Evaluating and Comparing Size, Complexity and Coupling Metrics as Web Applications Vulnerabilities Predictors

Abstract

Most security and privacy issues in software are related to exploiting code vulnerabilities. Many studies have tried to find the correlation between the software characteristics (complexity, coupling, etc.) quantified by corresponding code metrics and its vulnerabilities and to propose automatic prediction models that help developers locate vulnerable components to minimize maintenance costs. The results obtained by these studies cannot be applied directly to web applications because a web application differs in many ways from a non-web application: development, use, etc. and a lot of evaluation of these conclusions has to be made. The purpose of this study is to evaluate and compare the vulnerabilities prediction power of three types of code metrics in web applications. There are a few similar studies that targeted non-web application and to the best of our knowledge, there are no similar studies that targeted web applications. The results obtained show that unlike non-web applications where complexity metrics have better vulnerability prediction power, in web applications the metrics that give better prediction are the coupling metrics with high recall (> 75%) and fewer costs in terms of inspection (<25%).

إستعراض منهجی للأدبیات حول الکشف عن نقاط ضعف البرمجیات بإستخدام أسالیب تعلم الألة

“…One of the key research directions is to develop intelligent vulnerability detection techniques that act on source code. The following three sub-categories can be found: vulnerability detection methods based on software metrics [18] [19] [20] [21], anomaly detection technique for detecting vulnerabilities by looking for abnormal patterns [22], and vulnerable pattern learning [23].…”

“…Some of the prior studies in the field of vulnerability detection tried to evaluate theories that are a correlation between software characteristics: complexity, coupling, etc. [19] [46] [47] [18]. Mohammed et al [20] Aim to use code metrics as features to detect software vulnerabilities based on deep learning with a fine granularity level.…”

“…This is demonstrated by the fact that numerous vulnerabilities are reported each year in the Common Vulnerabilities and Exposures (CVE) [2]. According to the Common Vulnerabilities and Exposures (CVE) organization's statistics and the National Vulnerability Database (NVD) Report [3], The number of vulnerabilities recorded in a single year has never been higher than in 2020 (18,103). It can be seen from Figure 1 that the number of vulnerabilities has reached its peak in the past three years.…”

Deep Learning for Software Vulnerabilities Detection Using Code Metrics

“…Most of the prior studies in the field of AVP tried to evaluate theories that are a correlation between software characteristics: complexity, coupling, etc and vulnerabilities [10]- [13]. In other studies [8], [14] researchers reported that the classic software metrics used in DPM are not accurate for VPM.…”

“…Training a VPM from such an imbalanced dataset is often challenging because the VPM may be biased towards the major class (negatives) and hence it only learns to predict everything as negatives and ignores the minor class (positives). Therefore, undersampling is a technique that is often used to balance the training set [11], [13], [15]. With this technique, all the positive cases in the training set are retained, while only a subset of the negatives is selected.…”