Abstract
With the increasing role of technologies in our daily lives, software security has become an important issue to provide protection from malicious attacks and ultimately avoid irreversible damage to systems. The collection of data reflecting the quality of programming allows the application and training of machine learning algorithms to predict if potential software vulnerabilities are in a script, knowing some of its features. We examine if these algorithms can be used to predict some score that reflects the severity of vulnerabilities in a script prior to release. To this end, we develop a crucial preprocessing stage to define a metric that reflects the programmer evolution over time and be aware of future flaws in his code. To provide a comprehensive performance assessment, we use a private dataset containing labelled vulnerabilities of a programmer over time recorded by code snippet. Ultimately, an effective early diagnosis system is obtained.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Dempsey, K., Paul, E., George, M., Takamura, E.: In: Automation Support for Security: Software Vulnerability Management. NIST (2020)
Rebecca, L., Russell, Kim, L.: Automated vulnerability detection in source code using deep representation learning. In: IEEE International Conference on Machine Learning and Applications (IEEE ICMLA 2018), Orlando, Florida, USA (2018)
Bilgin, Z., Ersoy, M.A.: Vulnerability prediction from source code using machine learning. pp. 8. (2020)
Delaitre, A.M., Stivalet, B.C.: Sate V report: ten years of static analysis tool expositions (2018)
Engler, D., Chen, D.Y.: Bugs as deviant behavior: a general approach to inferring errors in systems code. 35(5) (2001)
Kim, S., Woo, S.: (s.f.). VUDDY: a scalable approach for vulnerable code clone discovery (2017)
Engler, D.A.: Under-constrained symbolic execution: correctness checking for real code (2015)
Li, Z., Zou, D., Xu, S., Ou, X., Jin, H., Wang, S., ... Zhong, Y. Vuldeepecker: a deep learning-based system for vulnerability detection (2018). arXiv preprint arXiv:1801.01681
M. Sutton, Greene, A.: Fuzzing: brute force vulnerability discovery (2007)
Song, J.N.: Dynamic taint analysis for automatic detection analysis and signature generation of exploits on commodity software (2005)
Li, X., Wang, L.: Automated software vulnerability detection based on hybrid neural network. Appl. Sci. (2021)
Jiang, J., Wen, S.: Identifying propagation sources in networks: state-of-the-art and comparative studies. 19(1) (2017)
Shin, Y., Ersoy, A.M.: Evaluating complexity code churn and developer activity metrics as indicators of software vulnerabilities. 37(6) (2011)
Rahimi, S., Zargham, M.: Vulnerability scrying method for software vulnerability discovery prediction without a vulnerability database. 2(62) (2013)
Alhazmi, O.H., Malaiya, M.Y.: Quantitative vulnerability assessment of systems software. In: Reliability and Maintainability Symposium (2005)
Friedman, J.: Greedy function approximation: a gradient boosting machine. 5(29) (2001)
Hastie, T.T.: The elements of statistical learning: data mining, inference and prediction (2009)
Johnson, M.K.: In: Applied predictive modeling. Springer (2013)
Ban, X., Liu, S., Chen, C., Chua, C.: A performance evaluation of deep-learnt features for software vulnerability detection. Concurrency and Comput.: Practice and Exper. 31(19), e5103 (2019)
Acknowledgements
This research work has been funded by the Spanish Ministry of Energy, Tourism and Digital Agenda, project “TrustedCoding: Plataforma de detección de vulnerabilidades y aprendizaje de soluciones para una codificación segura e inteligente” with ID: TSI- 100906-2019-6.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Alonso-García, M., Fuente-Alonso, R., Corchado, J.M. (2023). Machine Learning Based System for the Control and Evaluation of Programming Vulnerabilities. In: Julián, V., Carneiro, J., Alonso, R.S., Chamoso, P., Novais, P. (eds) Ambient Intelligence—Software and Applications—13th International Symposium on Ambient Intelligence. ISAmI 2022. Lecture Notes in Networks and Systems, vol 603. Springer, Cham. https://doi.org/10.1007/978-3-031-22356-3_17
Download citation
DOI: https://doi.org/10.1007/978-3-031-22356-3_17
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-22355-6
Online ISBN: 978-3-031-22356-3
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)