一句话：提出 Bellwether 算法筛选代表性数据子集并调参，提升漏洞预测模型精度与成本效益。
漏洞预测模型（VPMs）用于识别大型软件系统中的易受攻击组件，但存在特征选择、机器学习使用方式以及忽略参数优化影响等问题。本文研究 Bellwether 分析对 VPMs 的作用：首先提出 Bellwether 算法，从数据中识别并选取具有代表性的示例子集作为 Bellwether，以在基准上提高预测精度；然后构建具有不同参数设置的机器学习方法，评估参数配置对性能的改善。采用精确率、召回率、F-measure 及其他统计指标评估。初步结果显示，在多个应用上 Bellwether 方法优于基准技术，F-measure 范围为 51.1%-98.5%。
Vulnerability Prediction Models (VPMs) aims to identify vulnerable and non-vulnerable components in large software systems. Consequently, VPMs presents three major drawbacks (i) finding an effective method to identify a representative set of features from which to construct an effective model. (ii) the way the features are utilized in the machine learning setup (iii) making an implicit assumption that parameter optimization would not change the outcome of VPMs. To address these limitations, we investigate the significant effect of the Bellwether analysis on VPMs. Specifically, we first develop a Bellwether algorithm to identify and select an exemplary subset of data to be considered as the Bellwether to yield improved prediction accuracy against the growing portfolio benchmark. Next, we build a machine learning approach with different parameter settings to show the improvement of performance of VPMs. The prediction results of the suggested models were assessed in terms of precision, recall, F-measure, and other statistical measures. The preliminary result shows the Bellwether approach outperforms the benchmark technique across the applications studied with F-measure values ranging from 51.1%-98.5%.
DOI 原文 ·
@inproceedings{paperbot5380,
title = {A cost-effective strategy for software vulnerability prediction based on bellwether analysis},
author = {Patrick Kwaku Kudjo and Jinfu Chen},
booktitle = {ISSTA},
year = {2019},
doi = {10.1145/3293882.3338985}
}