Please use this identifier to cite or link to this item:
Title: Examining the Capacity of Text Mining and Software Metrics in Vulnerability Prediction
Authors: Kalouptsoglou, Ilias
Siavvas, Miltiadis
Kehagias, Dionysios
Chatzigeorgiou, Alexander
Ampatzoglou, Apostolos
Type: Article
Subjects: FRASCATI::Natural sciences::Computer and information sciences
Keywords: dataset extension
deep learning
ensemble learning
machine learning
software metrics
text mining
vulnerability prediction
Issue Date: 5-May-2022
Source: Entropy (Basel, Switzerland)
Volume: 24
Issue: 5
First Page: 651
Abstract: Software security is a very important aspect for software development organizations who wish to provide high-quality and dependable software to their consumers. A crucial part of software security is the early detection of software vulnerabilities. Vulnerability prediction is a mechanism that facilitates the identification (and, in turn, the mitigation) of vulnerabilities early enough during the software development cycle. The scientific community has recently focused a lot of attention on developing Deep Learning models using text mining techniques for predicting the existence of vulnerabilities in software components. However, there are also studies that examine whether the utilization of statically extracted software metrics can lead to adequate Vulnerability Prediction Models. In this paper, both software metrics- and text mining-based Vulnerability Prediction Models are constructed and compared. A combination of software metrics and text tokens using deep-learning models is examined as well in order to investigate if a combined model can lead to more accurate vulnerability prediction. For the purposes of the present study, a vulnerability dataset containing vulnerabilities from real-world software products is utilized and extended. The results of our analysis indicate that text mining-based models outperform software metrics-based models with respect to their F2-score, whereas enriching the text mining-based models with software metrics was not found to provide any added value to their predictive performance.
ISSN: 1099-4300
Electronic ISSN: 1099-4300
Other Identifiers: 10.3390/e24050651
Appears in Collections:Department of Applied Informatics

Files in This Item:
File Description SizeFormat 
kalouptsoglou2022entropy.pdf831,35 kBAdobe PDFView/Open

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.