Kalouptsoglou Ilias, Siavvas Miltiadis, Kehagias Dionysios, Chatzigeorgiou Alexandros, Ampatzoglou Apostolos
Centre for Research and Technology Hellas, 57001 Thessaloniki, Greece.
Department of Applied Informatics, University of Macedonia, 54636 Thessaloniki, Greece.
Entropy (Basel). 2022 May 5;24(5):651. doi: 10.3390/e24050651.
Software security is a very important aspect for software development organizations who wish to provide high-quality and dependable software to their consumers. A crucial part of software security is the early detection of software vulnerabilities. Vulnerability prediction is a mechanism that facilitates the identification (and, in turn, the mitigation) of vulnerabilities early enough during the software development cycle. The scientific community has recently focused a lot of attention on developing Deep Learning models using text mining techniques for predicting the existence of vulnerabilities in software components. However, there are also studies that examine whether the utilization of statically extracted software metrics can lead to adequate Vulnerability Prediction Models. In this paper, both software metrics- and text mining-based Vulnerability Prediction Models are constructed and compared. A combination of software metrics and text tokens using deep-learning models is examined as well in order to investigate if a combined model can lead to more accurate vulnerability prediction. For the purposes of the present study, a vulnerability dataset containing vulnerabilities from real-world software products is utilized and extended. The results of our analysis indicate that text mining-based models outperform software metrics-based models with respect to their F-score, whereas enriching the text mining-based models with software metrics was not found to provide any added value to their predictive performance.
对于希望向消费者提供高质量和可靠软件的软件开发组织来说，软件安全是一个非常重要的方面。软件安全的一个关键部分是早期发现软件漏洞。漏洞预测是一种机制，可在软件开发周期中尽早促进漏洞的识别（进而缓解）。科学界最近将大量注意力集中在使用文本挖掘技术开发深度学习模型，以预测软件组件中漏洞的存在。然而，也有研究探讨静态提取的软件度量的使用是否能产生足够的漏洞预测模型。在本文中，构建并比较了基于软件度量和基于文本挖掘的漏洞预测模型。还研究了使用深度学习模型将软件度量和文本令牌相结合，以调查组合模型是否能导致更准确的漏洞预测。出于本研究的目的，利用并扩展了一个包含来自实际软件产品漏洞的漏洞数据集。我们的分析结果表明，基于文本挖掘的模型在F分数方面优于基于软件度量的模型，而用软件度量丰富基于文本挖掘的模型并未发现能为其预测性能提供任何附加值。
