Filters

Settings

Now showing1 - 2 of 2
  • Some of the metrics are blocked by your 
    consent settings
    Item type:Publication, Access status: without files ,
    Static analysis and penetration testing from the perspective of maintenance teams
    (Association for Computing Machinery (ACM), 2016-09)
    Ceccato, Mariano
    ;
    Scandariato, Riccardo
    Static analysis and penetration testing are common techniques used to discover security bugs in implementation code. Penetration testing is often performed in black-box way by probing the attack surface of a running system and discovering its security holes. Static analysis techniques operate in a white-box way by analyzing the source code of a system and identifying security weaknesses. Because of their different nature, the two techniques report their findings in two different ways. This paper presents an exploratory study meant to determine whether a vulnerability report generated by a security tool based on static analysis is more or less useful than a report generated by a security tool based on penetration testing. The usefulness is judged from the perspective of the developers that have to devise a vulnerability-fixing patch. The initial results show an advantage when using penetration testing in one of the two cases we investigated.
    Publicationtype: Conference Paper
      19
  • Some of the metrics are blocked by your 
    consent settings
    Item type:Publication, Access status: without files ,
    Is newer always better?: The case of vulnerability prediction models
    (Association for Computing Machinery (ACM), 2016-09)
    Hovsepyan, Aram
    ;
    Scandariato, Riccardo
    ;
    Joosen, Wouter
    Finding security vulnerabilities in the source code as early as possible is becoming more and more essential. In this respect, vulnerability prediction models have the potential to help the security assurance activities by identifying code locations that deserve the most attention. In this paper, we investigate whether prediction models behave like milk (i.e., they turn with time) or wine (i.e., the improve with time) when used to predict future vulnerabilities. Our findings indicate that the recall values are largely in favor of predictors based on older versions. However, the better recall comes at the price of much higher file inspection ratio values.
    Publicationtype: Conference Paper
      21