Copy the page URI to the clipboard
Peters, Fayola; Tun, Thein; Yu, Yijun and Nuseibeh, Bashar
(2019).
DOI: https://doi.org/10.1109/TSE.2017.2787653
Abstract
Security bug reports can describe security critical vulnerabilities in software products. Bug tracking systems may contain thousands of bug reports, where relatively few of them are security related. Therefore finding unlabelled security bugs among them can be challenging. To help security engineers identify these reports quickly and accurately, text-based prediction models have been proposed. These can often mislabel security bug reports due to a number of reasons such as class imbalance, where the ratio of non-security to security bug reports is very high. More critically, we have observed that the presence of security related keywords in both security and non-security bug reports can lead to the mislabelling of security bug reports. This paper proposes FARSEC, a framework for filtering and ranking bug reports for reducing the presence of security related keywords. Before building prediction models, our framework identifies and removes non-security bug reports with security related keywords. We demonstrate that FARSEC improves the performance of text-based prediction models for security bug reports in 90% of cases. Specifically, we evaluate it with 45,940 bug reports from Chromium and four Apache projects. With our framework, we mitigate the class imbalance issue and reduce the number of mislabelled security bug reports by 38%.
Viewing alternatives
Download history
Metrics
Public Attention
Altmetrics from AltmetricNumber of Citations
Citations from DimensionsItem Actions
Export
About
- Item ORO ID
- 53059
- Item Type
- Journal Item
- ISSN
- 0098-5589
- Project Funding Details
-
Funded Project Name Project ID Funding Body Adaptive Security And Privacy (XC-11-004-BN) 291652 EC (European Commission): FP (inc.Horizon2020, ERC schemes) - Keywords
- security cross words; security related keywords; security bug reports; text filtering; ranking; prediction models; transfer learning
- Academic Unit or School
-
Faculty of Science, Technology, Engineering and Mathematics (STEM) > Computing and Communications
Faculty of Science, Technology, Engineering and Mathematics (STEM) - Research Group
- Health and Wellbeing PRA (Priority Research Area)
- Copyright Holders
- © 2017 IEEE
- Depositing User
- Thein Tun