loading
Papers Papers/2022 Papers Papers/2022

Research.Publish.Connect.

Paper

Authors: Rusen Halepmollası 1 ; 2 ; Khadija Hanifi 3 ; Ramin Fouladi 3 and Ayse Tosun 1

Affiliations: 1 Istanbul Technical University, Istanbul, Turkey ; 2 T ÜB İTAK Informatics and Information Security Research Center, Kocaeli, Turkey ; 3 Ericsson Security Research, Istanbul, Turkey

Keyword(s): Software Vulnerabilities, Software Metrics, Embeddings, Abstract Syntax Tree.

Abstract: Vulnerability prediction is a data-driven process that utilizes previous vulnerability records and their associated fixes in software development projects. Vulnerability records are rarely observed compared to other defects, even in large projects, and are usually not directly linked to the related code changes in the bug tracking system. Thus, preparing a vulnerability dataset and building a predicting model is quite challenging. There exist many studies proposing software metrics-based or embedding/token-based approaches to predict software vulnerabilities over code changes. In this study, we aim to compare the performance of two different approaches in predicting code changes that induce vulnerabilities. While the first approach is based on an aggregation of software metrics, the second approach is based on embedding representation of the source code using an Abstract Syntax Tree and skip-gram techniques. We employed Deep Learning and popular Machine Learning algorithms to predict vulnerability-inducing code changes. We report our empirical analysis over code changes on the publicly available SmartSHARK dataset that we extended by adding real vulnerability data. Software metrics-based code representation method shows a better classification performance than embedding-based code representation method in terms of recall, precision and F1-Score. (More)

CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 3.149.240.75

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Halepmollası, R.; Hanifi, K.; Fouladi, R. and Tosun, A. (2023). A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes. In Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - ENASE; ISBN 978-989-758-647-7; ISSN 2184-4895, SciTePress, pages 469-478. DOI: 10.5220/0011859300003464

@conference{enase23,
author={Rusen Halepmollası. and Khadija Hanifi. and Ramin Fouladi. and Ayse Tosun.},
title={A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes},
booktitle={Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - ENASE},
year={2023},
pages={469-478},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011859300003464},
isbn={978-989-758-647-7},
issn={2184-4895},
}

TY - CONF

JO - Proceedings of the 18th International Conference on Evaluation of Novel Approaches to Software Engineering - ENASE
TI - A Comparison of Source Code Representation Methods to Predict Vulnerability Inducing Code Changes
SN - 978-989-758-647-7
IS - 2184-4895
AU - Halepmollası, R.
AU - Hanifi, K.
AU - Fouladi, R.
AU - Tosun, A.
PY - 2023
SP - 469
EP - 478
DO - 10.5220/0011859300003464
PB - SciTePress