Reference : Vulnerability Prediction Models: A case study on the Linux Kernel
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/28259
Vulnerability Prediction Models: A case study on the Linux Kernel
English
Jimenez, Matthieu mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Papadakis, Mike mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Le Traon, Yves mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Oct-2016
16th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2016, Raleigh, US, October 2-3, 2016
Yes
No
International
16th IEEE International Working Conference on Source Code Analysis and Manipulation
from 02-10-2016 to 03-10-2016
[en] Vulnerability Prediction Model ; Replication ; Linux Kernel
[en] To assist the vulnerability identification process, researchers proposed prediction models that highlight (for inspection) the most likely to be vulnerable parts of a system. In this paper we aim at making a reliable replication and comparison of the main vulnerability prediction models. Thus, we seek for determining their effectiveness, i.e., their ability to distinguish between vulnerable and non-vulnerable components, in the context of the Linux Kernel, under different scenarios. To achieve the above-mentioned aims, we mined vulnerabilities reported in the National Vulnerability Database and created a large dataset with all vulnerable components of Linux from 2005 to 2016. Based on this, we then built and evaluated the prediction models. We observe that an approach based on the header files included and on function calls performs best when aiming at future vulnerabilities, while text mining is the best technique when aiming at random instances. We also found that models based on code metrics perform poorly. We show that in the context of the Linux kernel, vulnerability prediction models can be superior to random selection and relatively precise. Thus, we conclude that practitioners have a valuable tool for prioritizing their security inspection efforts.
University of Luxembourg: High Performance Computing - ULHPC
http://hdl.handle.net/10993/28259
10.1109/SCAM.2016.15

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Open access
Jimenez_VPMLinuxKernel.pdfAuthor preprint438.28 kBView/Open

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.