Prediction of future vulnerability discovery in software applications using vulnerability syntax tree (PFVD-VST)‎

Abstract EN

Software applications are the origin to spread vulnerabilities in systems, networks and other software applications.

Vulnerability Discovery Model (VDM) helps to encounter the susceptibilities in the problem domain.

But preventing the software applications from known and unknown vulnerabilities is quite difficult and also need large database to store the history of attack information.

We proposed a vulnerability prediction scheme named as Prediction of Future Vulnerability Discovery in Software Applications using Vulnerability Syntax Tree (PFVD-VST) which consists of five steps to address the problem of new vulnerability discovery and prediction.

First, Classification and Clustering are performed based on the software application name, status, phase, category and attack types.

Second, Code Quality is analyzed with the help of code quality measures such as, Cyclomatic Complexity, Functional Point Analysis, Coupling, Cloning between the objects, etc,.

Third, Genetic based Binary Code Analyzer (GABCA) is used to convert the source code to binary code and evaluates each bit of the binary code.

Fourth, Vulnerability Syntax Tree (VST) is trained with the help of vulnerabilities collected from National Vulnerability Database (NVD).

Finally, a combined Naive Bayesian and Decision Tree based prediction algorithm is implemented to predict future vulnerabilities in new software applications.

The experimental results of this system depicts that the prediction rate, recall, precision has improved significantly.