Software Metrics as Indicators of Security Vulnerabilities

摘要: Detecting software security vulnerabilities and distinguishing vulnerable from non-vulnerable code is anything but simple. Most of the time, remain undisclosed until they are exposed, for instance, by an attack during operational phase. Software metrics widely-used indicators quality, question whether can be used to distinguish units ones development. In this paper, we perform exploratory study on metrics, their interdependency, relation with vulnerabilities. We aim at understanding: i) correlation between architectural characteristics, represented in form number vulnerabilities; ii) which most informative discriminative that allow identifying code. To achieve these goals, use, respectively, coefficients heuristic search techniques. Our analysis carried out a dataset includes reported vulnerabilities, exposed attacks, all functions, classes, files five widely projects. Results show: strong several project-level possibility using group both file function levels, high level accuracy.