Vulnerability prediction capability: A comparison between vulnerability discovery models and neural network models. Issue 87 (November 2019)

• Record Type: Journal Article
• Authors: Movahedi, Yazdan; Cukier, Michel; Gashi, Ilir
• Is Part Of: Computers & security. Issue 87(2019)
• Publication Date: 2019-11
• Subjects: Vulnerability discovery model -- Neural network model -- Time series -- Vulnerability discovery process -- Prediction -- Software reliability; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.101596
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: In this paper, we introduce an approach for predicting the cumulative number of software vulnerabilities that is in most cases more accurate than vulnerability discovery models (VDMs). Our approach uses a neural network model (NNM) to model the nonlinearities associated with vulnerability disclosure. Nine common VDMs were used to compare their prediction capability with our approach. The different models were applied to vulnerabilities associated with eight well-known software (four operating systems and four web browsers). The models were assessed in terms of prediction accuracy and prediction bias. Out of eight software we analyzed, the NNM outperformed the VDMs in all the cases in terms of prediction accuracy, and provided smaller values of absolute average bias in seven cases. This study shows that NNMs are promising for accurate predictions of software vulnerabilities disclosures.