Learning to Identify Security-Related Issues Using Convolutional Neural Networks

Abstract

Software security is becoming a high priority for both large companies and start-ups alike due to the increasing potential for harm that vulnerabilities and breaches carry with them. However, attaining robust security assurance while delivering features requires a precarious balancing act in the context of agile development practices. One path forward to help aid development teams in securing their software products is through the design and development of security-focused automation. Ergo, we present a novel approach, called SecureReqNet, for automatically identifying whether issues in software issue tracking systems describe security-related content. Our approach consists of a two-phase neural net architecture that operates purely on the natural language descriptions of issues. The first phase of our approach learns high dimensional word embeddings from hundreds of thousands of vulnerability descriptions listed in the CVE database and issue descriptions extracted from open source projects. The second phase then utilizes the semantic ontology represented by these embeddings to train a convolutional neural network capable of predicting whether a given issue is securityrelated. We evaluated SecureReqNet by applying it to identify security-related issues from a dataset of thousands of issues mined from popular projects on GitLab and GitHub. In addition, we also applied our approach to identify security-related requirements from a commercial software project developed by a major telecommunication company. Our preliminary results are encouraging, with SecureReqNet achieving an accuracy of 96% on open source issues and 71.6% on industrial requirements.

On the feasibility of automated prediction of bug and non-bug issues

“…Qin and Sun (2018) propose to use word embeddings of the title and description of the issue as features and use these to train a Long Short-Term Memory (LSTM). Palacio et al (2019) propose to use the SecureReqNet (shallow) 2 Kallis et al (2019) created the tool Ticket Tagger that can be directly integrated into GitHub as a recommendation system for issue type classification. The Ticket Tagger uses the fastText Facebook AI Research (2019) algorithm, which uses the text as input and internally calculates a feature representation that is based on n-grams, but not of the words, but of the letters within the words.…”

“…The network is still a deep neural network, the (shallow) means that this is the less deep variant that was used in byPalacio et al (2019), because they found that this performs better. neural network based on work byHan et al (2017) for the labeling of issues as vulnerabilities.…”

Supporting Developers in Addressing Human-centric Issues in Mobile Apps

“…We also added the "I Don't Know" option to the Likert questions to not force the respondents to answer the statements that they were unsure about or were unclear to them. We leveraged the survey studies [37], [38] used to evaluate the usefulness of (the outputs of) ML/DLbased approaches and tools in the software engineering community to design the following statements.…”

The Use of NLP-Based Text Representation Techniques to Support Requirement Engineering Tasks: A Systematic Mapping Review

“…We recognized 21 papers proposing solutions to various requirements classification tasks. Most of them focused on Functional/Non-Functional classification tasks [39,40,41,10,11,42,43,44,45,46,47,48,49], while the remaining focused on other classification tasks: security/Not security [50,51,52], topic-based classification [53], and classification based on requirements importance level [54].…”