Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities

By Yonghee Shin, Andrew Meneely, Laurie A. Williams, Jason A. Osborne. IEEE Transactions on Software Engineering, 2011

617 citations recorded by the source corpus.

Subfields: Information Systems, Software

View Paper: https://www.semanticscholar.org/paper/f2b119aa69f97cade98ac623fb64bee65b0ad8a2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Tien Nhut Nguyen
2. Shaohua Wang
3. Yi Li
4. Hamid Reza Shahriari
5. Seyed Mohammad Ghaffarian
6. Jaechang Nam
7. Sinno Jialin Pan
8. Sheng Wen

In Software

1. Hamid Reza Shahriari
2. Seyed Mohammad Ghaffarian
3. Jaechang Nam
4. Shaohua Wang
5. Yi Li
6. Sinno Jialin Pan
7. Yang Xiang
8. Jun Zhang

Citations in the corpus

• Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques (2017, background): “The authors claim that the more complete vulnerability information contributes to this improvement, and justify their claim by comparing the proposed approach with a replication of a previous work by Shin et al. (2011).”
• Predicting Vulnerable Software Components via Text Mining (2014, background): “…metrics MFSA / CVE / Bugzilla Logistic regression Firefox JS Engine recall: 3-93%, accuracy: 43-98%, fall-out: 0-58% Chowdhury et al. [12] complexity, coupling and cohesion metrics MFSA / Bugzilla Na€ıve bayes, C4.5 Decision Tree, Random Forest, Logistic regression Firefox C4.5 decision tree…”
• Transfer defect learning (2013, background): “Transfer learning may benefit other prediction and recommendation systems [57], [58].”
• SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities (2018, background): “, imports and function calls [8], complexity [44], [45], code churn and developer activity [45], [46]), but predict vulnerabilities at a coarse granularity (e.”
• Software Vulnerability Detection Using Deep Neural Networks: A Survey (2020, background): “Researchers have applied source-code-based features such as imports (e.g., header files), function calls [73], software complexity metrics, and code changes [94]–[96] as indicators for identifying potentially vulnerable files or code snippets.”
• Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks (2019, neutral): “In these early methods [9–11], features or patterns hand-crafted by human experts are taken as inputs by machine learning algorithms to detect vulnerabilities.”
• An empirical study on software defect prediction with a simplified metric set (2014, methodology): “ using other data sets. Another threat to external validity concerns the choice of software metrics used to construct predictors. Although we used only static code metrics available in the literature [2, 8, 19, 36, 37], we are aware that other types of software metrics could exhibit dierent results.”
• Vulnerability detection with fine-grained interpretations (2021, methodology): “Automated vulnerability detection (VD) approaches can be broadly classified into two categories: program analysis (PA)-based [1, 2, 7–9, 33] and machine learning (ML)based [23, 28, 30].”