Efficient Feature Selection for Static Analysis Vulnerability Prediction

Abstract

Common software vulnerabilities can result in severe security breaches, financial losses, and reputation deterioration and require research effort to improve software security. The acceleration of the software production cycle, limited testing resources, and the lack of security expertise among programmers require the identification of efficient software vulnerability predictors to highlight the system components on which testing should be focused. Although static code analyzers are often used to improve software quality together with machine learning and data mining for software vulnerability prediction, the work regarding the selection and evaluation of different types of relevant vulnerability features is still limited. Thus, in this paper, we examine features generated by SonarQube and CCCC tools, to identify those that can be used for software vulnerability prediction. We investigate the suitability of thirty-three different features to train thirteen distinct machine learning algorithms to design vulnerability predictors and identify the most relevant features that should be used for training. Our evaluation is based on a comprehensive feature selection process based on the correlation analysis of the features, together with four well-known feature selection techniques. Our experiments, using a large publicly available dataset, facilitate the evaluation and result in the identification of small, but efficient sets of features for software vulnerability prediction.

AI and Quality of Service Driven Attack Detection, Mitigation and Energy Optimization: A Review of Some EU Project Results

“…The field that started with the need to encrypt data and create secure systems through strong means for security such as passwords, authentication schemes, firewalls and cryptographic keys, has now substantially evolved towards the detection and mitigation of cyberattacks. In addition issues with respect to software's own specific vulnerabilities [23] and the need to detect and mitigate such properties has also become important [23,24,44,88,109,110].…”

Review of Some Recent European Cybersecurity Research and Innovation Projects

“…But it has now substantially been revolutionized as a means to detect and mitigate cyberattacks. Software's own specific vulnerabilities [187] have also become critical [176], [188]- [192]. Indeed, static means of Cybersecurity assurance are largely ineffective unless they incorportd real-time methods that can detect and rapidly react to attacks and malicious actions against a system.…”

A Self-adaptive Approach for Assessing the Criticality of Security-Related Static Analysis Alerts

“…Apart from alert-specific information, we decided to integrate security-related information retrieved from the software project itself. In particular, we applied text mining-based deep learning vulnerability prediction models [25][26][27] (see Section 4), in order to spot the security hot-spots of the software products, i.e., software classes that are likely to contain vulnerabilities. By highlighting the security hot-spots, we expect our approach to consider as more critical those static analysis alerts that belong to the identified hot-spots.…”