检索结果-内蒙古大学图书馆

NG_MDERANK: A software vulnerability feature knowledge extraction method based on N-gram similarity

JOURNAL OF software-EVOLUTION AND PROCESS 2025年第1期37卷

作者： Wu, Xiaoxue Weng, Shiyu Zheng, Bin Zheng, Wei Chen, Xiang Sun, Xiaobin Yangzhou Univ Sch Informat Engn Yangzhou Peoples R China Northwestern Polytech Univ Sch Software Xian Peoples R China Nantong Univ Sch Informat Sci & Technol Nantong Peoples R China

As software grows in size and complexity, software vulnerabilities are increasing, leading to a range of serious insecurity issues. Open-source software vulnerability reports and documentation can provide researchers with great convenience for analysis and detection. However, the quality of different data sources varies, the data are duplicated and lack of correlation, which often requires a lot of manual management and analysis. In order to solve the problems of scattered and heterogeneous data and lack of correlation in traditional vulnerability repositories, this paper proposes a software vulnerability feature knowledge extraction method that combines the N-gram model and mask similarity. The method generates mask text data based on the extraction of N-gram candidate keywords and extracts vulnerability feature knowledge by calculating the similarity of mask text. This method analyzes the samples efficiently and stably in the environment of large sample size and complex samples and can obtain high-value semi-structured data. Then, the final node, relationship, and attribute information are obtained by secondary knowledge cleaning and extraction of the extracted semi-structured data results. And based on the extraction results, the corresponding software vulnerability domain knowledge graph is constructed to deeply explore the semantic information features and entity relationships of vulnerabilities, which can help to efficiently study software security problems and solve vulnerability problems. The effectiveness and superiority of the proposed method is verified by comparing it with several traditional keyword extraction algorithms on Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) vulnerability data. Proposing NG_MDERANK, a novel approach for extracting software vulnerability feature knowledge using N-gram similarity, enhancing detection and analysis of vulnerabilities by identifying multiword phrases critical to security. NG_MDER

关键词： knowledge extraction knowledge graph mask similarity software security software vulnerability

来源：评论

学校读者我要写书评

暂无评论

Hybrid feature selection module for improving performance of software vulnerability severity prediction model on textual dataset

引用

COMPUTING 2025年第2期107卷 1-37页

作者： Malhotra, Ruchika Vidushi Delhi Technol Univ Software Engn Dept Delhi India Vivekananda Inst Profess Studies Sch Engn & Technol Tech Campus Delhi India

software vulnerability severity prediction is a critical area in software engineering, where model performance heavily depends on the quality of the feature set used for training. Challenges such as feature redundancy, correlations, and irrelevant features can degrade model effectiveness, emphasizing the importance of Feature Selection (FS) methods to optimize performance and reduce development costs. In this study, we introduce two innovative FS modules within the homogeneous wrapper method category. The first, Parallel-Grey Wolf Optimization (P-GWO), employs a hybrid approach combining Grey Wolf Optimization (GWO) with Opposition-Based Learning (OBL). The second, Multi-Stage Grey Wolf Whale Optimization (MS-G2WO), uses GWO to find an initial optimal solution, which is further refined by the Whale Optimization Algorithm (WOA). Both modules are evaluated using Area Under Curve (AUC) values, demonstrating the significant impact of FS on model performance. Our experimental results show that P-GWO achieved superior performance with a mean AUC of 0.804, followed by MS-G2WO with a mean AUC of 0.77, establishing the effectiveness of these proposed methods in improving vulnerability severity prediction models.

关键词： software vulnerability Severity prediction Prediction model Feature selection

来源：评论

学校读者我要写书评

暂无评论

FORTIFYING ANDROID SECURITY: HYPERPARAMETER TUNED DEEP LEARNING APPROACH FOR ROBUST software vulnerability DETECTION

引用

FRACTALS-COMPLEX GEOMETRY PATTERNS AND SCALING IN NATURE AND SOCIETY 2025年第2期33卷

作者： Alzaben, Nada Alashjaee, Abdullah m. Maray, Mohammed Alotaibi, Shoayee dlaim Alharbi, Abeer a. k. Sayed, Ahmed Princess Nourah bint Abdulrahman Univ PNU Coll Comp & Informat Sci Dept Comp Sci POB 84428 Riyadh 11671 Saudi Arabia Northern Border Univ Fac Comp & Informat Technol Dept Comp Sci Rafha 91911 Saudi Arabia King Khalid Univ Coll Comp Sci Dept Informat Syst Abha Saudi Arabia Univ Hail Coll Comp Sci & Engn Dept Artificial Intelligence & Data Sci Hail Saudi Arabia Imam Mohammad Ibn Saud Islamic Univ IMSIU Coll Comp & Informat Sci Dept Informat Syst Riyadh 11432 Saudi Arabia Future Univ Egypt Egypt Res Ctr New Cairo 11835 Egypt

Detecting software vulnerabilities is a vital component of cybersecurity, concentrating on identifying and remedying weaknesses or flaws in software that malicious actors could exploit. Improving Android security includes using robust software vulnerability detection processes to identify and mitigate possible threats. Leveraging advanced methods like dynamic and static analysis and machine learning (ML) approaches with fractals theories these models early scan Android apps for vulnerabilities. Effectual software vulnerability detection is critical to mitigate safety risks, security systems, and data from cyber-attacks. Android malware detection employing deep learning (DL) supports the control of neural networks (NNs) for identifying and mitigating malicious apps targeting the Android and Complex Systems platforms. DL approaches, namely recurrent neural networks (RNNs) and convolutional neural networks (CNNs) can be trained on massive datasets encompassing benign and malicious samples. This study develops a Hyperparameter Tuned Deep Learning Approach for Robust software vulnerability Detection (HPTDLA-RSVD) technique. The primary aim of the HPTDLA-RSVD technique is to ensure Android malware security using an optimal DL model. In the HPTDLA-RSVD technique, the min-max normalization method is applied to scale the input data into a uniform format. In addition, the HPTDLA-RSVD methodology employs ant lion fractal optimizer (ALO)-based feature selection (FS) named ALO-FS methodology for choosing better feature sets. Besides, the HPTDLA-RSVD technique uses a deep belief network (DBN) model for vulnerability detection and classification. Moreover, the slime mould algorithm (SMA) has been executed to boost the hyperparameter tuning process of the DBN approach. The experimental value of the HPTDLA-RSVD approach can be examined by deploying a benchmark database. The simulation outcomes implied that the HPTDLA-RSVD approach performs better than existing approaches with respec

关键词： software vulnerability Cybersecurity Deep Learning Ant Lion Fractal Optimizer Hyperparameter Tuning

来源：评论

学校读者我要写书评

暂无评论

Improving software vulnerability severity prediction model performance with HDLN & FWFS: a two-stage feature selection approach

引用

software QUALITY JOURNAL 2025年第1期33卷 1-32页

作者： Malhotra, Ruchika Vidushi Delhi Technol Univ Dept Software Engn New Delhi India Vivekananda Inst Profess Studies Tech Campus Sch Engn & Technol New Delhi India

software vulnerability Severity Prediction (SVSP) is an evolving domain of software engineering. Ensuring the robustness and continuous operation of software systems relies heavily on the accuracy of SVSP models. However, the effectiveness of SVSP models relies heavily on the features used for training. The presence of redundant, correlated, or irrelevant features can significantly degrade model performance. To address this issue, researchers employ Feature Selection (FS) methods to streamline feature sets, reducing computational costs in model development. However, selecting appropriate FS methods and utilizing their combined strength to achieve a more efficient model remains a challenge in many existing techniques documented in the literature. In this paper, to overcome the problems associated with a large number of features, two new FS modules are proposed which have not been explored so far. The first module employs a combination of Convolutional Neural Network and Bidirectional Long Short-Term Memory, referred to as the Hybrid Deep Learning Network (HDLN) module while the second module utilizes Information Gain and Grey Wolf Optimization techniques, forming the Filter Wrapper Feature Selection (FWFS) module. The efficacy of the proposed feature selection approach is evaluated through the Area under the Curve (AUC). Upon analyzing the results, it is determined that the proposed module enhances the performance of the SVSP model. The prediction models crafted using the HDLN module exhibited the most superior performance, boasting an average AUC value of 0.88. Following closely, the FWFS module, employing Extreme Gradient Boosting as a classifier, demonstrated the second-best performance, achieving an average AUC value of 0.86.

关键词： Hybrid Feature Selection Prediction Model software vulnerability Machine learning algorithms

来源：评论

学校读者我要写书评

暂无评论

software vulnerability Detection: A Comparison of Statistical and Machine Learning Algorithms

引用

INTERNATIONAL JOURNAL OF RELIABILITY QUALITY AND SAFETY ENGINEERING 2025年

作者： Peerzada, Bareen Kumar, Deepak Amity Univ Amity Inst Informat Technol Noida Uttar Pradesh India

software vulnerabilities can be defined as potential threats to an existing software structure. With the advent of networks and the internet to far and wide places, the software has become vulnerable to attacks by elements irrespective of their geographical locations. It would need consistent efforts and constant upgradation of vulnerability detection methods to keep up with the attacks. Machine learning methods can be used to detect vulnerabilities in less time. The proposed work's main aim is to find the best possible methods to improve vulnerability detection. Classical statistical methods as well as hyper-tuned machine learning methods have been used to analyze vulnerability detection. The proposed work has employed the grid search method to improve the accuracy of SVM and neural networks. This study aims to move toward machine learning methods of vulnerability detection from classical statistical techniques with the help of empirical results, charts and graphs.

关键词： software defect vulnerability machine learning patching software vulnerability

来源：评论

学校读者我要写书评

暂无评论

software vulnerability Detection Using Deep Neural Networks: A Survey

引用

PROCEEDINGS OF THE IEEE 2020年第10期108卷 1825-1848页

作者： Lin, Guanjun Wen, Sheng Han, Qing-Long Zhang, Jun Xiang, Yang Sanming Univ Sch Informat Engn Sanming 365004 Fujian Peoples R China Swinburne Univ Technol Sch Software & Elect Engn Melbourne Vic 3122 Australia

The constantly increasing number of disclosed security vulnerabilities have become an important concern in the software industry and in the field of cybersecurity, suggesting that the current approaches for vulnerability detection demand further improvement. The booming of the open-source software community has made vast amounts of software code available, which allows machine learning and data mining techniques to exploit abundant patterns within software code. Particularly, the recent breakthrough application of deep learning to speech recognition and machine translation has demonstrated the great potential of neural models' capability of understanding natural languages. This has motivated researchers in the software engineering and cybersecurity communities to apply deep learning for learning and understanding vulnerable code patterns and semantics indicative of the characteristics of vulnerable code. In this survey, we review the current literature adopting deep-learning-/neural-network-based approaches for detecting software vulnerabilities, aiming at investigating how the state-of-the-art research leverages neural techniques for learning and understanding code semantics to facilitate vulnerability discovery. We also identify the challenges in this new field and share our views of potential research directions.

关键词： Computer security Semantics Feature extraction Open source software Neural networks Deep learning Computer bugs Cybersecurity deep neural network (DNN) machine learning (ML) representation learning software vulnerability

来源：评论

学校读者我要写书评

暂无评论

software vulnerability: Definition, modelling, and practical evaluation for e-mail transfer software

引用

INTERNATIONAL JOURNAL OF PRESSURE VESSELS AND PIPING 2006年第4期83卷 256-261页

作者： Kimura, Mitsuhiro Hosei Univ Fac Engn Dept Ind & Syst Engn Koganei Tokyo 1848584 Japan

This paper proposes a method of assessing software vulnerability quantitatively. By expanding the concept of the IPO (input-program-output) model, we first define the software vulnerability and construct a stochastic model. Then we evaluate the software vulnerability of the sendmail system by analyzing the actual security-hole data, which were collected from its release note. Also we show the relationship between the estimated software reliability and vulnerability of the analyzed system. (c) 2006 Elsevier Ltd. All rights reserved.

关键词： software reliability software vulnerability malicious users nonhomogeneous Poisson process

来源：评论

学校读者我要写书评

暂无评论

software vulnerability Assessment: Vendor, Scanner, and User Analysis 13

Software Vulnerability Assessment: Vendor, Scanner, and User...

引用

13th IEEE International Conference on Cloud Computing Technology and Science (CloudCom)

作者： Boonchuay, Kietthibhum Siripaktanakon, Wachirawich Sangpetch, Orathai Sangpetch, Akkarit

ISBN: (纸本)9781665463676

Given the complexity of existing software stacking on top of each other, many vulnerabilities are just waiting to be discovered. Certain vulnerabilities can lead to severe exploitation and loss. In this paper, we try to understand how safely we, as users, are against potential exploitations due to known vulnerabilities found in commonly used software. First, we assess the capability of current vulnerability scanners to detect known vulnerabilities. In our analysis, we use 6 months of the real vulnerability scanning log. Surprisingly, our analysis shows that the existing vulnerability scanners could take at least 2,999 days to discover 90% of the known vulnerabilities and 50% of the high-severity-level vulnerabilities could take 3,328 days to be discovered. Then, we evaluate the effectiveness of existing software vendors patching mechanisms by measuring how long the computing devices were exposed before being patched. Our investigation suggests where we should improve to lower the risk of exploitations.

关键词： software vulnerability vulnerability Assessment Data Analysis and Interpretation

来源：评论

学校读者我要写书评

暂无评论

software vulnerability Severity Evaluation Based on Economic Losses 1

引用

International Standard Conference on Trustworthy Computing and Services (ISCTCS)

作者： Yang, Yunxue Jin, Shuyuan He, Xiaowei Chinese Acad Sci Inst Comp Technol CAS Key Lab Network Data Sci & Technol Beijing Peoples R China

ISBN: (数字)9783662474013

ISBN: (纸本)9783662474013;9783662474006

Enterprises suffer economic losses due to vulnerability exploitation. The aim of this paper is to propose a comprehensive software vulnerability severity evaluation model incorporating technical assessment and circumstances information of enterprises, especially economic losses caused by vulnerability exploitation. We use analytic hierarchy process to establish the model and get weights of evaluation factors, obtaining both of qualitative severity ranking levels and quantitative severity scores of vulnerabilities. Through case study, we show that evaluation values are accurate and effective and consequently, our model can be used for security improvement prioritization.

关键词： software vulnerability vulnerability evaluation Economic losses Analytic hierarchy process CVSS

来源：评论

学校读者我要写书评

暂无评论

software vulnerability Detection using Large Language Models 34

Software Vulnerability Detection using Large Language Models

引用

34th IEEE International Symposium on software Reliability Engineering (ISSRE)

作者： Das Purba, Moumita Ghosh, Arpita Radford, Benjamin J. Chu, Bill Univ N Carolina Dept Software & Informat Syst Charlotte NC 28223 USA Univ N Carolina Dept Polit Sci & Publ Adm Charlotte NC USA

ISBN: (纸本)9798350319569

software development is among the first demonstrations of using Large Language Models (LLMs) to enhance human productivity. Such a co-pilot paradigm envisions LLM working side-by-side with human developers to assist in programming tasks. Ensuring the security of software products is a critical factor for the success of such a paradigm. There have been various anecdotal reports on the success of using LLMs to detect vulnerabilities in programs. This paper reports a set of experiments applying four well-known LLMs to two widely referenced public datasets to evaluate the performance of LLMs in detecting software vulnerabilities. Our results show a significant performance gap between these LLMs and those from popular static analysis tools, primarily due to their high false positive rates. However, LLMs show great promise in identifying subtle patterns commonly associated with software vulnerabilities. This observation suggests a possible path forward by combining LLMs and other program analysis techniques to achieve better software vulnerability detection.

关键词： Cybersecurity Large language model AI software vulnerability

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：