Visible to the public Evaluating micro patterns and software metrics in vulnerability prediction

TitleEvaluating micro patterns and software metrics in vulnerability prediction
Publication TypeConference Paper
Year of Publication2017
AuthorsSultana, K. Z., Williams, B. J.
Conference Name2017 6th International Workshop on Software Mining (SoftwareMining)
ISBN Number978-1-5386-1389-4
KeywordsApache Camel, Apache Tomcat, class-level patterns, class-level traceable patterns, Complexity theory, cost effective software testing, Design patterns, early detection, Internet, Java, learning (artificial intelligence), machine learning techniques, Metrics, micropatterns evaluation, Object oriented modeling, Predictive Metrics, Predictive models, predictive security metrics, program testing, pubcrawl, security, security of data, security vulnerabilities, Software, software metrics, software quality, software security, source code, source code (software), stand-alone Java web applications, time effective software testing, traditional class-level software metrics, traditional software metrics, vulnerability prediction model, vulnerable classes, vulnerable code

Software security is an important aspect of ensuring software quality. Early detection of vulnerable code during development is essential for the developers to make cost and time effective software testing. The traditional software metrics are used for early detection of software vulnerability, but they are not directly related to code constructs and do not specify any particular granularity level. The goal of this study is to help developers evaluate software security using class-level traceable patterns called micro patterns to reduce security risks. The concept of micro patterns is similar to design patterns, but they can be automatically recognized and mined from source code. If micro patterns can better predict vulnerable classes compared to traditional software metrics, they can be used in developing a vulnerability prediction model. This study explores the performance of class-level patterns in vulnerability prediction and compares them with traditional class-level software metrics. We studied security vulnerabilities as reported for one major release of Apache Tomcat, Apache Camel and three stand-alone Java web applications. We used machine learning techniques for predicting vulnerabilities using micro patterns and class-level metrics as features. We found that micro patterns have higher recall in detecting vulnerable classes than the software metrics.

Citation Keysultana_evaluating_2017