Predicting Vulnerable Software Components via Text Mining

背景

文章于2014年10月份发表在IEEE TRANSACTIONS ON SOFTWARE ENGINEERING，一篇通过文本挖掘技术进行软件漏洞检测的论文。文章本身引用只有14，创新点也不是很新，但由于其期刊等级较高，而且文章数据处理分析较多，还是值得以后写作借鉴。

• 出处：IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 40, NO. 10, OCTOBER 2014
• 作者：Riccardo Scandariato, James Walden, Aram Hovsepyan, and Wouter Joosen

概述

论文主要观点

将Android app应用软件源代码视作文本，源代码中语句与词类比于文本中词，作为数据特征，使用朴素贝叶斯和随机森林的算法，构建软件源代码漏洞预测模型。

成果

• 首次将文本挖掘相关方法应用于软件漏洞预测，直接使用源代码而非软件语义、开发者相关特征作为特征进行预测。
• 预测模型相对于当前的软件漏洞预测模型，具有更好的准确性和召回率。

方法模型

相关工作图

作者使用五个维度的信息来评价对比软件漏洞预测模型相关工作，如下图所示：

image

主要步骤

• 样本选择selection of applications：
  • source: the F-Droid repository (f-droid.org)
  • selection criteria:programming language, application size, and the number of
    versions released
• 漏洞数据构建construction of dataset：
  • tool:HP Fortify SCA scan the source code to present vulnerablity warnings of the applications
  • why:too few vulnerabilities(NVD
    (nvd.nist.gov)) related to Android applications
• 输入构建input：Each Java file is tokenized into a vector of terms
• 机器学习方法选择machine learning techniques:five, wellknown learning techniques are applied to the approache: Decision Trees, k-Nearest
  Neighbor, Na€ ıve Bayes, Random Forest and support vector machine (SVM). Best results are obtained with NB and Random Forest.
• 实验设计experiments design:
  • 验证方法validation:10-fold cross-validation
  • experiment 1:built models with both Na€ ıve Bayes and Random Forest machine learning techniques based on the first version (v0) of each application.prove the method can be used to build high quality prediction models for Android applications.
  • experiment 2:built a prediction model based on the initial version (using all source files available in v0) and predicted all subsequent versions of that application (v1 andfollowing) prediction technique can forecast with excellent performance the vulnerable files of the future versions of an Android application
  • experiment 3：built 20 models using version v0 of each application. We then tested each model by predicting vulnerable files in the v0 versions of the other 19 applications.a single application can predict which software components are vulnerable in other applications

创新点

• 文本挖掘方法应用于软件缺陷检测
• 实验设计上，进行三个方向上的对比实验

总结

优点

• 文章的实验部分数据对比写的不错，很简单的创意和想法，做出了三组实验

不足

• 创新点较为简单
• 数据对比牵强，数据集不同
• 期刊论文过于滞后，本文2014年10月发表，但是研究时间节点在2012年前后，以后尽量多看会议论文，期刊论文仅作为参考文献

我的想法

• 结合vccfinder论文