Predicting vulnerable software components

Abstract

Where do most vulnerabilities occur in software? Our Vulture tool automatically mines existing vulnerability databases and version archives to map past vulnerabilities to components. The resulting ranking of the most vulnerable components is a perfect base for further investigations on what makes components vulnerable.In an investigation of the Mozilla vulnerability history, we surprisingly found that components that had a single vulnerability in the past were generally not likely to have further vulnerabilities. However, components that had similar imports or function calls were likely to be vulnerable.Based on this observation, we were able to extend Vulture by a simple predictor that correctly predicts about half of all vulnerable components, and about two thirds of all predictions are correct. This allows developers and project managers to focus their their efforts where it is needed most: "We should look at nsXPInstallManager because it is likely to contain yet unknown vulnerabilities."

Using SQL Hotspots in a Prioritization Heuristic for Detecting All Types of Web Application Vulnerabilities

“…For these case studies, we analyzed the Trac issue reports for two open source web applications, WordPress 8 and WikkaWiki 9 . Trac is a web-based issue management system, similar to Bugzilla …”

“…Nehaus et al [9] use their tool, Vulture, to predict vulnerable software components in versions of the Mozilla web browser. They demonstrate that vulnerabilities correlate with component imports and that component imports in the Mozilla web browser can be used to consistently and accurately predict vulnerable components.…”

Software Security Economics: Theory, in Practice

“…Neuhaus et al studied Mozilla vulnerabilities in order to predict so far unknown vulnerabilities [11] and Schryen studies many OSS projects in order to find out whether open-source security is a myth [19].…”

Vulnerability Prediction Models: A Case Study on the Linux Kernel

“…To support this process, researchers have developed vulnerability prediction models, which guide security inspections, such as code reviews [2] or security testing [5], by pointing out components that are likely to be vulnerable [7]. In fact, there are three main approaches, here named as software metrics [8], text mining [7] and includes and function calls [9].…”

“…The majority of previous research, i.e., [7], [9], [8], seeks to predict the vulnerable source code files. This choice was confirmed as actionable by Microsoft Windows developers [10] and thus, we make our evaluation at the file granularity level.…”