The Evolution and Decay of Statically Detected Source Code Vulnerabilities

Abstract

Abstract

Tracking Your Changes: A Language-Independent Approach

“…Figure 3-b shows the median LDA and Unix diff accuracy over the experiments performed, and the interquartile range (between the third and first quartile). We tested the significance of the obtained results, by using a two-tailed 2 Mann-Whitney test. The LDA algorithm exhibits significantly higher performances in the identification of changed lines (p-value<0.001), while the Unix diff performs better in the 1 Since we are expecting improvements over subsequent steps.…”

“…The LDA algorithm exhibits significantly higher performances in the identification of changed lines (p-value<0.001), while the Unix diff performs better in the 1 Since we are expecting improvements over subsequent steps. 2 Since we do not know a-priori whether ldiff performs better than the Unix diff. identification of added and deleted lines (p-value=0.009 and <0.0001 respectively) because ldiff classifies added and deleted lines as potential changed lines, causing an increment of both false negatives and positives.…”

“…Figure 4-b compares the decay time of different kinds of vulnerabilities detected by Splint in the Squid Web proxy 8 source code, and indicates how vulnerabilities such as buffer overflows and memory allocation problems are removed quicker than others. In addition, it would be possible to model the vulnerability decay by means of a probability distribution, or to estimate the likelihood a vulnerability has to be removed [2]: we found that for some vulnerability categories (e.g., buffer overflows) the likelihood a vulnerability has to disappear from the system exponentially decreases with the time.…”

The life and death of statically detected vulnerabilities: An empirical study

“…In a companion paper [32] we presented a preliminary version of this work. The present paper extends the previous one by analyzing how and in what context vulnerabilities are removed, and to what extent developers document such removals.…”

METAMORPHOS: MEthods and Tools for migrAting software systeMs towards web and service Oriented aRchitectures: exPerimental evaluation, usability, and tecHnOlogy tranSfer

“…Using this framework, different kinds of studies have been conducted, among others (i) to investigate the changeability design patterns [1]; (ii) to analyze the maintenance of clones (preliminary results limited to manual analysis are reported in [2]); and (iii) to investigate on the evolution and decay of vulnerabilities in network applications [15].…”