A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes

Rusen Halepmollası, Rusen Halepmollası, Khadija Hanifi, Ramin Fouladi, Ayse Tosun

2023

Abstract

Vulnerability prediction is a data-driven process that utilizes previous vulnerability records and their associated fixes in software development projects. Vulnerability records are rarely observed compared to other defects, even in large projects, and are usually not directly linked to the related code changes in the bug tracking system. Thus, preparing a vulnerability dataset and building a predicting model is quite challenging. There exist many studies proposing software metrics-based or embedding/token-based approaches to predict software vulnerabilities over code changes. In this study, we aim to compare the performance of two different approaches in predicting code changes that induce vulnerabilities. While the first approach is based on an aggregation of software metrics, the second approach is based on embedding representation of the source code using an Abstract Syntax Tree and skip-gram techniques. We employed Deep Learning and popular Machine Learning algorithms to predict vulnerability-inducing code changes. We report our empirical analysis over code changes on the publicly available SmartSHARK dataset that we extended by adding real vulnerability data. Software metrics-based code representation method shows a better classification performance than embedding-based code representation method in terms of recall, precision and F1-Score.

Paper Citation

in Harvard Style

Halepmollası R., Hanifi K., Fouladi R. and Tosun A. (2023). A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes. In Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE, ISBN 978-989-758-647-7, SciTePress, pages 469-478. DOI: 10.5220/0011859300003464

in Bibtex Style

@conference{enase23,
author={Rusen Halepmollası and Khadija Hanifi and Ramin Fouladi and Ayse Tosun},
title={A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes},
booktitle={Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE,},
year={2023},
pages={469-478},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011859300003464},
isbn={978-989-758-647-7},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE,
TI - A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes
SN - 978-989-758-647-7
AU - Halepmollası R.
AU - Hanifi K.
AU - Fouladi R.
AU - Tosun A.
PY - 2023
SP - 469
EP - 478
DO - 10.5220/0011859300003464
PB - SciTePress