Can complexity, coupling, and cohesion metrics be used as early indicators of vulnerabilities?

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2010, Pages 1963-1969

  Chowdhury, Istehad ^a   Zulkernine, Mohammad ^a  

^a QUEEN S UNIVERSITY   (Canada)

Author keywords

cohesion; complexity; coupling; empirical study; security; software metrics; software security; vulnerability

Indexed keywords

COHESION METRICS; CORRELATION PATTERNS; EMPIRICAL EVIDENCE; EMPIRICAL STUDIES; EMPIRICAL STUDY; FIREFOX; MOZILLA; OPERATIONAL STAGES; SECURITY FAILURE; SECURITY SOFTWARE; SOFTWARE DEVELOPER; SOFTWARE DEVELOPMENT; SOFTWARE METRICS; SOFTWARE SECURITY;

ADHESION; COMPUTER SOFTWARE; SECURITY OF DATA;

SOFTWARE DESIGN;

EID: 77954724866     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1774088.1774504     Document Type: Conference Paper

References (26)

1. A. G. Koru and J. Tian, "An Empirical Comparison and characterization of High Defect and High Complexity Modules," The Journal of Systems & Software, vol. 67, 2003, pp. 153-163.
2. A. Janes, M. Scotto, W. Pedrycz, B. Russo, M. Stefanovic, and G. Succi, "Identification of Defect-prone Classes in Telecommunication Software Systems Using Design Metrics," The Journal of Systems & Software, vol. 176, 2006, pp. 3711-3734.
3. K. E. Emam, W. Melo, and J. C. Machado, "The Prediction of Faulty Classes Using Object-Oriented Design Metrics," The Journal of Systems & Software, vol. 56, 2001, pp. 63-75.
4. th International Conference on Software Engineering, Shanghai, China, May 2006, pp. 452-461.
5. T. Menzies, J. Greenwald, and A. Frank, "Data Mining Static Code Attributes to Learn Defect Predictors," IEEE Trans. on Software Eng., vol. 33, no. 9, 2007, pp. 2-13.
6. th Pacific Rim International Symposium on Dependable Computing, Melbourne, Victoria, Australia, Dec 2007, pp. 93-96.
7. N. Nagappan, L. Williams, and M. Vouk, "Towards a Metric Suite for Early Software Reliability Assessment", in the Proc. of the 2003 International Symposium on Software Reliability Engineering, Denver, CO, USA, 2003, pp. 238-239.
8. IEEE, "IEEE Std 982.1-1988 IEEE Standard Dictionary of Measures to Produce Reliable Software," The Institute of Electrical and Electronics Engineers, Jun. 1988.
9. S.R. Chidamber and C.F. Kemerer, "A Metrics Suite for Object Oriented Design," IEEE Trans. on Software Eng., vol. 20, no. 6, 1994, pp. 476-493.
10. N. E. Fenton and S. L. Pfleeger, Software Metrics: A Rigorous and Practical Approach, PWS Publishing Co., Boston, MA, USA, 1997.
11. K. Ayari, P. Meshkinfam, Antoniol, G., and M. Di Penta, "Threats on building models from cvs and bugzilla repositories: the mozilla case study," in the Proc. of the 2007 Conference of the Center for Advanced Studies on Collaborative Research, Richmond Hill, Ontario, Canada, Oct. 2007, pp. 215-228.
12. O. H. Alhazmi, Y. K. Malaiya, and I. Ray, "Measuring, Analyzing and Predicting Security Vulnerabilities in Software Systems," Computers & Security, vol. 26, no. 3, 2007, pp. 219-228.
13. th ACM Conference on Computer and Communications Security, Virginia, USA, Oct. 2007, pp. 529-540.
14. M.Y. Liu and I. Traore, "Empirical Relations Between Attackability and Coupling: A case study on DoS," in the Proc. of the ACM SIGPLAN Workshop on Programming Languages and Analysis for Security, Ottawa, Canada, Jun. 2006, pp. 57-64.
15. th ACM Workshop on Quality of Protection, Virginia, USA, Oct. 2008, pp. 47-50.
16. nd ACM-IEEE International Symposium on Empirical Software Engineering and Measurement, Kaiserslautern, Germany, Oct. 2008, pp. 315-317.
17. rd International Doctoral Symposium on Empirical Software Engineering, Kaiserslautern, Germany, October 8, 2008.
18. th International Workshop on Software Engineering for Secure Systems, Leipzig, Germany, May 2008.pp. 57-64.
19. th International Conference on Software Maintenance, Beijing, China, Sept. 2008, pp 167-176.
20. nd ed., Academic Press New York, 1988.
21. Mozilla Firefox, http://www.mozilla.com/en-US/firefox (accessed July 2009).
22. Bugzilla, http://www.bugzilla.org (accessed July 2009).
23. Mozilla Vulnerabilities, http://www.mozilla.org/projects/security/ knownvulnerabilities (accessed July 2009).
24. SciTools Inc, http://www.scitools-.com (accessed July 2009).
25. Browser Statistics, http://ww.w3schools.com/browsers/browsers-stats.asp (accessed July 2009).
26. A. E. Hassan, Mining Software Repositories to Assist Developers and Support Managers, PhD. Thesis, University of Waterloo, 2004.