Experimentação de características no contexto da predição de vulnerabilidades

Abstract

The growing use of technology makes the de- velopment of secure applications essential. In contrast, the secure software development cycle is a costly task, considering the human effort required to review applica- tion code for finding vulnerabilities. In order to minimize this cost (human effort), vulnerability prediction models (VPMs) can be used by software development teams during inspection tasks. In general, VPMs are machine learning- based algorithms capable of indicate potentially vulnera- ble software components. Among the aspects that make the application of VPM unfeasible its low precision, which indicates the waste of human effort in the review of non- vulnerable components. Therefore, one of the obstacles in the construction of efficient VPMs is modeling meaning- ful features related to the vulnerabilities found. This work proposed a new feature, extracted through another domain (defect prediction) techniques. We evaluated the feature within an active learning-based VPM through a simula- tion on real open source projects. Our results indicates that the proposed feature looks promising in cost saving when applied to vulnerability inspection tasks.