Vulnerability prediction capability: A comparison between vulnerability discovery models and neural network models

• Published in: Computers & security Vol. 87; p. 101596
• Main Authors: Movahedi, Yazdan, Cukier, Michel, Gashi, Ilir
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier Ltd 01-11-2019; Elsevier Sequoia S.A
• Subjects: Bias; Comparative studies; Neural network model; Neural networks; Prediction; Predictions; Software; Software reliability; Time series; Vulnerability discovery model; Vulnerability discovery process; Vulnerability discovery model; Software reliability; Neural network model; Vulnerability discovery process; Time series; Prediction
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2019.101596

In this paper, we introduce an approach for predicting the cumulative number of software vulnerabilities that is in most cases more accurate than vulnerability discovery models (VDMs). Our approach uses a neural network model (NNM) to model the nonlinearities associated with vulnerability disclosure. Nine common VDMs were used to compare their prediction capability with our approach. The different models were applied to vulnerabilities associated with eight well-known software (four operating systems and four web browsers). The models were assessed in terms of prediction accuracy and prediction bias. Out of eight software we analyzed, the NNM outperformed the VDMs in all the cases in terms of prediction accuracy, and provided smaller values of absolute average bias in seven cases. This study shows that NNMs are promising for accurate predictions of software vulnerabilities disclosures.