Empirical Validation of Software Metrics for Software Security Vulnerability Prediction

The increasing vulnerability of software systems and the potential for significant damages caused by security flaws necessitate the prediction of vulnerable components before deployment. Existing Vulnerability Prediction Models (VPMs) have not achieved an acceptable threshold for cross-project prediction performance, often sacrificing traceability for accuracy. Static analyzers suffer from false positives and false negatives. This study aims to create a software vulnerability prediction dataset with security-related metrics that have a strong indication of vulnerability. The correlation coefficient values of the primary dataset are compared to a benchmark dataset, and a random forest model is built using both datasets. The results demonstrate that the VPM dataset, which includes security-related metrics and code smell metrics in addition to traditional software metrics, exhibits higher correlation values to vulnerability. The inclusion of securityrelated metrics significantly improves the performance of VPMs, achieving precision, recall, and f-measure above 90% in within-project prediction and over 80% in cross-project prediction. The study concludes that the addition of security-related metrics and code smells to traditional software metrics in the dataset enhances the performance of VPMs.