Predicting Vulnerable Software Components via Text Mining (2014, methodology): “The authors’ initial results demonstrated that there is a correlation (albeit weak) between complexity TABLE 1 Vulnerability Prediction Models in the Related Work Study Predictors used Vulnerability sources Prediction technique Applications Performance Shin et al. [5] software metrics, code churn, d”