Abstract
Software problems are the main cause of system failures today which can lead to financial losses and software vulnerabilities as the greatest threats. Security vulnerabilities are a particular case of software faults. Software engineers are often unable to keep track of vulnerabilities that other developers have reported and solved. Quantitative quality metrics are often subdued due to lack of adequate amounts of people, time, and resources. Security-related software vulnerabilities are typically hard to quantify and even harder to predict or relate to any process improvement initiatives and activities. There is much research about how to detect or avoid software vulnerabilities; however, in this work we focus on software vulnerability discovery prediction, which can help improve the secure deployment of software applications. There are a few vulnerability discovery models (VDMs) proposed in literature, yet those models require a high quantity of vulnerability data of the target application in order to work; further, VDMs cannot adapt to abrupt increment or decrement of the vulnerability discovery trends in a short time interval. Hence, a generalized Parr-curve (GPC) model with an initial prediction scheme is proposed and used in order to predict software vulnerabilities. The number of total vulnerabilities in the application is first roughly predicted; afterward, the GPC model can be further used when the software historical vulnerability data is available. The proposed vulnerability discovery model can adapt to abrupt increment or decrement of the discovery trends in a short time interval by applying change-points to proper positions of the data. In the experiment, we have used the GPC model with the initial prediction scheme in order to predict vulnerability discovery in Mozilla Firefox. The result shows that the proposed GPC model outperforms other VDMs, especially in those with abruptly changing data.