Predicting Vulnerable Software Components via Bellwethers

来源 :第十二届中国可信计算与信息安全学术会议 | 被引量 : 0次 | 上传用户:lala_
下载到本地 , 更方便阅读
声明 : 本文档内容版权归属内容提供方 , 如果您对本文有版权争议 , 可与客服联系进行内容授权或下架
论文部分内容阅读
  Software vulnerabilities are weakness,flaws or errors introduced dur-ing the life cycle of a software system.Although,previous studies have demon-strated the practical significance of using software metrics to predict vulnerable software components,empirical evidence shows that these metrics are plagued with issues pertaining to their effectiveness and robustness.This paper investi-gates the feasibility of using Bellwethers(i.e.,exemplary data)for predicting and classifying software vulnerabilities.We introduced a Bellwether method us-ing the following operators,PARTITION.SAMPLE+TRAIN and APPLY.The Bellwethers sampled by the three operators are used to train a learner(i.e.,deep neural networks)with the aim of predicting essential or non-essential vulnera-bilities.We evaluate the proposed Bellwether method using vulnerability re-ports extracted from three popular web browsers offered by CVE.Again,the mean absolute error(MAE),Welchs t-test and Cliffs δ effect size are used to further evaluate the prediction performance and practical statistical significant difference between the Bellwethers and the growing portfolio.We found that there exist subsets of vulnerability records(Bellwethers)in the studied datasets that can yield improved accuracy for software vulnerability prediction.The re-sult shows that recall and precision measures from the text mining process were in a range of 73.g%-85.3%and 67.g%-81.8%respectively across the three studied datasets.The findings further show that the use of the Bellwethers for predictive modelling is a promising research direction for assisting software en-gineers and practitioners when seeking to predict instances of vulnerability rec-ords that demand much attention prior to software release.
其他文献
Security compliance auditing against standards,regulations or requirements in cloud environments is of increasing importance to boost trust between stakeholders.Many automatic security compliance audi
软件漏洞是诸多安全事件的源头,而针对漏洞利用的恶意样本攻击则是当前主要的攻击手段.恶意样本通常会以嵌入恶意代码的方式实现利用漏洞安装运行其他下载项、混淆恶意代码、安装木马、设置后门等一系列恶意行为,进而造成极大的安全威胁.恶意样本由于结构复杂,使用灵活,对其的检测存在很大的难度.现有的恶意样本检测方法绝大多数建立在检测模式或规则上,难以应对高结构化恶意样本的模式或规则难以抽取等问题.本文提出了一种
Millionaire problem and private set intersection problem are not only the basic issues in the secure multiparty computation,but also the building block for privacy-preserving cooperative computation.H
Block chain is widely used in the financial field for its characteristics of centralization,anonymity and trust.Electronic money payment is an important application hotspot.Ring signature is widely us
In order to solve the data security problem in cloud storage system,an access control scheme which supports for a finer attribute expression for cloud storage data based on CP-ASBE(Ciphertext-Policy A
Recently,with the rapid development of Internet of Things(IoT),vehicular ad hoc network(VANET),as a typical application of IoT,brings more and more intelligent and convenient services to an increasing
硬盘是数据最主要的存储设备,不仅在信息系统中扮演着极其重要的角色,也面临着较为严峻的安全威胁。本文对硬盘的特性及安全威胁进行了分析,对安全需求进行了总结。本文提出基于UEFI 的固件级硬盘安全保护机制,通过在加密硬盘中预置固件级硬盘安全模块,实现硬盘提供硬盘口令、全盘加密、硬盘固件度量等安全功能。最后,本文对原型系统的实验结果进行了描述。实验结果表明,在硬盘保护区内预置固件级安全模块,能够对硬盘固
椭圆曲线密码体制在资源内存受限的环境上的广泛应用,使得对其运算效率提出新的挑战,因此研究椭圆曲线标量乘算法具有重要意义.其中通过优化底层域上不同坐标系下的点加、倍点运算公式,而提高标量乘的运算效率是比较有效的方法.基于统一Z 坐标的基础上,提出有限域GF(2m)上两种射影坐标下的Co_Z 点加运算公式,通过对椭圆曲线上有理点的Z 坐标统一化处理,使得其运算量分别为10M+3S和8M+3S,相比已有
现有多服务器环境下的身份认证方案大多存在无法抵御各种安全攻击,不能实现匿名性等问题,基于扩展的混沌映射和生物特征方法提出了一种多服务器的身份认证协议,实现用户与多服务器之间的身份认证,并在认证过程中协商了会话密钥。利用BAN逻辑对提出的协议进行了安全证明。安全性分析结果表明,本文的协议可抵抗假冒攻击,离线口令猜测攻击等,并具有强匿名性。最后,与现有的相关协议比较,本文的协议更高效更安全,适合在实际
Remote authentication is a safe and verifiable mechanism.In the environment of Internet of things,remote hosts need to verify the legality of identity of terminal devices.However,resource constrained