一句话：提出在需求工程阶段利用数据驱动方法自动预测漏洞的框架，并给出初步验证。
现有基于静态代码分析和机器学习的漏洞预测多面向实现后的代码，难以在开发早期预防漏洞。本文针对漏洞可能源于需求规格且后期修复代价高的问题，提出一种数据驱动的自动化支持框架，目标是在需求工程阶段即对需求条目进行漏洞预测。作者还给出了框架的初步演示，观察到的结果较为积极，说明该研究方向具有潜力，并为后续在需求阶段开展预防性安全分析提供了新思路。
Due to the abundance of security breaches we continue to see, the software development community is recently paying attention to a more proactive approach towards security. This includes predicting vulnerability before exploitation employing static code analysis and machine learning techniques. Such mechanisms, however, are designed to detect post-implementation vulnerabilities. As the root of a vulnerability can often be traced back to the requirement specification, and vulnerability discovered later in the development life cycle is more expensive to fix, we need additional preventive mechanisms capable of predicting vulnerability at a much earlier stage. In this paper, we propose a novel framework providing an automated support to predict vulnerabilities for a requirement as early as during requirement engineering. We further present a preliminary demonstration of our framework and the promising results we observe clearly indicate the value of this new research idea.
DOI 原文 ·
@inproceedings{paperbot4647,
title = {Towards data-driven vulnerability prediction for requirements},
author = {Sayem Mohammad Imtiaz and Tanmay Bhowmik},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3264836}
}