Skip to main content

The Random Neural Network as a Bonding Model for Software Vulnerability Prediction

  • Conference paper
  • First Online:
Modelling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS 2020)

Part of the book series: Lecture Notes in Computer Science ((LNCCN,volume 12527))

Abstract

Software vulnerability prediction is an important and active area of research where new methods are needed to build accurate and efficient tools that can identify security issues. Thus we propose an approach based on mixed features that combines text mining features and the features generated using a Static Code Analyzer. We use a Random Neural Network as a bonding model that combines the text analysis that is carried out on software using a Convolutional Neural Network, and the outputs of Static Code Analysis. The proposed approach was evaluated on commonly used datasets and led to 97% training accuracy, and 93%–94% testing accuracy, with a 1% reduction in false positives with respect to previously published results on similar data sets.

This research was funded by the European Commission (EC) through the EU H2020 IoTAC Research and Innovation Action under Grant Agreement ID: 952684, and through the EU H2020 SDK4ED Research and Innovation Action under Grant Agreement ID: 780572. The EC’s financial support does not constitute an endorsement of this paper, which reflects the views only of the authors.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Ajit, A., Acharya, K., Samanta, A.: A review of convolutional neural networks. In: 2020 International Conference on Emerging Trends in Information Technology and Engineering (ic-ETITE), Vellore, India. pp. 1–5. IEEEXpress (2020). https://doi.org/10.1109/ic-ETITE47903.2020.049

  2. Alves, H., Fonseca, B., Antunes, N.: Software metrics and security vulnerabilities: dataset and exploratory study. In: 2016 12th European Dependable Computing Conference (EDCC), pp. 37–44 (2016)

    Google Scholar 

  3. Amin, A., Eldessouki, A., Magdy, M.T., Abdeen, N., Hindy, H., Hegazy, I.: Androshield: automated android applications vulnerability detection, a hybrid static and dynamic analysis approach. Information 10(10), 326 (2019)

    Article  Google Scholar 

  4. Brun, O., Yin, Y., Gelenbe, E.: Deep learning with dense random neural network for detecting attacks against IoT-connected home environments. Procedia Comput. Sci. 134, 458–463 (2018)

    Article  Google Scholar 

  5. Brun, O., Wang, L., Gelenbe, E.: Big data for autonomic intercontinental overlays. IEEE J. Sel. Areas Commun. 34(3), 575–583 (2016)

    Article  Google Scholar 

  6. Catal, C., Akbulut, A., Ekenoglu, E., Alemdaroglu, M.: Development of a software vulnerability prediction web service based on artificial neural networks. In: Kang, U., Lim, E.-P., Yu, J.X., Moon, Y.-S. (eds.) PAKDD 2017. LNCS (LNAI), vol. 10526, pp. 59–67. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-67274-8_6

    Chapter  Google Scholar 

  7. Computer Emergency Response Team Coordination Center. https://www.kb.cert.org/vuls/ Accessed 05 Aug 2020

  8. Chowdhury, I., Zulkernine, M.: Using complexity, coupling, and cohesion metrics as early indicators of vulnerabilities. J. Syst. Architect. 57(3), 294–313 (2011)

    Article  Google Scholar 

  9. Cisco 2019 Annual Report. (Cisco 2019). https://www.cisco.com/c/dam/en_us/about/annual-report/cisco-annual-report-2019.pdf Accessed 05 Aug 2020

  10. Cisco Cybersecurity Series 2019. Consumer Privacy Survey. (Cisco 2019). https://www.cisco.com/c/dam/en_us/about/annual-report/cisco-annual-report-2019.pdf Accessed 05 Aug 2020

  11. CWE Top 25 Most Dangerous Software Errors. https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html Accessed 05 Aug 2020

  12. Dam, H.K., Tran, T., Pham, T., Ng, S.W., Grundy, J., Ghose, A.: Automatic feature learning for vulnerability prediction. arXiv preprint arXiv:1708.02368 (2017)

  13. Ding, Y., et al.: Poster: Rust SGX SDK: Towards memory safety in intel SGX enclave. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 2491–2493 (2017)

    Google Scholar 

  14. Dobson, S., et al.: A survey of autonomic communications. ACM Trans. Auton. Adapt. Syst. (TAAS) 1(2), 223–259 (2006)

    Article  Google Scholar 

  15. Du, X., et al.: Leopard: Identifying vulnerable code for vulnerability assessment through program metrics. In: 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), pp. 60–71 (2019)

    Google Scholar 

  16. Enabling Open Innovation & Collaboration | The Eclipse Foundation. https://www.eclipse.org/ Accessed 05 Aug 2020

  17. Evmorfos, S., Vlachodimitropoulos, G., Bakalos, N., Gelenbe, E.: Neural network architectures for the detection of SYN flood attacks in IoT systems. In: Proceedings of the 13th ACM International Conference on PErvasive Technologies Related to Assistive Environments, no. 69, pp. 1–4. ACM (2020) https://doi.org/10.1145/3389189.3398000

  18. Fourneau, J.M., Gelenbe, E.: G-networks with adders. Future Internet 9(3), 34 (2017)

    Article  Google Scholar 

  19. Francois, F., Gelenbe, E.: Optimizing secure SDN-enabled inter-data centre overlay networks through cognitive routing. In: 2016 IEEE 24th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS), pp. 283–288. IEEE (2016)

    Google Scholar 

  20. Francois, F., Gelenbe, E.: Towards a cognitive routing engine for software defined networks. In: 2016 IEEE International Conference on Communications (ICC), pp. 1–6. IEEE (2016)

    Google Scholar 

  21. Fröhlich, P., Gelenbe, E.: Optimal fog services placement in SDN IoT network using random neural networks and cognitive network map. In: Rutkowski, L., Scherer, R., Korytkowski, M., Pedrycz, W., Tadeusiewicz, R., Zurada, J.M. (eds.) ICAISC 2020. LNCS (LNAI), vol. 12415, pp. 78–89. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-61401-0_8

    Chapter  Google Scholar 

  22. Frohlich, P., Gelenbe, E., Nowak, M.P.: Smart SDN management of fog services. In: GIOTS 2020: Global IoT Summit 2020, IEEE Communications Society, pp. 1–5 June 2020, Dubin, Ireland. TechRxiv (2020)

    Google Scholar 

  23. Gegick, M., Williams, L.: Toward the use of automated static analysis alerts for early identification of vulnerability-and attack-prone components. In: Second International Conference on Internet Monitoring and Protection (ICIMP 2007), pp. 18–18. IEEE (2007)

    Google Scholar 

  24. Gelenbe, E.: Learning in the recurrent random neural network. Neural Comput. 5, 154–164 (1993)

    Article  Google Scholar 

  25. Gelenbe, E., Feng, Y., Krishnan, K.R.R.: Neural network methods for volumetric magnetic resonance imaging of the human brain. Proc. IEEE 84(10), 1488–1496 (1996)

    Article  Google Scholar 

  26. Gelenbe, E.: Random neural networks with negative and positive signals and product form solution. Neural Comput. 1(4), 502–510 (1989)

    Article  Google Scholar 

  27. Gelenbe, E.: Stability of the random neural network model. Neural Comput. 2(2), 239–247 (1990)

    Article  Google Scholar 

  28. Gelenbe, E.: G-networks with signals and batch removal. Probab. Eng. Inf. Sci. 7(3), 335–342 (1993)

    Article  Google Scholar 

  29. Gelenbe, E.: Steps toward self-aware networks. Commun. ACM 52(7), 66–75 (2009)

    Article  Google Scholar 

  30. Gelenbe, E.: Machine learning for network routing. In: 2020 9th Mediterranean Conference on Embedded Computing (MECO), pp. 1–1. IEEE (2020)

    Google Scholar 

  31. Gelenbe, E., Domanska, J., Frohlich, P., Nowak, M., Nowak, S.: Self-aware networks that optimize security, Qos and energy. In: Proceedings of the IEEE, accepted for publication, vol. 108 no. 7 (2020)

    Google Scholar 

  32. Gelenbe, E., Fourneau, J.M.: Random neural networks with multiple classes of signals. Neural Comput. 11(4), 953–963 (1999)

    Article  Google Scholar 

  33. Gelenbe, E., Hussain, K., Kaptan, V.: Simulating autonomous agents in augmented reality. J. Syst. Softw. 74(2), 255–268 (2005)

    Article  Google Scholar 

  34. Gelenbe, E., Hussain, K., Kaptan, V.: Simulating autonomous agents in augmented reality. J. Syst. Softw. 74(3), 255–268 (2005)

    Article  Google Scholar 

  35. Gelenbe, E., Koçak, T.: Area-based results for mine detection. IEEE Trans. Geosci. Remote Sens. 38(1), 12–24 (2000)

    Article  Google Scholar 

  36. Gelenbe, E., Lent, R., Nunez, A.: Self-aware networks and Qos. Proc. IEEE 92(9), 1478–1489 (2004)

    Article  Google Scholar 

  37. Gelenbe, E., Lent, R., Xu, Z.: Measurement and performance of a cognitive packet network. Comput. Netw. 37(6), 691–701 (2001)

    Article  MATH  Google Scholar 

  38. Gelenbe, E., Liu, P., Laine, J.: Genetic algorithms for route discovery. IEEE Trans. Syst. Man Cybern. Part B (Cybernetics) 36(6), 1247–1254 (2006)

    Google Scholar 

  39. Gelenbe, E., Loukas, G.: A self-aware approach to denial of service defence. Comput. Netw. 51(5), 1299–1314 (2007)

    Article  MATH  Google Scholar 

  40. Gelenbe, E., Montuori, A., Nunez, A., Lent, R., Xu, Z.: Experiments with Qos driven learning packet networks. Internet Process Coordination, CRC Press, Boca Raton, pp. 215–233 (2020)

    Google Scholar 

  41. Gelenbe, E., Sungur, M., Cramer, C.: Learning random networks for compression of still and moving images. JPL: A Decade of Neural Networks; Practical Applications and Prospects, pp. 171–189 (1994)

    Google Scholar 

  42. Gelenbe, E., Wu, F.J.: Large scale simulation for human evacuation and rescue. Comput. Math. Appl. 64(12), 3869–3880 (2012)

    Article  Google Scholar 

  43. Gelenbe, E., Wu, F.J.: Future research on cyber-physical emergency management systems. Future Internet 5(3), 336–354 (2013)

    Article  Google Scholar 

  44. Gelenbe, E., Yin, Y.: Deep learning with dense random neural networks. In: Gruca, A., Czachórski, T., Harezlak, K., Kozielski, S., Piotrowska, A. (eds.) Gelenbe, E., Yin, Y.: Deep learning with dense random neural networks. In: International Conference on Man-Machine Interactions. pp. 3–18. Springer, Cham (2017). AISC, vol. 659, pp. 3–18. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-67792-7_1

    Chapter  Google Scholar 

  45. He, Z., Chen, W., Li, Z., Zhang, W., Shao, H., Zhang, M.: Syntax-aware entity representations for neural relation extraction. Artif. Intell. 275, 602–617 (2019)

    Article  MathSciNet  MATH  Google Scholar 

  46. Hussain, K., Moussa, G.: On-road vehicle classification based on random neural network and bag-of-visual words. Probab. Eng. Inf. Sci. 30(3), 403–412 (2016)

    Article  MathSciNet  Google Scholar 

  47. Hussain, K., Yousef, M., Gelenbe, E.: Accurate and energy-efficient classification with spiking random neural network. Probab. Eng. Inf. Sci., 1–11 (2019). https://doi.org/10.1017/S0269964819000147

  48. Hussain, K.F., Radwan, E., Moussa, G.S.: Augmented reality experiment: Drivers’ behavior at an unsignalized intersection. IEEE Trans. Intell. Trans. Syst. 14(2), 608–617 (2013)

    Article  Google Scholar 

  49. IntelliJ IDEA: The Java IDE for Professional Developers by JetBrains. https://www.jetbrains.com/idea/ Accessed 05 Aug 2020

  50. Jackson, K.A., Bennett, B.T.: Locating SQL injection vulnerabilities in java byte code using natural language techniques. SoutheastCon 2018, 1–5 (2018)

    Google Scholar 

  51. Jimenez, M., Papadakis, M., Le Traon, Y.: Vulnerability prediction models: A case study on the linux kernel. In: 2016 IEEE 16th International Working Conference on Source Code Analysis and Manipulation (SCAM), pp. 1–10 (2016)

    Google Scholar 

  52. Kaptan, V., Gelenbe, E.: Fusing terrain and goals: agent control in urban environments. In: Multisensor, Multisource Information Fusion: Architectures, Algorithms, and Applications 2006. vol. 6242, p. 624208. International Society for Optics and Photonics (2006)

    Google Scholar 

  53. Keras Functional API. https://keras.io/guides/functional_api/ Accessed 06 Aug 2020

  54. Klees, G., Ruef, A., Cooper, B., Wei, S., Hicks, M.: Evaluating fuzz testing. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 2123–2138 (2018)

    Google Scholar 

  55. Kobak, D., Berens, P.: The art of using t-SNE for single-cell transcriptomics. Nature Commun. 10(1), 1–14 (2019)

    Article  Google Scholar 

  56. Kudjo, P.K., Chen, J., Zhou, M., Mensah, S., Huang, R.: Improving the accuracy of vulnerability report classification using term frequency-inverse gravity moment. In: 2019 IEEE 19th International Conference on Software Quality, Reliability and Security (QRS), pp. 248–259 (2019)

    Google Scholar 

  57. Lan, M., Zhang, Y., Zhang, L., Du, B.: Global context based automatic road segmentation via dilated convolutional neural network. Inf. Sci. 535, 156–171 (2020)

    Article  MathSciNet  Google Scholar 

  58. Li, Z., Yang, W., Peng, S., Liu, F.: A survey of convolutional neural networks: Analysis, applications, and prospects (2020)

    Google Scholar 

  59. Li, Z., et al.: Vuldeepecker: A deep learning-based system for vulnerability detection. arXiv preprint arXiv:1801.01681 (2018)

  60. Liu, J., Li, Q., Yang, H., Han, Y., Jiang, S., Chen, W.: Sequence fault diagnosis for PEMFC water management subsystem using deep learning with t-SNE. IEEE Access 7, 92009–92019 (2019)

    Article  Google Scholar 

  61. Moshtari, S., Sami, A., Azimi, M.: Using complexity metrics to improve software security. Comput. Fraud Secur. 2013(5), 8–17 (2013)

    Article  Google Scholar 

  62. Nafi, K.W., Roy, B., Roy, C.K., Schneider, K.A.: A universal cross language software similarity detector for open source software categorization. J. Syst. Softw. 162, 110491 (2020)

    Article  Google Scholar 

  63. Neuhaus, S., Zimmermann, T., Holler, C., Zeller, A.: Predicting vulnerable software components. In: Proceedings of the 14th ACM Conference on Computer and Communications Security, pp. 529–540 (2007)

    Google Scholar 

  64. Öke, G., Loukas, G.: A denial of service detector based on maximum likelihood detection and the random neural network. Comput. J. 50(6), 717–727 (2007)

    Article  Google Scholar 

  65. Oke, G., Loukas, G., Gelenbe, E.: Detecting denial of service attacks with bayesian classifiers and the random neural network. In: 2007 IEEE International Fuzzy Systems Conference, pp. 1–6. IEEE (2007)

    Google Scholar 

  66. Open Web Application Security Project (OWASP). https://owasp.org/ Accessed 05 Aug 2020

  67. OWASP Secure Coding Practices Quick Reference Guide. https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_v1.pdf Accessed 05 Aug 2020

  68. OWASP Top Ten. https://owasp.org/www-project-top-ten/ Accessed 05 Aug 2020

  69. Pang, Y., Xue, X., Wang, H.: Predicting vulnerable software components through deep neural network. In: Proceedings of the 2017 International Conference on Deep Learning Technologies, pp. 6–10 (2017)

    Google Scholar 

  70. Saeed, A., Ahmadinia, A., Javed, A., Larijani, H.: Intelligent intrusion detection in low-power IoTs. ACM Trans. Internet Technol. (TOIT) 16(4), 1–25 (2016)

    Article  Google Scholar 

  71. Salka, C.: Programming languages and systems security. IEEE Secur. Priv. 3(3), 80–83 (2005)

    Article  Google Scholar 

  72. Information Security Training - SANS Cyber Security Certifications & Research. https://www.sans.org/ Accessed 05 Aug 2020

  73. Scalabrino, S., Grano, G., Di Nucci, D., Oliveto, R., De Lucia, A.: Search-based testing of procedural programs: iterative single-target or multi-target approach? In: International Symposium on Search Based Software Engineering, pp. 64–79 (2016)

    Google Scholar 

  74. Scandariato, R., Walden, J., Hovsepyan, A., Joosen, W.: Predicting vulnerable software components via text mining. IEEE Trans. Softw. Eng. 40(10), 993–1006 (2014)

    Article  Google Scholar 

  75. Serrano, W., Gelenbe, E.: Deep learning clusters in the cognitive packet network. Neurocomputing 396, 406–428 (2020)

    Article  Google Scholar 

  76. Serrano, W., Gelenbe, E., Yin, Y.: The random neural network with deep learning clusters in smart search. Neurocomputing 396, 394–405 (2020)

    Article  Google Scholar 

  77. Sherriff, M., Heckman, S.S., Lake, M., Williams, L.: Identifying fault-prone files using static analysis alerts through singular value decomposition. In: Proceedings of the 2007 conference of the center for advanced studies on Collaborative research, pp. 276–279 (2007)

    Google Scholar 

  78. Shin, Y., Meneely, A., Williams, L., Osborne, J.A.: Evaluating complexity, code churn, and developer activity metrics as indicators of software vulnerabilities. IEEE Trans. Softw. Eng. 37(6), 772–787 (2010)

    Article  Google Scholar 

  79. Siavvas, M., Gelenbe, E., Kehagias, D., Tzovaras, D.: Static analysis-based approaches for secure software development. In: International ISCIS Security Workshop, pp. 142–157 (2018)

    Google Scholar 

  80. SonarQube. https://www.sonarqube.org/ Accessed 03 Aug 2020

  81. Tang, Y., Zhao, F., Yang, Y., Lu, H., Zhou, Y., Xu, B.: Predicting vulnerable components via text mining or software metrics? an effort-aware perspective. In: 2015 IEEE International Conference on Software Quality, Reliability and Security, pp. 27–36 (2015)

    Google Scholar 

  82. Thaseen, I.S., Kumar, C.A.: Intrusion detection model using fusion of chi-square feature selection and multi class SVM. J. King Saud Univ. Comput. Inf. Sci. 29(4), 462–472 (2017)

    Google Scholar 

  83. Timotheou, S.: A novel weight initialization method for the random neural network. Neurocomputing 73(1), 160–168 (2009)

    Article  Google Scholar 

  84. Timotheou, S.: The random neural network: a survey. Comput. J. 53(3), 251–267 (2010)

    Article  MATH  Google Scholar 

  85. Veracode: State of software security. Technical Report (2016)

    Google Scholar 

  86. Veracode: State of software security, vol. 9, Technical Report (2018)

    Google Scholar 

  87. Veracode. https://www.veracode.com/ Accessed 05 Aug 2020

  88. Visual Studio IDE, Code Editor, Azure DevOps, & App Center - Visual Studio. https://visualstudio.microsoft.com/ Accessed 05 Aug 2020

  89. Walden, J., Stuckman, J., Scandariato, R.: Predicting vulnerable components: software metrics vs text mining. In: 2014 IEEE 25th International Symposium on Software Reliability Engineering, pp. 23–33 (2014)

    Google Scholar 

  90. Wang, L., Brun, O., Gelenbe, E.: Adaptive workload distribution for local and remote clouds. In: 2016 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 003984–003988. IEEE (2016)

    Google Scholar 

  91. Wang, L., Gelenbe, E.: Real-time traffic over the cognitive packet network. In: Gaj, P., Kwiecień, A., Stera, P. (eds.) CN 2016. CCIS, vol. 608, pp. 3–21. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-39207-3_1

    Chapter  Google Scholar 

  92. Wang, X., Sun, J., Chen, Z., Zhang, P., Wang, J., Lin, Y.: Towards optimal concolic testing. In: Proceedings of the 40th International Conference on Software Engineering, pp. 291–302 (2018)

    Google Scholar 

  93. Wu, J., Liu, X., Hu, X., Zhu, J.: Popmnet: generating structured pop music melodies using neural networks. Artif. Intell. 286, 103303 (2020)

    Google Scholar 

  94. Wu, Y., Ma, Y., Liu, J., Du, J., Xing, L.: Self-attention convolutional neural network for improved MR image reconstruction. Inf. Sci. 490, 317–328 (2019)

    Article  MathSciNet  Google Scholar 

  95. Yin, Y., Gelenbe, E.: A classifier based on spiking random neural network function approximator (2018)

    Google Scholar 

  96. Yin, Y., Wang, L., Gelenbe, E.: Multi-layer neural networks for quality of service oriented server-state classification in cloud servers. In: 2017 International Joint Conference on Neural Networks (IJCNN), pp. 1623–1627. IEEE (2017)

    Google Scholar 

  97. Yin, Y.: Deep learning with the random neural network and its applications. ArXiv abs/1810.08653 (2018)

    Google Scholar 

  98. Yin, Y., Gelenbe, E.: Deep learning in multi-layer architectures of dense nuclei. arXiv preprint arXiv:1609.07160 (2016)

  99. Zhang, M., de Carnavalet, X.D.C., Wang, L., Ragab, A.: Large-scale empirical study of important features indicative of discovered vulnerabilities to assess application security. IEEE Trans. Inf. Forensics Secur. 14(9), 2315–2330 (2019)

    Article  Google Scholar 

  100. Zhang, Y., et al.: Combining software metrics and text features for vulnerable file prediction. In: 2015 20th International Conference on Engineering of Complex Computer Systems (ICECCS), pp. 40–49 (2015)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Katarzyna Filus .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Filus, K., Siavvas, M., Domańska, J., Gelenbe, E. (2021). The Random Neural Network as a Bonding Model for Software Vulnerability Prediction. In: Calzarossa, M.C., Gelenbe, E., Grochla, K., Lent, R., Czachórski, T. (eds) Modelling, Analysis, and Simulation of Computer and Telecommunication Systems. MASCOTS 2020. Lecture Notes in Computer Science(), vol 12527. Springer, Cham. https://doi.org/10.1007/978-3-030-68110-4_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-68110-4_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-68109-8

  • Online ISBN: 978-3-030-68110-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics