Predicting vulnerable software components using software network graph

Shengjun Wei; Xiaojiang Du; Changzhen Hu; Chun Shan

doi:10.1007/978-3-319-69471-9_21

Predicting vulnerable software components using software network graph

Shengjun Wei^*, Xiaojiang Du, Changzhen Hu, Chun Shan

^*Corresponding author for this work

Department of Computer and Information Sciences

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Citation (Scopus)

Abstract

Vulnerability Prediction Models (VPMs) are used to predict vulnerability-prone modules and now many software security metrics have been proposed. In this paper, we predict vulnerability-prone components. Based on software network graph we define component cohesion and coupling metrics which are used as security metrics to build the VPM. To validate the prediction performance, we conduct an empirical study on Firefox 3.6. We compare the results with other works’, it shows that our model has a good performance in the accuracy, precision, and recall, and indicate that the proposed metrics are also effective in vulnerability prediction.

Original language	English
Title of host publication	Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings
Editors	Wei Wu, Aniello Castiglione, Sheng Wen
Publisher	Springer Verlag
Pages	280-290
Number of pages	11
ISBN (Print)	9783319694702
DOIs	https://doi.org/10.1007/978-3-319-69471-9_21
Publication status	Published - 2017
Event	9th International Symposium on Cyberspace Safety and Security, CSS 2017 - Xi'an, China Duration: 23 Oct 2017 → 25 Oct 2017

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10581 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	9th International Symposium on Cyberspace Safety and Security, CSS 2017
Country/Territory	China
City	Xi'an
Period	23/10/17 → 25/10/17

Keywords

Component cohesion and coupling
Software network
Software security
Vulnerability prediction

Access to Document

10.1007/978-3-319-69471-9_21

Cite this

Wei, S., Du, X., Hu, C., & Shan, C. (2017). Predicting vulnerable software components using software network graph. In W. Wu, A. Castiglione, & S. Wen (Eds.), Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings (pp. 280-290). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10581 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-319-69471-9_21

Wei, Shengjun ; Du, Xiaojiang ; Hu, Changzhen et al. / Predicting vulnerable software components using software network graph. Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings. editor / Wei Wu ; Aniello Castiglione ; Sheng Wen. Springer Verlag, 2017. pp. 280-290 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{1a3b49385d4d4ed684c60293dff3ae11,

title = "Predicting vulnerable software components using software network graph",

abstract = "Vulnerability Prediction Models (VPMs) are used to predict vulnerability-prone modules and now many software security metrics have been proposed. In this paper, we predict vulnerability-prone components. Based on software network graph we define component cohesion and coupling metrics which are used as security metrics to build the VPM. To validate the prediction performance, we conduct an empirical study on Firefox 3.6. We compare the results with other works{\textquoteright}, it shows that our model has a good performance in the accuracy, precision, and recall, and indicate that the proposed metrics are also effective in vulnerability prediction.",

keywords = "Component cohesion and coupling, Software network, Software security, Vulnerability prediction",

author = "Shengjun Wei and Xiaojiang Du and Changzhen Hu and Chun Shan",

note = "Publisher Copyright: {\textcopyright} 2017, Springer International Publishing AG.; 9th International Symposium on Cyberspace Safety and Security, CSS 2017 ; Conference date: 23-10-2017 Through 25-10-2017",

year = "2017",

doi = "10.1007/978-3-319-69471-9_21",

language = "English",

isbn = "9783319694702",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "280--290",

editor = "Wei Wu and Aniello Castiglione and Sheng Wen",

booktitle = "Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings",

address = "Germany",

}

Wei, S, Du, X, Hu, C & Shan, C 2017, Predicting vulnerable software components using software network graph. in W Wu, A Castiglione & S Wen (eds), Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10581 LNCS, Springer Verlag, pp. 280-290, 9th International Symposium on Cyberspace Safety and Security, CSS 2017, Xi'an, China, 23/10/17. https://doi.org/10.1007/978-3-319-69471-9_21

Predicting vulnerable software components using software network graph. / Wei, Shengjun; Du, Xiaojiang; Hu, Changzhen et al.
Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings. ed. / Wei Wu; Aniello Castiglione; Sheng Wen. Springer Verlag, 2017. p. 280-290 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10581 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Predicting vulnerable software components using software network graph

AU - Wei, Shengjun

AU - Du, Xiaojiang

AU - Hu, Changzhen

AU - Shan, Chun

PY - 2017

Y1 - 2017

N2 - Vulnerability Prediction Models (VPMs) are used to predict vulnerability-prone modules and now many software security metrics have been proposed. In this paper, we predict vulnerability-prone components. Based on software network graph we define component cohesion and coupling metrics which are used as security metrics to build the VPM. To validate the prediction performance, we conduct an empirical study on Firefox 3.6. We compare the results with other works’, it shows that our model has a good performance in the accuracy, precision, and recall, and indicate that the proposed metrics are also effective in vulnerability prediction.

AB - Vulnerability Prediction Models (VPMs) are used to predict vulnerability-prone modules and now many software security metrics have been proposed. In this paper, we predict vulnerability-prone components. Based on software network graph we define component cohesion and coupling metrics which are used as security metrics to build the VPM. To validate the prediction performance, we conduct an empirical study on Firefox 3.6. We compare the results with other works’, it shows that our model has a good performance in the accuracy, precision, and recall, and indicate that the proposed metrics are also effective in vulnerability prediction.

KW - Component cohesion and coupling

KW - Software network

KW - Software security

KW - Vulnerability prediction

UR - http://www.scopus.com/inward/record.url?scp=85034251228&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-69471-9_21

DO - 10.1007/978-3-319-69471-9_21

M3 - Conference contribution

AN - SCOPUS:85034251228

SN - 9783319694702

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 280

EP - 290

BT - Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings

A2 - Wu, Wei

A2 - Castiglione, Aniello

A2 - Wen, Sheng

PB - Springer Verlag

T2 - 9th International Symposium on Cyberspace Safety and Security, CSS 2017

Y2 - 23 October 2017 through 25 October 2017

ER -

Wei S, Du X, Hu C , Shan C. Predicting vulnerable software components using software network graph. In Wu W, Castiglione A, Wen S, editors, Cyberspace Safety and Security - 9th International Symposium, CSS 2017, Proceedings. Springer Verlag. 2017. p. 280-290. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-69471-9_21

Predicting vulnerable software components using software network graph

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this