Challenging machine learning algorithms in predicting vulnerable javascript functions
The rapid rise of cyber-crime activities and the growing number of devices threatened by them place software security issues in the spotlight. As around 90% of all attacks exploit known types of security issues, finding vulnerable components and applying existing mitigation techniques is a viable pr...
Elmentve itt :
| Szerzők: | |
|---|---|
| Dokumentumtípus: | Könyv része |
| Megjelent: |
Institute of Electrical and Electronics Engineers Inc.
2019
|
| Sorozat: | 7th IEEE/ACM International Workshop on Realizing Artificial Intelligence Synergies in Software Engineering, RAISE 2019
|
| doi: | 10.1109/RAISE.2019.00010 |
| mtmt: | 30881323 |
| Online Access: | http://publicatio.bibl.u-szeged.hu/17461 |
| LEADER | 02734naa a2200277 i 4500 | ||
|---|---|---|---|
| 001 | publ17461 | ||
| 005 | 20191122123413.0 | ||
| 008 | 191122s2019 hu o 0|| zxx d | ||
| 020 | |a 9781728122724 | ||
| 024 | 7 | |a 10.1109/RAISE.2019.00010 |2 doi | |
| 024 | 7 | |a 30881323 |2 mtmt | |
| 040 | |a SZTE Publicatio Repozitórium |b hun | ||
| 041 | |a zxx | ||
| 100 | 1 | |a Ferenc Rudolf | |
| 245 | 1 | 0 | |a Challenging machine learning algorithms in predicting vulnerable javascript functions |h [elektronikus dokumentum] / |c Ferenc Rudolf |
| 260 | |a Institute of Electrical and Electronics Engineers Inc. |c 2019 | ||
| 300 | |a 7 | ||
| 300 | |a 8-14 | ||
| 490 | 0 | |a 7th IEEE/ACM International Workshop on Realizing Artificial Intelligence Synergies in Software Engineering, RAISE 2019 | |
| 520 | 3 | |a The rapid rise of cyber-crime activities and the growing number of devices threatened by them place software security issues in the spotlight. As around 90% of all attacks exploit known types of security issues, finding vulnerable components and applying existing mitigation techniques is a viable practical approach for fighting against cyber-crime. In this paper, we investigate how the state-of-the-art machine learning techniques, including a popular deep learning algorithm, perform in predicting functions with possible security vulnerabilities in JavaScript programs. We applied 8 machine learning algorithms to build prediction models using a new dataset constructed for this research from the vulnerability information in public databases of the Node Security Project and the Snyk platform, and code fixing patches from GitHub. We used static source code metrics as predictors and an extensive grid-search algorithm to find the best performing models. We also examined the effect of various re-sampling strategies to handle the imbalanced nature of the dataset. The best performing algorithm was KNN, which created a model for the prediction of vulnerable functions with an F-measure of 0.76 (0.91 precision and 0.66 recall). Moreover, deep learning, tree and forest based classifiers, and SVM were competitive with F-measures over 0.70. Although the F-measures did not vary significantly with the re-sampling strategies, the distribution of precision and recall did change. No re-sampling seemed to produce models preferring high precision, while re-sampling strategies balanced the IR measures. © 2019 IEEE. | |
| 700 | 0 | 1 | |a Hegedűs Péter |e aut |
| 700 | 0 | 1 | |a Gyimesi Péter |e aut |
| 700 | 0 | 1 | |a Antal Gábor |e aut |
| 700 | 0 | 1 | |a Bán Dénes |e aut |
| 700 | 0 | 1 | |a Gyimóthy Tibor |e aut |
| 856 | 4 | 0 | |u http://publicatio.bibl.u-szeged.hu/17461/1/FHG19-Challenging20Machine20Learning20Algorithms20in20Predicting20Vulnerable20JavaScript20Functions.pdf |z Dokumentum-elérés |