A Preliminary Study Examining Relationships Between Nano-Patterns and Software Security Vulnerabilities
Document Type
Conference Proceeding
Publication Date
8-24-2016
Abstract
Software security plays a significant role in ensuring software quality. The goal of this study is to conduct a preliminary analysis to find hidden relationships between source code patterns and security defects. We describe a study in which we focus on evaluating software security using nano-patterns to reduce security risks during the development lifecycle. Nano-patterns are simple properties of Java methods. In our research, we investigate the correlation between software vulnerabilities and nano-patterns using data mining techniques. Identifying these relationships can assist developers to quickly assess the likelihood that they are writing vulnerable code and recommend tests to uncover the vulnerability. The goal of this research is to reduce the amount of vulnerable code developers write. We successfully apply data mining techniques to identify vulnerable code characteristics and apply hypothesis testing to validate the findings. This preliminary study shows that certain nano-patterns localReader, jdkClient, tailCaller are significantly present in vulnerable methods. These findings can be used to recommend security test patterns to improve vulnerability testing and reduce the number of vulnerabilities in released code.
DOI
10.1109/COMPSAC.2016.34
Montclair State University Digital Commons Citation
Sultana, Kazi Zakia; Deo, Ajay; and Williams, Byron J., "A Preliminary Study Examining Relationships Between Nano-Patterns and Software Security Vulnerabilities" (2016). Department of Computer Science Faculty Scholarship and Creative Works. 57.
https://digitalcommons.montclair.edu/compusci-facpubs/57