Title
A large-scale empirical study on vulnerability distribution within projects and the lessons learned
Abstract
ABSTRACTThe number of vulnerabilities increases rapidly in recent years, due to advances in vulnerability discovery solutions. It enables a thorough analysis on the vulnerability distribution and provides support for correlation analysis and prediction of vulnerabilities. Previous research either focuses on analyzing bugs rather than vulnerabilities, or only studies general vulnerability distribution among projects rather than the distribution within each project. In this paper, we collected a large vulnerability dataset, consisting of all known vulnerabilities associated with five representative open source projects, by utilizing automated crawlers and spending months of manual efforts. We then analyzed the vulnerability distribution within each project over four dimensions, including files, functions, vulnerability types and responsible developers. Based on the results analysis, we presented 12 practical insights on the distribution of vulnerabilities. Finally, we applied such insights on several vulnerability discovery solutions (including static analysis and dynamic fuzzing), and helped them find 10 zero-day vulnerabilities in target projects, showing that our insights are useful.
Year
DOI
Venue
2020
10.1145/3377811.3380923
International Conference on Software Engineering
Keywords
DocType
ISSN
Empirical Study, Vulnerability Distribution
Conference
0270-5257
Citations 
PageRank 
References 
3
0.38
0
Authors
9
Name
Order
Citations
PageRank
Bingchang Liu162.08
Guozhu Meng2273.41
Zou Wei3407.40
Qi Gong430.38
Feng Li583.46
Min Lin630.38
Dandan Sun730.38
Wei Huo8476.02
Chao Zhang942338.17