Mining the Categorized Software Repositories to Improve the Analysis of Security Vulnerabilities

Abstract

Security has become the Achilles' heel of most modern software systems. Techniques ranging from the manual inspection to automated static and dynamic analyses are commonly employed to identify security vulnerabilities prior to the release of the software. However, these techniques are time consuming and cannot keep up with the complexity of ever-growing software repositories (e.g., Google Play and Apple App Store). In this paper, we aim to improve the status quo and increase the efficiency of static analysis by mining relevant information from vulnerabilities found in the categorized software repositories. The approach relies on the fact that many modern software systems are developed using rich application development frameworks (ADF), allowing us to raise the level of abstraction for detecting vulnerabilities and thereby making it possible to classify the types of vulnerabilities that are encountered in a given category of application. We used open-source software repositories comprising more than 7 million lines of code to demonstrate how our approach can improve the efficiency of static analysis, and in turn, vulnerability detection.

SeMA: A Design Methodology for Building Secure Android Apps

“…Existing research efforts related to Android app security have focused on developing tools and techniques to help detect vulnerabilities in an app's implementation [18,8]. Despite such efforts, apps with known vulnerabilities find their way to app stores [15,4]. This is possibly because existing tools are neither accurate [14] nor scalable [12] in terms of detecting known vulnerabilities.…”

Mining mobile app markets for prioritization of security assessment effort

“…Since many of the security issues encountered in modern software are due to the wrong usage of ADF [21], we are able to develop highly effective predictors as to the types of security vulnerabilities one may find in different categories of apps. In our prior research [17], we have shown the existence of strong correlations between the types of vulnerabilities and categories of apps. This paper shows how such correlations can be used to improve the efficiency of static, dynamic, and manual analysis techniques for security assessment of software.…”

“…Some examples of app markets with categories are F-Droid for open source and Google Play for Android applications. Other than facilitating the users in searching and browsing, categories of apps have shown to be good predictors of the common features found within software of a particular category [12,17].…”

Static Analysis of Information Systems for IoT Cyber Security: A Survey of Machine Learning Approaches

“…The category mentions the following works and their ideas: fuzzy testing using genetic algorithms [ 59 ]; bug report analysis using classification to identify hidden vulnerabilities [ 60 , 61 ]; searching for memory corruption vulnerabilities by source code using genetic algorithms and Fish School Search [ 62 ]; classification and prediction of false positives in SA vulnerabilities in Web application code and automatic fixing them [ 63 ]; and improving SA efficiency and scalability for software repositories [ 64 ]. Thus, although the research in the fourth category is related to SA, it is rather of an auxiliary nature and will not be discussed further.…”