论文标题
检查代码和建筑气味与软件漏洞的关系
Examining the Relationship of Code and Architectural Smells with Software Vulnerabilities
论文作者
论文摘要
上下文：安全对于为商业或个人使用开发的软件至关重要。尽管越来越多的组织正在意识到应用安全编码实践的重要性，但在许多组织中，在安全故障发生之前，不知道或解决安全问题。安全故障的根本原因是脆弱的代码。尽管指标已用于预测软件漏洞，但我们探索了与安全弱点的代码和建筑气味之间的关系。由于气味是软件中更深层问题的表面指标，因此确定气味和软件漏洞之间的关系可以在脆弱性预测模型中发挥重要作用。目的：本研究探讨了气味与软件脆弱性之间的关系以识别气味。方法：我们为三个系统提取了类，方法，文件和软件包的气味：Apache Tomcat，Apache CXF和Android。然后，我们比较了它们在脆弱类中的出现，这些类别据报道包含脆弱的代码和中立类（尚未报告尚无脆弱性的不可挖掘类）。结果：我们发现，与不可挖掘的类别相比，脆弱的阶级更有可能有某些气味。 God class，Complex Class，大型班级，数据类，功能羡慕，大脑类与软件漏洞具有统计学意义。我们发现建筑气味与软件漏洞之间没有显着关系。结论：我们可以得出结论，对于所检查的所有系统，软件漏洞和某些气味之间存在统计学意义的相关性。
Context: Security is vital to software developed for commercial or personal use. Although more organizations are realizing the importance of applying secure coding practices, in many of them, security concerns are not known or addressed until a security failure occurs. The root cause of security failures is vulnerable code. While metrics have been used to predict software vulnerabilities, we explore the relationship between code and architectural smells with security weaknesses. As smells are surface indicators of a deeper problem in software, determining the relationship between smells and software vulnerabilities can play a significant role in vulnerability prediction models. Objective: This study explores the relationship between smells and software vulnerabilities to identify the smells. Method: We extracted the class, method, file, and package level smells for three systems: Apache Tomcat, Apache CXF, and Android. We then compared their occurrences in the vulnerable classes which were reported to contain vulnerable code and in the neutral classes (non-vulnerable classes where no vulnerability had yet been reported). Results: We found that a vulnerable class is more likely to have certain smells compared to a non-vulnerable class. God Class, Complex Class, Large Class, Data Class, Feature Envy, Brain Class have a statistically significant relationship with software vulnerabilities. We found no significant relationship between architectural smells and software vulnerabilities. Conclusion: We can conclude that for all the systems examined, there is a statistically significant correlation between software vulnerabilities and some smells.
