Predicting Vulnerable Software Components via Text Mining

By Riccardo Scandariato, J. Walden, A. Hovsepyan, Wouter Joosen. IEEE Transactions on Software Engineering, 2014

342 citations recorded by the source corpus.

This paper presents an approach based on machine learning to predict which components of a software application contain security vulnerabilities. The approach is based on text mining the source code of the components. Namely, each component is characterized as a series of terms contained in its source code, with the associated frequencies. These features are used to forecast whether each component is likely to contain vulnerabilities. In an exploratory validation with 20 Android applications, we discovered that a dependable prediction model can be built. Such model could be useful to prioritize the validation activities, e.g., to identify the components needing special scrutiny.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/d713d6b8f76e848d870ede64e3915d052db620b9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Tien Nhut Nguyen
2. Shaohua Wang
3. Yi Li
4. Denys Poshyvanyk
5. David Lo
6. Sheng Wen
7. Qing-Long Han
8. Mario Linares Vásquez

In Software

1. Shaohua Wang
2. Yi Li
3. Tien Nhut Nguyen
4. Yang Xiang
5. Jun Zhang
6. Denys Poshyvanyk
7. David Lo
8. Sheng Wen

In Signal Processing

1. Yang Xiang
2. Jun Zhang
3. Tien Nhut Nguyen
4. Shaohua Wang
5. Yi Li
6. David Lo
7. Sheng Wen
8. Denys Poshyvanyk

Citations in the corpus

• Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques (2017, methodology): “Some previous studies employ naive approaches based on very limited or shallow information about the program (e.g., Scandariato et al. (2014)).”
• Vulnerability detection with fine-grained interpretations (2021, background): “Various ML-based approaches have been built on top of distinct metrics, such as terms and their occurrence frequencies [29], imports and function calls [23], complexity, code churn, and developer activity [31], dependency relation [22], API symbols and subtrees [34, 35].”
• Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, methodology): “For instance, the bag-of-words technique was applied to convert tokens in the source code to vector representations which were then used as feature sets for classification [88].”
• RCLinker: Automated Linking of Issue Reports and Commits Leveraging Rich Contextual Information (2015, positive): “proposed a vulnerability prediction model learned from text features extracted from source code files to predict which components of a software application are more likely to contain security vulnerabilities [53].”