Enhancing Software Vulnerability Prediction Models

Abstract

Purpose: The purpose of this study is to evaluate and replicate various Vulnerability Prediction Models (VPMs) to determine their effectiveness in identifying software vulnerabilities. Given the increasing complexity of software, identifying vulnerabilities during development is becoming more challenging. This study aims to enhance the accuracy of vulnerability prediction to improve security inspections and testing.

Methodology: The study involves benchmarking different VPM approaches, including software metrics, text mining, and automated static analysis. These models are evaluated using a dataset that consists of over 100,000 lines of code from multiple open-source projects. The evaluation focuses on assessing the models in terms of precision, recall, and F-Measure.

Findings: The findings indicate that combining multiple VPM techniques results in improved prediction accuracy. The study demonstrates that integrating various approaches enhances the overall effectiveness of vulnerability detection in software development.

Unique Contribution to Theory, Practice, and Policy (Recommendations):The unique contribution of this study lies in its demonstration that a multi-technique approach to VPMs can significantly enhance prediction accuracy. This finding offers valuable insights for both theoretical advancements and practical applications in software security. For practice, it suggests that incorporating a combination of VPM techniques can lead to more effective vulnerability detection. For policy, it underscores the importance of adopting advanced and varied VPM methods to improve software security measures. Future research should focus on expanding datasets to include a broader range of projects and incorporating machine learning techniques to further enhance VPM predictive capabilities.