Presentation
Process-Based Predictors of Vulnerability Reintroduction
DescriptionThere is growing interest in securing scientific software, which underpins research results and often transitions into commercial systems. While source code metrics provide useful indicators of vulnerabilities, software engineering process (SEP) metrics can uncover patterns that lead to their introduction. Few studies have explored whether SEP metrics can reveal risky development activities over time—insights that are essential for predicting vulnerabilities.
This work highlights the critical role of SEP metrics in understanding and mitigating vulnerability reintroduction. We move beyond file-level prediction and analyze security fixes at the commit level, focusing on sequences of changes where vulnerabilities evolve and re-emerge. Our approach emphasizes that reintroduction is rarely the result of one isolated action, but emerges from cumulative development activities and socio-technical conditions.
This work highlights the critical role of SEP metrics in understanding and mitigating vulnerability reintroduction. We move beyond file-level prediction and analyze security fixes at the commit level, focusing on sequences of changes where vulnerabilities evolve and re-emerge. Our approach emphasizes that reintroduction is rarely the result of one isolated action, but emerges from cumulative development activities and socio-technical conditions.
Event Type
Research and ACM SRC Posters
TimeThursday, 20 November 20258:00am - 5:00pm CST
LocationSecond Floor Atrium
Archive
view