Predicting vulnerable software components

  • Authors:

  • Stephan Neuhaus;Thomas Zimmermann;Christian Holler;Andreas Zeller

  • Affiliations:

  • Saarland University, Saarbrücken, Germany;University of Calgary, Alberta, Canada;Saarland University, Saarbrücken, Germany;Saarland University, Saarbrücken, Germany

  • Venue:
  • Proceedings of the 14th ACM conference on Computer and communications security
  • Year:
  • 2007

Quantified Score

Hi-index 0.02

Visualization

Abstract

Where do most vulnerabilities occur in software? Our Vulture tool automatically mines existing vulnerability databases and version archives to map past vulnerabilities to components. The resulting ranking of the most vulnerable components is a perfect base for further investigations on what makes components vulnerable. In an investigation of the Mozilla vulnerability history, we surprisingly found that components that had a single vulnerability in the past were generally not likely to have further vulnerabilities. However, components that had similar imports or function calls were likely to be vulnerable. Based on this observation, we were able to extend Vulture by a simple predictor that correctly predicts about half of all vulnerable components, and about two thirds of all predictions are correct. This allows developers and project managers to focus their their efforts where it is needed most: "We should look at nsXPInstallManager because it is likely to contain yet unknown vulnerabilities.".