Can complexity, coupling, and cohesion metrics be used as early indicators of vulnerabilities?

Chowdhury, Istehad; Zulkernine, Mohammad

doi:10.1145/1774088.1774504

Cited by 77 publications

(62 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…: Chowdhury and Zulkernine [17] in their study show that there is a correlation between code complexity and the appearance of vulnerabilities. Thus, we measure the complexity of the functions that were changed to remove the vulnerability and compare it with the complexity of the other functions located in the same source code file trying to see if we find the same correlation with Android vulnerabilities.…”

Section: ) Component Analysismentioning

confidence: 92%

Profiling Android Vulnerabilities

Jiménez

Papadakis

Bissyandé

et al. 2016

2016 IEEE International Conference on Software Quality, Reliability and Security (QRS)

View full text Add to dashboard Cite

Abstract-In widely used mobile operating systems a single vulnerability can threaten the security and privacy of billions of users. Therefore, identifying vulnerabilities and fortifying software systems requires constant attention and effort. However, this is costly and it is almost impossible to analyse an entire code base. Thus, it is necessary to prioritize efforts towards the most likely vulnerable areas. A first step in identifying these areas is to profile vulnerabilities based on previously reported ones. To investigate this, we performed a manual analysis of Android vulnerabilities, as reported in the National Vulnerability Database for the period 2008 to 2014. In our analysis, we identified a comprehensive list of issues leading to Android vulnerabilities. We also point out characteristics of the locations where vulnerabilities reside, the complexity of these locations and the complexity to fix the vulnerabilities. To enable future research, we make available all of our data.

show abstract

Section: ) Component Analysismentioning

confidence: 92%

Profiling Android Vulnerabilities

Jiménez

Papadakis

Bissyandé

et al. 2016

2016 IEEE International Conference on Software Quality, Reliability and Security (QRS)

View full text Add to dashboard Cite

show abstract

“…Although it is a relatively new area of research, a great number of VPMs has already been proposed in the related literature. As stated in [9], the main VPMs that can be found in the literature utilize software metrics [13][14][15][16][17][18][19][20][21][22], text mining [23][24][25][26][27][28], and security-related static analysis alerts [10,[29][30][31][32]] to predict vulnerabilities. These types of VPMs are analyzed in the rest of this section.…”

Section: Vulnerability Prediction Modelingmentioning

confidence: 99%

“…The weak relationship that was generally observed between complexity and vulnerabilities led to the need for incorporating additional metrics in vulnerability prediction. Towards this end, Chowdhury and Zulkernine [17], based on 52 releases of Mozilla Firefox, highlighted the ability of complexity, coupling, and cohesion (CCC) metrics to indicate the existence of vulnerabilities in software files. Based on this observation, the same authors proposed a framework for the automatic prediction of vulnerable files based on CCC metrics [18].…”

Section: Vulnerability Prediction Modelingmentioning

confidence: 99%

Static Analysis-Based Approaches for Secure Software Development

Siavvas

Gelenbe

Kehagias

et al. 2018

Communications in Computer and Information Science

View full text Add to dashboard Cite

Abstract. Software security is a matter of major concern for software development enterprises that wish to deliver highly secure software products to their customers. Static analysis is considered one of the most effective mechanisms for adding security to software products. The multitude of static analysis tools that are available provide a large number of raw results that may contain security-relevant information, which may be useful for the production of secure software. Several mechanisms that can facilitate the production of both secure and reliable software applications have been proposed over the years. In this paper, two such mechanisms, particularly the vulnerability prediction models (VPMs) and the optimum checkpoint recommendation (OCR) mechanisms, are theoretically examined, while their potential improvement by using static analysis is also investigated. In particular, we review the most significant contributions regarding these mechanisms, identify their most important open issues, and propose directions for future research, emphasizing on the potential adoption of static analysis for addressing the identified open issues. Hence, this paper can act as a reference for researchers that wish to contribute in these subfields, in order to gain solid understanding of the existing solutions and their open issues that require further research.

show abstract

“…However, heuristic approaches could be explored. For example, Chowdhury, and Zulkernine [32] find that software complexity, coupling, and cohesion metrics are correlated to vulnerabilities at a statistically significant level. While their research was focused on web browsers, an investigation of the applicability of the approach to operating system-scale software could be undertaken as one means to generate independent data for comparison to equation (5).…”

Section: B Future Workmentioning

confidence: 99%

Estimating Software Vulnerability Counts in the Context of Cyber Risk Assessments

Llansó¹,

McNeil²

2018

Proceedings of the 51st Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Abstract-Stakeholders often conduct cyber risk assessments as a first step towards understanding and managing their risks due to cyber use. Many risk assessment methods in use today include some form of vulnerability analysis. Building on prior research and combining data from several sources, this paper develops and applies a metric to estimate the proportion of latent vulnerabilities to total vulnerabilities in a software system and applies the metric to five scenarios involving software on the scale of operating systems. The findings suggest caution in interpreting the results of cyber risk methodologies that depend on enumerating known software vulnerabilities because the number of unknown vulnerabilities in large-scale software tends to exceed known vulnerabilities.

show abstract

Can complexity, coupling, and cohesion metrics be used as early indicators of vulnerabilities?

Cited by 77 publications

References 14 publications

Profiling Android Vulnerabilities

Profiling Android Vulnerabilities

Static Analysis-Based Approaches for Secure Software Development

Estimating Software Vulnerability Counts in the Context of Cyber Risk Assessments

Contact Info

Product

Resources

About