Evaluating micro patterns and software metrics in vulnerability prediction

Kazi Zakia Sultana, Byron J. Williams

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

3 Scopus citations

Abstract

Software security is an important aspect of ensuring software quality. Early detection of vulnerable code during development is essential for the developers to make cost and time effective software testing. The traditional software metrics are used for early detection of software vulnerability, but they are not directly related to code constructs and do not specify any particular granularity level. The goal of this study is to help developers evaluate software security using class-level traceable patterns called micro patterns to reduce security risks. The concept of micro patterns is similar to design patterns, but they can be automatically recognized and mined from source code. If micro patterns can better predict vulnerable classes compared to traditional software metrics, they can be used in developing a vulnerability prediction model. This study explores the performance of class-level patterns in vulnerability prediction and compares them with traditional class-level software metrics. We studied security vulnerabilities as reported for one major release of Apache Tomcat, Apache Camel and three stand-alone Java web applications. We used machine learning techniques for predicting vulnerabilities using micro patterns and class-level metrics as features. We found that micro patterns have higher recall in detecting vulnerable classes than the software metrics.

Original languageEnglish
Title of host publicationSoftwareMining 2017 - Proceedings of the 2017 6th IEEE/ACM International Workshop on Software Mining, co-located with ASE 2017
EditorsXiaoyin Wang, Ming Li, David Lo
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages40-47
Number of pages8
ISBN (Electronic)9781538613894
DOIs
StatePublished - 7 Nov 2017
Event6th IEEE/ACM International Workshop on Software Mining, SoftwareMining 2017 - Urbana-Champaign, United States
Duration: 3 Nov 2017 → …

Publication series

NameSoftwareMining 2017 - Proceedings of the 2017 6th IEEE/ACM International Workshop on Software Mining, co-located with ASE 2017

Conference

Conference6th IEEE/ACM International Workshop on Software Mining, SoftwareMining 2017
CountryUnited States
CityUrbana-Champaign
Period3/11/17 → …

Fingerprint Dive into the research topics of 'Evaluating micro patterns and software metrics in vulnerability prediction'. Together they form a unique fingerprint.

Cite this