The evolution and decay of statically detected source code vulnerabilities

Proceedings - 8th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2008

Volumn , Issue , 2008, Pages 101-110

  Di Penta, Massimiliano ^a   Cerulo, Luigi ^a   Aversano, Lerina ^a  

^a UNIVERSITY OF SANNIO   (Italy)

Author keywords

Empirical study; Mining software repositories; Software vulnerabilities

Indexed keywords

STATIC ANALYSIS;

BUFFER OVERFLOWS; DECAY TIMES; EMPIRICAL STUDIES; EMPIRICAL STUDY; EVOLUTION TRENDS; MINING SOFTWARE REPOSITORIES; SOFTWARE REPOSITORIES; SOFTWARE SYSTEMS; SOFTWARE VULNERABILITIES; SOURCE CODES;

CODES (SYMBOLS);

EID: 56349113248     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SCAM.2008.20     Document Type: Conference Paper

References (27)

1. V. Basili, G. Caldiera, and D. H. Rombach. The Goal Question Metric Paradigm Encyclopedia of Software Engineering. John Wiley and Sons, 1994.
2. F. Calzolari, P. Tonella, and G. Antoniol. Maintenance and testing effort modeled by linear and nonlinear dynamic systems. Information & Software Technology, 43(8):477-486, 2001.
3. G. Canfora, L. Cerulo, and M. Di Penta. Identifying changed source code lines from version repositories. In MSR'07: Proceedings of the Fourth International Workshop on Mining Software Repositories, page 14. IEEE CS, 2007.
4. J. Cohen. Statistical power analysis for the behavioral sciences (2nd ed.). Lawrence Earlbaum Associates, Hillsdale, NJ, 1988.
5. D. DaCosta, C. Dahn, S. Mancoridis, and V. Prevelakis. Characterizing the 'security vulnerability likelihood' of software functions. In ICSM'03: Proceedings of the International Conference on Software Maintenance, page 266, Washington, DC, USA, 2003. IEEE Computer Society.
6. C. Dahn and S. Mancoridis. Using program transformation to secure C programs against buffer overflows. In WCRE'03: Proceedings of the 10th Working Conference on Reverse Engineering, page 323, Washington, DC, USA, 2003. IEEE Computer Society.
7. C. Del Grosso, G. Antoniol, M. Di Penta, P. Galinier, and E. Merlo. Improving network applications security: a new heuristic to generate stress testing data. In GECCO'05: Proceedings of the 2005 conference on Genetic and evolutionary computation, pages 1037-1043, New York, NY, USA, 2005. ACM.
8. M. Di Penta, L. Cerulo, and L. Aversano. An empirical study on the evolution of vulnerable code. Technical report, Dept. of Engineering, Univ. of Sannio, Italy, 2008. http://www.rcost.unisannio.it/vuln-tr.pdf.
9. D. A. Dickey and W. A. Fuller. Likelihood ratio statistics for autoregressive time series with a unit root. Econometrica, 49(4):1057-72, June 1981.
10. H. Gall, M. Jazayeri, and J. Krajewski. CVS release history data for detecting logical couplings. In IWPSE'03: Proceedings of the 6th International Workshop on Principles of Software Evolution, page 13. IEEE Computer Society, 2003.
11. Y.-W. Huang, S.-K. Huang, T.-P. Lin, and C.-H. Tsai. Web application security assessment by fault injection and behavior monitoring. In WWW'03: Proceedings of the I2th international conference on World Wide Web, pages 148-159, New York, NY, USA, 2003. ACM.
12. W. Jones. Reliability models for very large software systems in industry. In International Symposium on Software Reliability Engineering, pages 35-42, 1991.
13. S. Kim and M. D. Ernst. Which warnings should i fix first? In Proceedings of the 6th joint meeting of the European Software Engineering Conference and the ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2007, Dubrovnik, Croatia, September 3-7, 2007, pages 45-54, 2007.
14. B. Korel and A. M. Al-Yami. Assertion-oriented automated test data generation. In ICSE'96: Proceedings of the 18th international conference on Software engineering, pages 71-80, Washington, DC, USA, 1996. IEEE CS.
15. I. V. Krsul. Software vulnerability analysis. PhD thesis, West Lafayette, IN, USA, 1998. Major Professor-Eugene H. Spafford.
16. P. L. Li, M. Shaw, J. Herbsleb, B. Ray, and P. Santhanam. Empirical evaluation of defect projection models for widely-deployed production software systems. In SIG-SOFT'04/FSE-12: Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering, pages 263-272, New York, NY, USA, 2004. ACM.
17. E. Merlo, D. Letarte, and G. Antoniol. Automated protection of php applications against SQL-injection attacks. In CSMR'07: Proceedings of the 11th European Conference on Software Maintenance and Reengineering, pages 191-202, Washington, DC, USA, 2007. IEEE Computer Society.
18. R. G. Miller. Simultaneous statistical inference. 2nd. Springer Verlag, 1981.
19. A. Mockus, D. M. Weiss, and P. Zhang. Understanding and predicting effort in software projects. In ICSE'03: Proceedings of the 25th International Conference on Software Engineering, pages 274-284, Washington, DC, USA, 2003. IEEE CS.
20. O. Ruwase and M.S. Lam. A practical dynamic buffer overflow detector. In NDSS, 2004.
21. D. Scott and R. Sharp. Abstracting application-level web security. In WWW'02: Proceedings of the 11th international conference on World Wide Web, pages 396-407, New York, NY, USA, 2002. ACM.
22. N. Tracey, J. Clark, K. Mander, and J. McDermid. Automated test-data generation for exception conditions. Softw. Pract. Exper., 30(1):61-79, 2000.
23. L. Wang, J. R. Cordy, and T. R. Dean. Enhancing security using legality assertions. In WCRE'05: Proceedings of the 12th Working Conference on Reverse Engineering, pages 35-44, Washington, DC, USA, 2005. IEEE CS.
24. C. Wohlin, P. Runeson, M. Höst, M. Ohlsson, B. Regnell, and A. Wesslén. Experimentation in Software Engineering - An Introduction. Kluwer Academic Publishers, 2000.
25. A. Wood. Predicting software reliability. IEEE Computer, 9:69-77, 1999.
26. R. K. Yin. Case Study Research: Design and Methods - Third Edition. SAGE Publications, London, 2002.
27. T. Zimmermann, P. Weisgerber, S. Diehl, and A. Zeller. Mining version histories to guide software changes. In ICSE'04: Proceedings of the 26th International Conference on Software Engineering, pages 563-572. IEEE CS, 2004.