Towards a Prototype Based Explainable JavaScript Vulnerability Prediction Model

Abstract

Security has become a central and unavoidable aspect of today's software development. Practitioners and researchers have proposed many code analysis tools and techniques to mitigate security risks. These tools apply static and dynamic analysis or, more recently, machine learning. Machine learning models can achieve impressive results in finding and forecasting possible security issues in programs. However, most of the current approaches fall short of developer demands in two areas at least: explainability and granularity of predictions.In this paper, we propose a novel and simple yet, promising approach to identify potentially vulnerable source code in JavaScript programs. The model improves the state-of-the-art in terms of explainability and prediction granularity as it gives results at the level of individual source code lines, which is fine-grained enough for developers to take immediate actions. Additionally, the model explains each predicted line (i.e., provides the most similar vulnerable line from the training set) using a prototype-based approach. In a study of 186 real-world and confirmed JavaScript vulnerability fixes of 91 projects, the approach could flag 60% of the known vulnerable lines on average by marking only 10% of the code-base, but in particular cases, the model identified 100% of the vulnerable code lines while flagging only 8.72% of the code-base.

Software vulnerability prediction: A systematic mapping study

“…Forecasting the number of vulnerabilities is most usually applied to high levels of granularity, with the project level to be the prevailing one, whereas prediction of vulnerable components is applied to lower levels of granularity, with the file level to be the most common one. Based on the findings of our literature research [15][16][17], researchers need to develop more practical VPMs in the sense of providing more precise information about the localization of the vulnerability into the source code. The lower the granularity level of the vulnerable software component, the easier for the user to identify the exact location of the vulnerability and fix it.…”

Comparing ML-Based Predictions and Static Analyzer Tools for Vulnerability Detection

“…Our main goal in this paper is to compare how well a JavaScript line-level MLbased vulnerability prediction method works when compared to classical static analyzer tools for vulnerability detection. Therefore, in this section, we describe the essence of an ML-based vulnerability detection method [18] we developed for identifying vulnerable JavaScript code lines and the benchmark we used for comparing it to other static analysis vulnerability checkers.…”

“…In one of our earlier works [18], we proposed an ML-based line-level vulnerability prediction method with the goal of finding vulnerabilities in JavaScript systems, while being both granular and explainable. Since our method provided favorable results, it was the next natural step to see how it fares against other static analyzers.…”