Empirical studies on the impact of filter‐based ranking feature selection on security vulnerability prediction

Abstract

Security vulnerability prediction (SVP) can construct models to identify potentially vulnerable program modules via machine learning. Two kinds of features from different points of view are used to measure the extracted modules in previous studies. One kind considers traditional software metrics as features, and the other kind uses text mining to extract term vectors as features. Therefore, gathered SVP data sets often have numerous features and result in the curse of dimensionality. In this article, we mainly investigate the impact of filter-based ranking feature selection (FRFS) methods on SVP, since other types of feature selection methods have too much computational cost. In empirical studies, we first consider three real-world large-scale web applications. Then we consider seven methods from three FRFS categories for FRFS and use a random forest classifier to construct SVP models. Final results show that given the similar code inspection cost, using FRFS can improve the performance of SVP when compared with state-of-the-art baselines. Moreover, we use McNemar's test to perform diversity analysis on identified vulnerable modules by using different FRFS methods, and we are surprised to find that almost all the FRFS methods can identify similar vulnerable modules via diversity analysis.This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Privacy-aware examination results ranking for the balance between teachers and mothers

“…Therefore, in our future academic research, we will aim to further improve the proposed PERR method by considering the weights of different dimensions to enlarge the application scope of PERR. In addition, we will continue to investigate the possibility of integrating our privacy-aware PERR solution with other classical privacy-preservation techniques, such as blockchain [31][32][33] , differential privacy [34,35] , anonymization [36] , and program code analyses [37,38] . Moreover, computation offloading is often necessary, especially in a big data environment [39][40][41][42][43][44][45] .…”

A Systematic Literature Review on Software Vulnerability Prediction Models

“…respectively. Only two studies [46] and [73] used a combination of metrics and text features. Three studies [32], [33], and [39] have utilized patterns, and four studies [7], [13], [16], and [68] used code attributes.…”

“…The experimental research shows that this procedure cuts training time by roughly 68%. In [73], it is mentioned that SVP data sets frequently include several features, which leads to the dimensionality curse. Since other forms of feature selection methods have a high computational cost, the focus of this paper is on the effect of filter-based ranking feature selection (FRFS) approaches on SVP.…”

Efficient Feature Selection for Static Analysis Vulnerability Prediction

“…Many works have been done considering the evaluation of different static code analyzers (e.g., [55] for C/C++), but the number of works considering the analysis of the suitability of features generated by them for the purpose of vulnerability prediction is limited. In [56,57], empirical studies considering three open-source PHP web applications were conducted. They based their research on a dataset and twelve metrics introduced in [49].…”

“…They based their research on a dataset and twelve metrics introduced in [49]. In [56], they examined the performance of different software vulnerability prediction models in terms of effort-aware performance measures, in contrast to [57], where they considered the impact of Filter-based Ranking Feature Selection (FRFS) methods on vulnerability prediction. In [58], an empirical study was conducted to examine a security risk (assessed by the Androrisk application) prediction of Android applications based on 21 code metrics obtained using SonarQube and six machine learning algorithms.…”