Searching for a needle in a haystack: Predicting security vulnerabilities for Windows Vista

ICST 2010 - 3rd International Conference on Software Testing, Verification and Validation

Volumn , Issue , 2010, Pages 421-428

  Zimmermann, Thomas ^a   Nagappan, Nachiappan ^a   Williams, Laurie ^b  

^a MICROSOFT RESEARCH   (United States)

^b North Carolina State University   (United States)

Author keywords

Churn; Complexity; Coverage; Dependencies; Metrics; Organizational structure; Prediction; Vulnerabilities

Indexed keywords

DATA SETS; EMPIRICAL STUDIES; HIGH PRECISION; LOWER PRECISION; ORGANIZATIONAL STRUCTURES; SECURITY VERIFICATION; SECURITY VULNERABILITIES; SOFTWARE MEASURES; SOFTWARE SYSTEMS; SOFTWARE VULNERABILITIES; WINDOWS VISTA;

COMPUTER OPERATING SYSTEMS; COMPUTER SOFTWARE SELECTION AND EVALUATION; FORECASTING; NEEDLES; POPULATION STATISTICS; SOFTWARE TESTING; VERIFICATION;

SECURITY OF DATA;

EID: 77954485601     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICST.2010.32     Document Type: Conference Paper

References (28)

1. V. R. Basili, F. Shull, and F. Lanubile, Building Knowledge Through Families of Experiments, IEEE Transactions on Software Engineering, vol. 25, pp. 456-473, 1999.
2. B. E. Boser, I. Guyon, and V. Vapnik. A Training Algorithm for Optimal Margin Classifiers. In Proceedings of the Fifth Annual ACM Conference on Computational Learning Theory. COLT '92. 144-152.
3. C. Catal and B. Diri. A systematic review of software fault prediction studies. Expert Systems With Applications, 2008.
4. J. Cohen, Statistical Power Analysis for the Behavioral Sciences, second ed. Lawrence Erlbaum Assoc., 1988. 427
5. M. Di Penta, L. Cerulo, and L. Aversano. The evolution and decay of statically detected source code vulnerabilities. In Proc. Int'l. Working Conf. on Source Code Analysis and Manipulation (SCAM), 2008.
6. N. E. Fenton and S. L. Pfleeger, Software Metrics: A Rigorous and Practical Approach: Brooks/Cole, 1998.
7. M. Gegick, P. Rotella, and L. Williams. Toward non-security failures as a predictor of security faults and failures. In Proc. Int'l. Symposium on Engineering Secure Software and Systems (ESSoS), 2009.
8. M. Gegick, L. Williams, J. Osborne, and M. Vouk. Prioritizing software security fortification throughcode-level metrics. In QoP '08: Proc. of the 4th ACM workshop on Quality of protection, pages 31-38. 2008.
9. M. Gegick, P. Rotella, and L. Williams. Predicting Attack-Prone Components, In International Conference on Software Testing, Verification, and Validation (ICST) 2009, Denver, CO, pp. 181-190.
10. Michael Howard and David LeBlanc. Writing Secure Code, Second Edition. 2002.
11. Z. Li, L. Tan, X. Wang, S. Lu, Y. Zhou, and C. Zhai. Have things changed now? An empirical study of bug characteristics in modern open source software. In Proc. Workshop on Architectural and System Support for Improving Software Dependability 2006, pages 25-33, October 2006.
12. P. K. Manadhata, J. M. Wing, M. Flynn, and M. McQueen: Measuring the attack surfaces of two FTP daemons. Proceedings of the 2nd ACM Workshop on Quality of Protection, QoP 2006. 3-10
13. T. J. McCabe: A Complexity Measure. IEEE Trans. Software Eng. 2(4): 308-320 (1976)
14. P. Mell, K. Scarfone, and S. Romanosky. CVSS. A Complete Guide to the Common Vulnerability Scoring System. Version 2.0. http://www.first.org/cvss/ cvss-guide.html
15. A. Meneely and L. Williams. Secure Open Source Collaboration: An Empirical Study of Linus' Law, ACM Computers and Communication Security (CCS), 2009.
16. J. Munson and T. Khoshgoftaar. The Detection of Fault-Prone Programs, IEEE Transactions on Software Engineering, vol. 18, pp. 423-433, 1992.
17. N. Nagappan and T. Ball. Use of relative code churn measures to predict system defect density. In Proceedings of the 27th International Conference on Software Engineering, ICSE '05. 284-292.
18. N. Nagappan and T. Ball. Using Software Dependencies and Churn Metrics to Predict Field Failures: An Empirical Case Study. In Proceedings of the First International Symposium on Empirical Software Engineering and Measurement, ESEM'07. 364-373
19. N. Nagappan, T. Ball, and A. Zeller. Mining metrics to predict component failures. In Proceedings of the 28th International Conference on Software Engineering, ICSE '06. 452-461.
20. N. Nagappan, B. Murphy, and V. Basili. The influence of organizational structure on software quality: an empirical case study. In Proceedings of the 30th International Conference on Software Engineering, ICSE '08. 521-530.
21. National Vulnerability Database. http://nvd.nist.gov/
22. S. Neuhaus, T. Zimmermann, C. Holler, and A. Zeller. Predicting vulnerable software components. In Proceedings of the 14th ACM Conference on Computer and Communications Security, CCS '07. 529-540.
23. S. Neuhaus, T. Zimmermann. The Beauty and the Beast: Vulnerabilities in Red Hat's Packages. In Proceedings of the 2009 USENIX Annual Technical Conference (USENIX ATC), June 2009.
24. A. Ozment and S. E. Schechter. Milk or wine: Does software security improve with age? In Proc. 15th Usenix Security Symposium, August 2006.
25. J. C. Platt, Fast Training of Support Vector Machines using Sequential Minimal Optimization. In Advances in Kernel Methods - Support Vector Learning, B. Schölkopf, C. J. C. Burges, and A. J. Smola, Eds.: MIT Press, 1998, pp. 185-208.
26. A. Schröter, T. Zimmermann, and A. Zeller. Predicting component failures at design time. In Proceedings of the 2006 ACM/IEEE international Symposium on Empirical Software Engineering, ISESE '06. 18-27.
27. Y. Shin and L. Williams. Is complexity really the enemy of software security? In QoP '08: Proc. 4th ACM workshop on Quality of protection, pages 31-38. ACM, 2008.
28. T. Zimmermann and N. Nagappan. Predicting Defects with Program Dependencies (Short Paper). In Proceedings of the Third International Symposium on Empirical Software Engineering and Measurement, ESEM '09. 428