A vulnerability analysis and prediction framework

Williams, Mark A.; Barranco, Roberto Camacho; Naim, Sheikh Motahar; Dey, Sumi; Hossain, M. Shahriar; Akbar, Monika

doi:10.1016/j.cose.2020.101751

Cited by 19 publications

(12 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…--In P1 [6], researchers classify software artifacts with vulnerabilities by finding a correlation between vulnerabilities and the evolution of the vulnerabilities from its genesis. Based on the evolution of a specific vulnerability, P1 [6] also predicts future appearance probabilities of vulnerability groups. P3 [54] used a fault prediction model to build a vulnerability classification model using metrics such as complexity, code churn, and fault history.…”

Section: A Answer To Rq1: What Research Topics Have Been Investigatementioning

confidence: 99%

“…Prediction models constructed from the above-mentioned proposed research suffer from a high false-positive rate (P1, P4, P5, P7, P13, P14, P16, P35, P42, P45). Vulnerability classification can exhibit a decrease in recall with an increase of precision for a certain range of classification thresholds as shown in P1 [6]. Classifying Vulnerability Categories: This topic includes publications that construct models to classify the categories of vulnerabilities.…”

Section: --P7 [58] Proposed a Novel Approach Called 'Ltrwes'mentioning

confidence: 99%

“…The prevalence of vulnerabilities has motivated researchers [2]- [6] to systematically study vulnerabilities in software by mining security bug reports used in open source software (OSS) projects. Security bug reports are reports from bug tracking systems that include descriptions and resolutions of security vulnerabilities that occur in software projects.…”

Section: Introductionmentioning

confidence: 99%

“…We perform an SMS following the guidelines of Petersen et al [7] to synthesize publications that use security bug reports for software vulnerability research. First, we search five scholar databases namely, IEEE Xplore 3 , ACM Digital Library 4 , ScienceDirect 5 , Wiley Online Library 6 , and Springer Link 7 . Using two search strings, we obtain a set of 45,077 publications from the software engineering (SE) domain that were published from 2000 to August 2020.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Security Bug Report Usage for Software Vulnerability Research: A Systematic Mapping Study

Bhuiyan¹,

Sharif²,

Rahman³

2021

IEEE Access

View full text Add to dashboard Cite

Context: Security bug reports are reports from bug tracking systems that include descriptions and resolutions of security vulnerabilities that occur in software projects. Researchers use security bug reports to conduct research related to software vulnerabilities. A mapping study of publications that use security bug reports can inform researchers on (i) the research topics that have been investigated, and (ii) potential research avenues in the field of software vulnerabilities. Objective: The objective of this paper is to help researchers identify research gaps related to software vulnerabilities by conducting a systematic mapping study of research publications that use security bug reports. Method: We perform a systematic mapping study of research that use security bug reports for software vulnerability research by searching five scholar databases: (i) IEEE Xplore, (ii) ACM Digital Library, (iii) ScienceDirect, (iv) Wiley Online Library, and (v) Springer Link. From the five scholar databases, we select 46 publications that use security bug reports by systematically applying inclusion and exclusion criteria. Using qualitative analysis, we identify research topics investigated in our collected set of publications. Results: We identify three research topics that are investigated in our set of 46 publications. The three topics are: (i) vulnerability classification; (ii) vulnerability report summarization; and (iii) vulnerability dataset construction. Of the studied 46 publications, 42 publications focus on vulnerability classification. Conclusion: Findings from our mapping study can be leveraged to identify research opportunities in the domains of software vulnerability classification and automated vulnerability repair techniques.

show abstract

Section: A Answer To Rq1: What Research Topics Have Been Investigatementioning

confidence: 99%

Section: --P7 [58] Proposed a Novel Approach Called 'Ltrwes'mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Security Bug Report Usage for Software Vulnerability Research: A Systematic Mapping Study

Bhuiyan¹,

Sharif²,

Rahman³

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…In (Williams et al, 2020) a framework that uses Topically Supervised Evolution Model (TSEM) model to discover relationships between vulnerabilities and predisposition of software products to attacks and risks is proposed. This work presents the labels of each vulnerability that was analyzed.…”

Section: Introductionmentioning

confidence: 99%

Automated Analysis of Topics on Security in Research Papers

Pocatilu¹,

Zamfiroiu²,

Apostol³

2020

STUD INFORM CONTROL

View full text Add to dashboard Cite

Forecasting the Number of Bugs and Vulnerabilities in Software Components Using Neural Network Models

Cosma¹,

Pop²,

Sabo³

et al. 2022

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

The frequency of cyber attacks has been rising rapidly lately, which is a major concern. Because each attack exploits one or more vulnerabilities in the software components that make up the targeted system, the number of vulnerabilities is an indication of the level of security and trust that these components provide. In addition to vulnerabilities, the security of a component can also be affected by software bugs, as they can turn into weaknesses, which if exploited can become vulnerabilities. This paper presents a comparison of several types of neural networks for forecasting the number of software bugs and vulnerabilities that will be discovered for a software component in certain timeframe, in terms of accuracy, trainability and stability to configuration parameters.

show abstract

A vulnerability analysis and prediction framework

Cited by 19 publications

References 16 publications

Security Bug Report Usage for Software Vulnerability Research: A Systematic Mapping Study

Security Bug Report Usage for Software Vulnerability Research: A Systematic Mapping Study

Automated Analysis of Topics on Security in Research Papers

Forecasting the Number of Bugs and Vulnerabilities in Software Components Using Neural Network Models

Contact Info

Product

Resources

About