Ingresando al terreno

Modeling in SE research is primarily concerned with reducing the gap between software problems and implementation through the use of models that describe complex systems at multiple levels of abstraction and from a variety of perspectives [120]. Table 6 summarizes the surveyed articles classified in this SE task, showing title of each article, publication year, name of the used SVDB, and what the SVDB was used for.

Table 6: SE articles using SVDBs in SE modeling task

Reference Title of Paper Year SVDBs How SVDBs Used

Alqahtani et al. [44] SV-AF - A Security Vulnerability _{Analysis Framework} 2016 NVD Modeling vulnerability _information.

Morrison et al. [121] A Security Practices Evaluation _Framework 2015 OWASP and _NVD Modeling secure coding _{practices knowledge.}

Ilo et al. [63]

Combining Software Interrelationship Data Across Heterogeneous Software Repositories

2015 NVD Modeling vulnerability _information.

Chatzipoulidis et al. [60]

Information Infrastructure Risk Prediction Through Platform

Vulnerability Analysis 2015 NVD

Used vulnerability measures information.

Scandariato et al. [61] Predicting Vulnerable Software _{Components via Text Mining} 2014 NVD Extracted seven vulnerability reports related

to Android apps.

Murtaza et al. [122] Total ADS: Automated Software _{Anomaly Detection System} 2014 CVE Downloaded specific _{vulnerabilities examples.}

Milenkoski et al.

[123] Experience Report: An Analysis of Hypercall Handler Vulnerabilities 2014 CVE Downloaded 23 vulnerabilities.

Shar et al. [62] Mining SQL Injection and Cross Site Scripting Vulnerabilities Using

Hybrid Program Analysis 2013

CVE and

PMASA Downloaded vulnerability information.

Berger et al. [58] Extracting and Analyzing the Implemented Security Architecture

of Business Applications 2013 CWE

Extracted vulnerability attacks examples. Almorsy et al. [124] Automated Software Architecture Security Risk Analysis Using

Formalized Signatures 2013 CAPEC

Applying predefined security pattern attacks. Shar et al. [125]

Predicting Common Web Application Vulnerabilities from Input Validation and Sanitization Code Patterns

2012 SecurityFocus Downloaded vulnerable _projects.

Almorsy et al. [126]

Supporting Automated Vulnerability Analysis Using Formalized Vulnerability Signatures

2012 OWASP Downloaded vulnerability information and attack

types.

Gauthier et al. [127] Fast Detection of Access Control _{Vulnerabilities in PHP Applications} 2012 OWASP and _CVE Downloaded specific number of vulnerability

Wu et al. [64] Empirical Results on the Study of Software Vulnerabilities (NIER

Track) 2011 CWE, CVE

Modeling vulnerability attack and relations with software projects.

Pham et al. [65] Detecting Recurring and Similar _{Software Vulnerabilities} 2010 CERT and CVE Downloaded and analyzed _{2, 598 vulnerabilities.}

Anbalagan et al. [66] Towards a Unifying Approach in _{Understanding Security Problems} 2009 OSVDB, NVD Downloaded and analyzed _{43, 710 vulnerabilities.}

Cavusoglu et al. [67]

Efficiency of Vulnerability Disclosure Mechanisms to Disseminate Vulnerability Knowledge

2007 CERT Downloaded and studied the disclosure policy of

vulnerabilities reports.

Xu et al. [128] Threat-Driven Modeling and Verification of Secure Software

Using Aspect-Oriented Petri Nets 2006 SecurityFocus

Studied specific vulnerability attacks.

Byers et al. [129] Modeling Software Vulnerabilities _{With Vulnerability Cause Graphs} 2006 CVE Used vulnerability _{information as a case study.}

Table 6 shows articles classified in this SE task. We manually classified these articles based on their content into four categories: knowledge modeling papers, vulnerability prediction models papers, threat modeling papers, and others. In what follows, we provide a summary of each article in each category.

Knowledge modeling. In our survey, this SE task (i.e., modeling) often uses SVDBs as a source

of knowledge modeling for vulnerability analysis and interlinking (e.g., Alqahtani et al. [44], Morrison et al. [121], Ilo et al. [63], Wu et al. [64], Pham et al. [65], Anbalagan et al. [66], and Cavusoglu et al. [67]). Alqahtani et al. [44] introduced a vulnerability analysis framework based on Semantic Web technologies, and used NVD as an example of SVDBs that can be integrated with SE knowledge sources (e.g., source code repositories, issue tracker systems) to study software security evolution. In other related work, Ilo et al. [63] introduced abstract research, which proposed an ontology for the semantic modeling of the relationships between SE ecosystems as linked data. They also proposed to evaluate their approach by integrating the data of several ecosystems (Maven29 _{and NVD) and demonstrated its usefulness by creating tools for}

vulnerability notification and license violation detection. Wu et al. [64] proposed organizing the information in project repositories around semantic templates (semantic templates are generalized patterns of relationship between software elements and faults, and their association with known higher level phenomena in the security domain [130]). In this paper the authors presented preliminary results of an experiment conducted to evaluate the effectiveness of using

semantic templates as an aid to studying software vulnerabilities. In the experiment they used

several reported vulnerabilities in the Apache Web Server from NVD.

We found SVDBs used as a knowledge source for software security practices—for example, Morrison et al. [121] who proposed a security practices evaluation framework. The goal of their framework is to aid software practitioners in evaluating security practice use in the development process by defining and validating a measurement framework for software development security practice use and outcomes. For evaluating the framework they proposed the use of historical data and industrial projects from different repositories such as OWASP and NVD.

By using vulnerabilities from OSVDB and NVD, Anbalagan et al. [66] discussed a model that captures software systems vulnerabilities status including the type of vulnerabilities, their disclosure status, exploit status, and their correction status. They mapped vulnerabilities for Bugzilla and FEDORA products to the model, with the goal to estimate model parameters in terms of studying the relationship between security problems and security exploits. In related work, Pham et al. [65] showed an approach to detecting recurring and similar software vulnerabilities. They proposed SecureSync, an automatic approach to detect and provide suggested resolutions for recurring software vulnerabilities on multiple systems sharing/using similar code or API libraries. They extracted and analyzed vulnerabilities reports from the US- CERT database. Additionally, the authors used some vulnerability information from the CVE database.

Cavusoglu et al. [67] studied how vulnerabilities should be disclosed to minimize the associated social loss. The authors developed a game-theoretical model [67] in which the coordinator minimizes the societal loss, which includes both damage to vulnerable firms and the patch development cost to the software vendor. The proposed model consists of four stakeholders in the vulnerability knowledge dissemination process: software developer (vendor), software deployers (firms), vulnerability identifier (benign user or hacker), and central coordinator (CERT30).

Vulnerability Prediction Models (VPM). We also found that the surveyed articles in this SE task

used SVDBs for VPMs (e.g., Chatzipoulidis et al. [60], Scandariato et al. [61], Shar et al. [62], and Shar et al. [125]). VPM is a field of study which aims at automatically classifying software

entities as vulnerable or not. For example, Shar et al. [62] and [125] showed a machine learning technique to predict common web application’s vulnerabilities from input validation and sanitization code patterns. They proposed a set of static code attributes that represent the characteristics of input validation and sanitization routines for predicting the two most common web application vulnerabilities—SQL injection and cross site scripting. The test subjects’ vulnerability information was extracted from the SecurityFocus repository and CVE dataset. In related work, Scandariato et al. [61] presented an approach based on machine learning to predict which components of a software application contain security vulnerabilities. The approach is based on text mining the source code of the components.

Chatzipoulidis et al. [60] aimed to provide a complementary approach to existing vulnerability prediction solutions and launched the measurement of zero-day risk by introducing a risk prediction methodology for an information infrastructure. The practicality of the risk prediction methodology is demonstrated with an implementation example from the electronic banking sector and vulnerability information extracted from NVD.

Threat Modeling. Some of the surveyed articles in this SE task introduced threat modeling

approaches (e.g., Berger et al. [58], Xu et al. [128]) using SVDBs as a knowledge source. Threat modeling is an approach for analyzing the security of an application [131]. It is a structured approach that enables you to identify, quantify, and address the security risks associated with an application [131]. Berger et al. [58] proposed a technique that automatically extracts the implemented security architecture of Java-based business applications from the source code. They carried out threat modeling on this extracted architecture to detect security flaws. To create the proposed approach’s knowledge base containing well-known threats as well as possible mitigations, the researchers inspected the CWE database which lists a number of security problems and their consequences, as well as potential mitigations. Xu et al. [128] presented a formal threat-driven model approach which explores explicit behaviors of security threats as the mediator between security goals and applications of security features. They demonstrated their approach through a systematic case study on the threat-driven modeling and verification of a real-world shopping cart application (using vulnerability information from SecurityFocus database).

Others. Last, we find other papers in this SE task that introduce modeling approaches with help

from SVDBs information. For example the use of SVDBs in modeling specific vulnerabilities for anomaly detection (e.g., Murtaza et al. [122]), using SVDBs information to model and understand hypercall31 _{handler vulnerabilities (e.g., Milenkoski et al. [123]), defining and}

modeling formal vulnerabilities signatures by using vulnerabilities signatures provided by SVDBs (e.g., Almorsy et al. [124], Almorsy et al. [126]), and locating the vulnerability root cause by modeling SVDBs vulnerabilities based on the vulnerability cause graph technique (e.g., Byers et al. [129]).